SOA-C02 BGP Practice Question
A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?
⚠ Common exam trap
The trap is that candidates often suspect VPC route misconfigurations or virtual private gateway attachment issues, but the core problem is a failed BGP session on the Direct Connect link, which stops route exchange between on-premises and AWS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The BGP session between the on-premises router and the Direct Connect router is down.
The BGP session between the on-premises router and the Direct Connect router is down. When BGP is down, the on-premises router cannot exchange routes with the AWS side over Direct Connect. Even though the on-premises router may be advertising a specific route, without an active BGP session, that route is not received by the Direct Connect router, and the virtual private gateway does not propagate it into the VPC. As a result, traffic from the on-premises network to the VPC falls back to using the internet route instead of Direct Connect. Option B is incorrect because the VPC route table controls outbound traffic from the VPC, not inbound traffic from on-premises; a default route to an Internet Gateway would cause asymmetric routing for return traffic but would not prevent inbound traffic from using Direct Connect if the BGP session is active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The on-premises network does not have a route to the VPC CIDR.
Why it's wrong here
The on-premises network does have a route to the VPC CIDR, as explicitly stated in the scenario, so this option cannot be the cause of the failure. In an AWS Direct Connect setup, the on-premises router learns the VPC CIDR through the BGP session that runs over the Direct Connect virtual interface; if that BGP session were down, the route would be withdrawn and disappear from the routing table. However, the fact that a route is present in the initial configuration does not prevent a later BGP failure from breaking connectivity, and since the question confirms the route exists, we must look beyond this option to the BGP session itself as the root cause.
- ✗
The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.
Why it's wrong here
While a default route to an Internet Gateway can cause asymmetric routing for return traffic, it does not affect inbound traffic direction from on-premises to the VPC. The VPC route table only controls outbound traffic; inbound traffic is determined by the on-premises router's routing table, which depends on BGP-learned routes.
- ✓
The BGP session between the on-premises router and the Direct Connect router is down.
Why this is correct
If the BGP session is down, the on-premises router cannot exchange routes with the Direct Connect router, so it loses the Direct Connect path to the VPC and falls back to internet routing. This is the most likely cause.
- ✗
The virtual private gateway is not attached to the VPC.
Why it's wrong here
The virtual private gateway is attached to the VPC in this scenario, so this option is not the cause. A VGW attachment is a prerequisite for routing traffic from the VPC to and from the Direct Connect virtual interface, but it does not by itself establish the BGP peering that carries route advertisements; that peering is formed between the on-premises router and the Direct Connect router using the virtual interface's ASN and VLAN. If the VGW were detached, you would see the VPC route table entries pointing to the VGW become unusable and the Direct Connect virtual interface would likely remain 'down', but since the stem asserts the attachment exists, the failure must instead be in the BGP session itself.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.