How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the ANS-C01 exam, each with detailed explanations and wrong-answer analysis.

How should I approach ANS-C01 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Advanced Networking Specialty ANS-C01 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified Advanced Networking Specialty ANS-C01 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

ANS-C01

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Read the full VPN explanation →

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

A
Change the VPN connection from static to dynamic routing.
Why wrong: Routing type does not affect latency.
B
Enable jumbo frames on the transit VPC's EC2-based virtual appliances.
Jumbo frames reduce overhead and improve throughput for large packets.
C
Enable BGP route propagation on the transit VPC's route tables.
Why wrong: Route propagation is likely already enabled.
D
Deploy a new transit VPC in eu-west-1.
Why wrong: Adding another transit VPC increases complexity.

Full breakdown with real-world context →

Question 2hardmultiple choice

Review the full subnetting walkthrough →

A network engineer is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) connected via a VPC peering connection. Both VPCs have CIDR blocks: VPC-A = 10.0.0.0/16, VPC-B = 10.1.0.0/16. An EC2 instance in VPC-A (10.0.1.10) cannot ping an EC2 instance in VPC-B (10.1.1.10). Security groups and NACLs allow all traffic. The route tables are configured as follows: In VPC-A, a route to 10.1.0.0/16 via the peering connection. In VPC-B, a route to 10.0.0.0/16 via the peering connection. What is the most likely cause?

A
The VPCs have overlapping CIDR blocks.
Why wrong: CIDR blocks are different.
B
Security groups are blocking ICMP traffic.
Why wrong: Security groups allow all traffic.
C
The route tables are missing routes to the peering connection.
Why wrong: Routes are present.
D
There is an intermediate VPC or on-premises network that routes traffic incorrectly due to the lack of transitive routing.
VPC peering does not allow transitive routing; any intermediate hop would break connectivity.

Full breakdown with real-world context →

Question 3mediummultiple choice

Review the full routing breakdown →

A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?

A
The network ACL in the VPC is blocking outbound traffic.
Why wrong: NACLs are stateless; if ping works, both inbound and outbound rules allow ICMP. However, TCP could be blocked if NACL rules are different for TCP, but ping success suggests NACLs are not the issue.
B
The security group for the EC2 instance does not allow inbound HTTPS traffic.
Security groups are stateful, so outbound return traffic is allowed automatically. The inbound rule for HTTPS must be present.
C
The BGP session is in the 'Idle' state.
Why wrong: Ping works, so BGP is up and routes are exchanged.
D
The route table associated with the virtual private gateway does not have a route to the on-premises network.
Why wrong: The virtual private gateway does not have its own route table; routes are added to the VPC route tables.

Full breakdown with real-world context →

Question 4hardmulti select

Review the full subnetting walkthrough →

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

A
Verify that the transit gateway route table contains the CIDR blocks of both VPCs.
The transit gateway route table must have routes for both VPC CIDRs to forward traffic between them.
B
Check the route tables in VPC A and VPC B to ensure they have routes pointing to the transit gateway for the other VPC's CIDR.
Each VPC must have a route to the other VPC's CIDR pointing to the transit gateway attachment.
C
Check the association of the VPC attachments with the transit gateway route table.
Each VPC attachment must be associated with the correct route table to use its routes.
D
Check the Direct Connect virtual interface status.
Why wrong: Direct Connect is for on-premises connectivity, not VPC-to-VPC communication.
E
Verify that the NAT Gateway in each VPC is properly configured.
Why wrong: NAT Gateways are for outbound internet traffic, not VPC-to-VPC routing.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full VPN explanation →

A company uses AWS Site-to-Site VPN to connect its on-premises network to AWS. The VPN connection is established, but traffic from on-premises to AWS is not working. The on-premises network team confirms that the on-premises firewall is allowing traffic to the VPC CIDR. What should the network engineer check in AWS to resolve the issue?

