The correct answer is that the policy must include a condition restricting the accepter VPC owner to the target account. When creating a cross-account VPC peering connection, the requester’s IAM policy must explicitly authorize the action for a specific accepter account using a condition key like ec2:AccepterVpcOwnerId or aws:SourceAccount; without this, the ec2:CreateVpcPeeringConnection call fails because the policy lacks the required cross-account authorization context. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of how IAM policies enforce resource-based permissions across accounts, often appearing as a trick where a seemingly permissive policy still fails due to missing conditions. A common trap is assuming that allowing the action alone is sufficient, but AWS requires explicit account-level scoping for cross-account operations. Remember the mnemonic “Peering without a condition is a permission omission”—always check for the accepter account condition.
ANS-C01 Network Design Practice Question
This ANS-C01 practice question tests your understanding of network design. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
IAM policy JSON:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:CreateVpcPeeringConnection",
"ec2:AcceptVpcPeeringConnection",
"ec2:DeleteVpcPeeringConnection"
],
"Resource": "*"
}
]
}
Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy must include a condition that the accepter VPC owner is the target account.
Option B is correct because when creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.
Why it's wrong here
The action is allowed with Resource "*".
✓
The policy must include a condition that the accepter VPC owner is the target account.
Why this is correct
Without a condition, the peering request may be denied if the accepter account is not specified.
Related concept
Read the scenario before looking for a memorised answer.
✗
The user needs ec2:ModifyVpcPeeringConnectionOptions permission.
Why it's wrong here
Not required for creation.
✗
The user needs ec2:CreateVpcEndpoint permission.
Why it's wrong here
VPC endpoints are not related to peering.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that the ec2:CreateVpcPeeringConnection action alone is sufficient for cross-account peering, but the trap is that the IAM policy must include a condition to specify the accepter account ID, otherwise the request fails due to missing authorization context.
Detailed technical explanation
How to think about this question
Under the hood, cross-account VPC peering requires the requester's IAM policy to include a condition that matches the accepter's AWS account ID, typically using the ec2:AccepterVpcOwnerId condition key. This ensures that the requester cannot initiate peering with arbitrary accounts, enforcing security boundaries. In real-world scenarios, this condition is often combined with resource-level ARNs for the requester VPC to further restrict permissions.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Network Design — This question tests Network Design — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The policy must include a condition that the accepter VPC owner is the target account. — Option B is correct because when creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.
What should I do if I get this ANS-C01 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IAM policy is attached to a user who needs to manage VPC peering connections. The policy allows creating and accepting peering connections, but the user reports they cannot add routes to the route table of their VPC (vpc-11111111) for the peered connection. What is the most likely cause?
hard
✓ A.The condition in the policy restricts the VPC, but the route table is not associated with that VPC.
B.The user does not have permission to create routes.
C.The user needs additional permissions for the peering connection.
D.The user needs to accept the peering connection first.
Why A: Option A is correct because the IAM policy includes a condition that restricts the VPC (e.g., `ec2:Vpc` condition key set to `vpc-11111111`), but the route table the user is trying to modify is not associated with that VPC. Even though the user has permissions to create and accept peering connections, the condition on the route table modification action (like `ec2:CreateRoute`) limits the operation to route tables belonging to the specified VPC. Since the route table belongs to a different VPC or is not associated with `vpc-11111111`, the request fails.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.