Troubleshooting Site-to-Site VPN: Missing VPC Route or BGP Advertisement
A company has a VPC with a CIDR of 10.0.0.0/16 and needs to establish a site-to-site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN tunnel is up, but traffic from the VPC to on-premises is not flowing. Which of the following is the most likely cause?
Quick Answer
The answer is the missing VPC route for 192.168.0.0/16 pointing to the virtual private gateway. This is correct because even when the VPN tunnel is up, the VPC’s route table must explicitly direct traffic destined for the on-premises network toward the virtual private gateway; without that entry, the VPC drops the packets at the subnet level, as it has no path for the remote CIDR. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of the fundamental connectivity prerequisites for site-to-site VPN troubleshooting—specifically, that a tunnel being up does not guarantee traffic flow if routing is misconfigured. A common trap is assuming BGP will automatically propagate routes into the VPC route table, but static routes or propagated routes must be explicitly added. Memory tip: “Tunnel up, route missing? Check the VPC table for the remote CIDR pointing to the VGW.”
⚠ Common exam trap
A common mix-up: candidates confuse routing with security filtering (security groups or NACLs) and assume the tunnel being up guarantees traffic flow, but AWS requires explicit route table entries to direct traffic to the virtual private gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.
For traffic from a VPC to an on-premises network over a site-to-site VPN, the VPC route table must contain a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway (VGW). Without this route, the VPC has no path to forward packets destined for 192.168.0.0/16, even though the VPN tunnel is up. Security groups and NACLs are stateful or stateless filters, but they do not create routing paths.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security groups do not allow outbound traffic.
Why it's wrong here
Security groups are stateful and allow outbound by default.
- ✗
The NACLs are blocking outbound traffic.
Why it's wrong here
NACLs default allow outbound.
- ✓
The VPC route table does not have a route for 192.168.0.0/16 pointing to the virtual private gateway.
Why this is correct
Missing route prevents traffic from leaving VPC.
- ✗
The VPN connection is in the wrong AWS region.
Why it's wrong here
VPN is region-specific; if in wrong region, tunnel wouldn't be up.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a CIDR of 10.0.0.0/16. They create a subnet 10.0.1.0/24 and launch an EC2 instance with a private IP 10.0.1.5. The instance needs to communicate with an on-premises server at 172.16.0.10 over a VPN connection. The VPN connection uses a Virtual Private Gateway. The VPC route table has a route 172.16.0.0/16 pointing to the VPG. The instance cannot reach the on-premises server. What is the most likely cause?
hard- A.The security group attached to the instance does not allow outbound traffic to 172.16.0.10.
- B.The instance's route table does not have a route to the internet gateway.
- C.The network ACL for the subnet denies outbound traffic to the on-premises IP range.
- ✓ D.The on-premises router is not advertising the 172.16.0.0/16 route to the Virtual Private Gateway.
Why D: The VPN connection requires the on-premises router to advertise the 172.16.0.0/16 route to the Virtual Private Gateway (VPG) via BGP (or static route configuration) for the VPG to forward traffic to the on-premises network. Without this route advertisement, the VPG will not have a path to 172.16.0.10, even though the VPC route table has a route pointing to the VPG. The instance's traffic reaches the VPG, but the VPG cannot forward it because it lacks the necessary routing information from the on-premises side.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.