A
Verify that the VPN tunnel status is UP.
Why wrong: The VPN is established, so tunnels are likely up.
B
Review the customer gateway configuration for incorrect BGP settings.
Why wrong: The customer gateway is on-premises; the question asks what to check in AWS.
C
Ensure the virtual private gateway is attached to the correct VPC.
Why wrong: If the VPN is established, the virtual private gateway is attached.
D
Check the VPC route tables to ensure routes to the on-premises network point to the virtual private gateway.
Missing routes in the VPC route table would prevent inbound traffic from reaching instances.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full VPN explanation →

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?

A
Verify that the VPN tunnel status shows as UP on both sides.
Why wrong: While tunnel status is important, the issue could be due to route propagation or association problems, not tunnel status alone.
B
Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.
Why wrong: VPC Flow Logs capture traffic at the VPC level, not inside the transit gateway, so they won't show routing decisions within the transit gateway.
C
In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.
This directly checks whether the transit gateway is correctly routing traffic to the VPN attachment for the on-premises CIDR.
D
Check the security group rules on the EC2 instances in VPC A for outbound traffic.
Why wrong: Security groups control inbound/outbound traffic to instances, but the issue is about network routing through the transit gateway.

Full breakdown with real-world context →

Question 7mediummultiple choice

Study the full ACL explanation →

A company is experiencing intermittent connectivity issues between two VPCs connected via a VPC peering connection. The VPCs are in different AWS regions. VPC A has CIDR 10.0.0.0/16 and VPC B has CIDR 10.1.0.0/16. The route tables in both VPCs have been updated to include routes pointing to the peering connection. Security groups and network ACLs are configured to allow all traffic for testing. However, traffic from VPC A to VPC B fails intermittently. Which of the following is the most likely cause of this intermittent failure?

A
The security group rules in VPC A are not allowing inbound traffic from VPC B's CIDR. The security group must reference the VPC B CIDR explicitly.
Why wrong: The scenario states security groups allow all traffic.
B
The route tables in both VPCs must include explicit routes for each other's CIDR blocks, but they should also include routes to the internet gateway for proper routing.
Why wrong: Internet gateway routes are not required for VPC peering.
C
The VPCs are in different regions, and cross-region VPC peering is not supported. A transit gateway must be used instead.
Why wrong: Cross-region VPC peering is supported.
D
The VPC peering connection does not support transitive routing. If any traffic is being routed through an intermediate device (e.g., a NAT instance or a VPN connection), the peering connection will not forward that traffic.
VPC peering does not support transitive routing, and intermittent failures suggest that some traffic is being sent through an unsupported path.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

A
Verify that the virtual private gateway is attached to the VPC.
Why wrong: It is already attached as stated.
B
Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.
Without a return route, traffic from on-premises may not reach the VPC.
C
Verify that the on-premises firewall is not blocking UDP port 500 for IKE.
Why wrong: If the tunnel is up, IKE is working.
D
Verify that the VPN tunnel's pre-shared key matches on both sides.
Why wrong: If the tunnel is up, the pre-shared key is correct.

Full breakdown with real-world context →

Question 9mediumdrag order

Full question →

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediumdrag order

Full question →

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11easymultiple choice

Open the full BGP breakdown →

A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?

A
The VPN connection is not using the correct pre-shared key.
Why wrong: Incorrect pre-shared key would prevent the VPN tunnel from establishing, but the VPN is already established.
B
The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.
Why wrong: Security groups are stateful; if the EC2 instance initiates outbound traffic, the return traffic is allowed regardless of inbound rules.
C
The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.
BGP route propagation can cause the VPC route table to learn a default route from on-premises, which may cause traffic destined for the VPC CIDR to be sent back to the VPN gateway instead of staying local.
D
The VPC's network ACLs are blocking inbound traffic from the on-premises network.
Why wrong: Network ACLs are stateless and would affect traffic in both directions; however, the issue is routing, not filtering.

