Overlapping CIDR with Direct Connect: Local Route Precedence
A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise a specific prefix (10.0.0.0/16) to AWS. The VPC CIDR is 10.0.0.0/16. The company wants to ensure that traffic from the VPC to on-premises uses the Direct Connect connection. However, traffic is going over the internet instead. What is the most likely cause?
Quick Answer
The correct answer is that the VPC’s local route takes precedence over the Direct Connect route when the VPC CIDR and the on-premises prefix overlap. This happens because AWS always considers a local route—the implicit route for the VPC’s own CIDR block—as more specific than any propagated or static route, even if the on-premises prefix is advertised via BGP with the same or a longer prefix length. In this scenario, traffic from the VPC destined for 10.0.0.0/16 is treated as local traffic, so it never leaves the VPC to reach the Direct Connect connection. On the ANS-C01 exam, this concept tests your understanding of route precedence in overlapping CIDR scenarios, a common trap where candidates mistakenly think BGP attributes or more specific prefixes override the local route. Remember: local always wins—think of it as the VPC’s “home field advantage” that cannot be beaten by any external route.
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that BGP propagated routes can override the VPC local route when prefixes are identical, but the trap here is that AWS always prioritizes the local route for exact CIDR matches, regardless of BGP attributes or propagation status.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.
When a VPC CIDR (10.0.0.0/16) exactly matches a prefix advertised via Direct Connect (10.0.0.0/16), the VPC's local route (which is implicitly created for the VPC CIDR) takes precedence over any propagated BGP route. This is because AWS route tables prioritize the most specific matching route, and when prefixes are identical, the local route is preferred over static or propagated routes. As a result, traffic destined for 10.0.0.0/16 stays within the VPC instead of being sent over the Direct Connect connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The on-premises BGP ASN is prepended, causing the route to be less preferred.
Why it's wrong here
AS path length does not override the local route.
- ✗
The on-premises prefix is less specific than the VPC CIDR, so the VPC route takes precedence.
Why it's wrong here
Actually, more specific routes are preferred, but the local route for exact match is always preferred.
- ✓
The VPC CIDR overlaps with the on-premises prefix, and the local route in the VPC route table takes precedence.
Why this is correct
Overlapping CIDRs cause the local route to be used, ignoring Direct Connect.
- ✗
The BGP route is not being propagated into the VPC route table.
Why it's wrong here
If the VPC CIDR overlaps, the local route wins regardless of propagation.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise its prefixes. Recently, the on-premises router started advertising a more specific route (10.0.0.0/24) that overlaps with the VPC's CIDR (10.0.0.0/16). What is the impact on traffic destined to 10.0.0.5?
medium- A.The instance becomes unreachable from on-premises.
- ✓ B.Return traffic from the instance to on-premises is routed through Direct Connect instead of staying within the VPC.
- C.Traffic destined to the instance is blackholed.
- D.Traffic is load-balanced between the VPC and Direct Connect.
Why B: When an on-premises router advertises a more specific route (10.0.0.0/24) via BGP over a Direct Connect private VIF, the VPC propagates this route into its route tables. For traffic destined to 10.0.0.5, the VPC now has a more specific route (10.0.0.0/24) pointing to the virtual private gateway (VGW), overriding the local VPC route (10.0.0.0/16). This causes return traffic from the instance to on-premises to be routed through Direct Connect instead of staying within the VPC, as the VPC's route table prefers the longest prefix match.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.