ANS-C01 Network Implementation Practice Question
Network Topology
Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?
⚠ Common exam trap
The ANS-C01 exam often tests the concept that a VPN tunnel being 'UP' does not guarantee bidirectional traffic; candidates mistakenly assume tunnel status implies full connectivity, but the real issue is often a missing return route on the on-premises side.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway
The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN tunnels are not both in UP state
Why it's wrong here
The exhibit shows state 'available'.
- ✗
The VPN acceleration is disabled, causing high latency
Why it's wrong here
Latency would not prevent pings.
- ✗
The VPN connection is configured with static routes only and BGP is not used
Why it's wrong here
Static routes are fine for this scenario.
- ✓
The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway
Why this is correct
Without a return route, traffic from VPC reaches on-premises but replies are dropped.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.