Full breakdown with real-world context →

Question 12easymultiple choice

Full question →

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

A
AWS Site-to-Site VPN is not established.
Why wrong: VPN is a separate connection and does not affect Direct Connect VIF state.
B
MACsec encryption is misconfigured on the customer router.
Why wrong: MACsec misconfiguration would affect encryption but not cause the VIF state to be down.
C
BGP session between the customer router and AWS is down.
A private VIF requires an active BGP session; if BGP is down, the VIF state becomes down.
D
Jumbo frames are enabled on the VIF but not supported by the customer router.
Why wrong: Jumbo frames do not affect the VIF state; they affect packet forwarding.

Full breakdown with real-world context →

Question 13mediummulti select

Read the full VPN explanation →

A network engineer is troubleshooting high latency on an AWS Transit Gateway that connects multiple VPCs and an on-premises network via AWS Site-to-Site VPN. The engineer wants to identify potential causes. Which TWO actions should the engineer take? (Choose two.)

A
Review the NACL rules for each subnet in the VPCs.
Why wrong: NACLs affect allowed traffic but not latency.
B
Review the CloudWatch metrics for the VPN tunnels for packet loss and latency.
VPN tunnel metrics can indicate performance issues.
C
Enable Transit Gateway Flow Logs to capture traffic between attachments.
Transit Gateway Flow Logs provide visibility into traffic flows.
D
Re-create the VPN connections to reset the tunnels.
Why wrong: Re-creating is a disruptive action, not a diagnostic step.
E
Enable VPC Flow Logs on the VPCs attached to the transit gateway.
Why wrong: VPC Flow Logs do not capture transit gateway traffic.

Full breakdown with real-world context →

Question 14mediummultiple choice

Review the full routing breakdown →

A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?

A
Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.
The on-premises router must advertise the VPC CIDR for return traffic.
B
Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.
Why wrong: NACLs are stateless and may block traffic, but the question states routes are correct.
C
Confirm that the private VIF is associated with the correct virtual private gateway.
Why wrong: The VIF is already configured and ping to Amazon side works.
D
Ensure that BGP is established and receiving routes.
Why wrong: Pinging the Amazon side IP suggests BGP is up.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full VPN explanation →

A company uses AWS Client VPN to provide remote access to its VPC resources. Users report that they can connect to the VPN but cannot reach any resources in the VPC. The VPN endpoint is associated with a subnet in VPC A. The VPC's route table has a route for the Client VPN CIDR (10.200.0.0/16) pointing to the VPN endpoint. The security group assigned to the VPN endpoint allows inbound traffic from the VPN clients. What is the most likely cause of the issue?

A
The Client VPN endpoint's authentication is failing.
Why wrong: Users can connect, so authentication is successful.
B
The VPN endpoint is not associated with the correct subnet.
Why wrong: The question states it is associated with a subnet in VPC A, so this is likely not the issue.
C
The route table in VPC A does not have a route for the Client VPN CIDR.
Why wrong: The question states the route exists.
D
The security group associated with the VPN endpoint does not allow inbound traffic from the VPN client CIDR.
The security group must allow inbound traffic from the client CIDR (10.200.0.0/16) to reach VPC resources.

Full breakdown with real-world context →

These ANS-C01 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style ANS-C01 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related ANS-C01 topic practice pages

Network Management and Operations practice questions

Network Security, Compliance and Governance practice questions

Network Design practice questions

Network Implementation practice questions

ANS-C01 fundamentals practice questions

ANS-C01 scenario practice questions

ANS-C01 troubleshooting practice questions

Practice scenarios

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

A company is using AWS Direct Connect with a private VIF to access their VPC. Users report intermittent connectivity issues. You check the Direct Connect console and see that the virtual interface state is 'down'. What is the MOST likely cause?

A network engineer is troubleshooting high latency on an AWS Transit Gateway that connects multiple VPCs and an on-premises network via AWS Site-to-Site VPN. The engineer wants to identify potential causes. Which TWO actions should the engineer take? (Choose two.)