Transit Gateway Route Table Troubleshooting: First Steps for Connectivity Issues
A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. Network engineers report intermittent connectivity issues between VPC A and the on-premises network. The transit gateway route table shows the on-premises CIDR (10.0.0.0/8) propagated from the VPN attachment. VPC A has a subnet route pointing to the transit gateway for 10.0.0.0/8. Which step should the engineer take FIRST to diagnose the issue?
Quick Answer
The correct first step is to verify that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated and points to the correct attachment. This is because intermittent connectivity issues often stem from a misconfigured route table rather than a failed VPN tunnel; if the route is missing or associated with the wrong attachment, traffic from VPC A to the on-premises network will be dropped even when the VPN itself is healthy. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of Transit Gateway route table troubleshooting as a foundational diagnostic step, with a common trap being that engineers jump to checking VPN tunnel status or VPC subnet routes first. Remember that the transit gateway route table is the central decision point for all inter-network traffic, so always start there. A useful memory tip is "Route before tunnel" — verify the route table association and propagation before investigating the VPN tunnel itself.
⚠ Common exam trap
The trap here is that candidates often jump to checking the VPN tunnel status (Option A) first, assuming the tunnel is the root cause, but the question specifically describes intermittent connectivity that is more likely due to a routing misconfiguration in the transit gateway route table rather than a tunnel flap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.
The first diagnostic step for intermittent connectivity through a transit gateway is to verify the route table configuration. The engineer must confirm that the VPN attachment is correctly associated with the transit gateway route table and that the 10.0.0.0/8 route is propagated from the VPN attachment, as a missing or misassociated route would cause traffic to be dropped even if the VPN tunnel is up.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the VPN tunnel status shows as UP on both sides.
Why it's wrong here
While tunnel status is important, the issue could be due to route propagation or association problems, not tunnel status alone.
- ✗
Enable VPC Flow Logs on VPC A to verify traffic reaching the transit gateway.
Why it's wrong here
VPC Flow Logs capture traffic at the VPC level, not inside the transit gateway, so they won't show routing decisions within the transit gateway.
- ✓
In the transit gateway route table, verify that the VPN attachment is correctly associated and that the 10.0.0.0/8 route is propagated and has the correct attachment.
Why this is correct
This directly checks whether the transit gateway is correctly routing traffic to the VPN attachment for the on-premises CIDR.
- ✗
Check the security group rules on the EC2 instances in VPC A for outbound traffic.
Why it's wrong here
Security groups control inbound/outbound traffic to instances, but the issue is about network routing through the transit gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that traffic between two VPCs is taking a suboptimal path, going through the on-premises network instead of staying within AWS. What is the most likely cause?
hard- ✓ A.The Transit Gateway route table has a propagated route from the on-premises network with a longer prefix
- B.The VPCs are also peered directly, creating a conflict
- C.VPC Flow Logs are enabled, causing latency
- D.Security groups are blocking direct traffic between VPCs
Why A: When a Transit Gateway route table contains a propagated route from an on-premises network with a longer prefix (more specific) than the local VPC route, traffic destined for that specific CIDR will be sent to the on-premises network instead of using the inter-VPC route. This is because more specific routes take precedence over less specific ones. The suboptimal path occurs because the traffic is forced through the on-premises network, even though both VPCs are attached to the Transit Gateway and could communicate directly within AWS. Option A is correct. Option B is incorrect because VPC peering is not used with Transit Gateway; if peering existed, it could create route conflicts, but the scenario describes Transit Gateway. Option C is incorrect because VPC Flow Logs are for monitoring traffic and do not affect routing. Option D is incorrect because security groups are stateful firewalls that control traffic, but they do not determine routing paths; routing is controlled by route tables.
Variation 2. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. The network team notices that traffic from an on-premises data center to a VPC is intermittently dropping. CloudWatch metrics show no errors on the Direct Connect virtual interface. What is the most likely cause of the intermittent drops?
medium- A.Latency spikes on the Direct Connect link due to AWS VPN backup path
- B.MTU mismatch causing packet fragmentation for jumbo frames
- C.BGP keepalive timer mismatch between the on-premises router and the Direct Connect router
- ✓ D.Asymmetric routing due to missing or incorrect route propagation in Transit Gateway route tables
Why D: The most likely cause of intermittent traffic drops from on-premises to a VPC via Direct Connect and Transit Gateway is asymmetric routing due to missing or incorrect route propagation. Asymmetric routing can occur when the forward path (on-premises to VPC) is valid, but the return path (VPC to on-premises) lacks a specific route in the Transit Gateway route table. This causes packets to be dropped intermittently as route propagation changes or routing tables are updated. Option A is incorrect because latency spikes are not typical of intermittent drops, and the VPN backup path is not mentioned as active. Option B is incorrect because MTU mismatch usually causes consistent packet loss for large packets, not intermittent drops. Option C is incorrect because BGP keepalive timer mismatches would cause sustained session loss rather than intermittent drops. Therefore, option D is correct.
Variation 3. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. After adding a new VPC attachment, traffic from the on-premises network cannot reach the new VPC. The on-premises BGP route table shows the prefixes of the new VPC as received. What should the engineer check?
medium- A.Verify that the on-premises router is advertising the correct prefix to AWS.
- B.Verify that the new VPC has a route to the Transit Gateway in its route table.
- ✓ C.Verify that the new VPC attachment is associated with the Transit Gateway route table that has the on-premises routes.
- D.Verify that the new VPC's DNS resolution is enabled.
Why C: For traffic from an on-premises network to reach a new VPC via Transit Gateway, the new VPC attachment must be associated with a Transit Gateway route table that contains a route (static or propagated) pointing to the on-premises network. Without this association, the Transit Gateway will not forward traffic to the new VPC even if the on-premises BGP route table has learned the VPC prefixes. Option A is incorrect because the on-premises router already receives the VPC prefixes via BGP, so advertising is not the issue. Option B is incorrect: the VPC's route table controls outbound traffic from the VPC, but inbound traffic from on-premises is governed by the Transit Gateway route table. Option D is irrelevant because DNS resolution does not affect IP routing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.