The correct first step is to add a route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway. This is because AWS Direct Connect establishes a dedicated network connection, but the VPC itself does not automatically know how to reach the on-premises network; without that explicit route, traffic from the EC2 instance to the on-premises data center is dropped at the VPC boundary, even though the virtual interface is up. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding that routing is the foundational layer of hybrid connectivity—many candidates mistakenly check security groups or network ACLs first, but those only filter traffic that is already being routed. The common trap is assuming a working physical link means traffic flows; in reality, the VPC route table is the gatekeeper for directing traffic to the virtual private gateway. Memory tip: think of the VPC route table as the “GPS” for your traffic—without the on-premises destination entered, the packet has no path to follow.
SOA-C02 Networking and Content Delivery Practice Question
This SOA-C02 practice question tests your understanding of networking and content delivery. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A SysOps administrator is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises data center connected via AWS Direct Connect. The EC2 instance can reach other instances in the same VPC but cannot reach the on-premises network. The virtual private gateway (VGW) is attached to the VPC and the Direct Connect virtual interface is up. Which configuration step should the administrator verify first?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway
Option D is correct because for Direct Connect to work, the on-premises CIDR must be added to the VPC route table pointing to the virtual private gateway. Without this route, traffic from the VPC to on-premises is dropped. Option A is wrong because the security group controls inbound/outbound traffic but does not affect routing. Option B is wrong because network ACLs are stateless and would need to allow both inbound and outbound; but the primary issue is routing. Option C is wrong because the VGW is already attached and the virtual interface is up, indicating the physical connection is fine.
Key principle: A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Check the security group rules for the EC2 instance
Why it's wrong here
Security groups control traffic but are not the first step for connectivity issues across Direct Connect.
✗
Confirm that the Direct Connect virtual interface is associated with the correct VLAN
Why it's wrong here
The virtual interface is up, so VLAN association is likely correct.
✓
Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway
Why this is correct
This is required for traffic to flow from the VPC to on-premises via Direct Connect.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Access ports place end devices into a single VLAN.
✗
Verify the network ACL inbound and outbound rules for the VPC subnet
Why it's wrong here
Network ACLs can affect traffic but routing is the more likely issue.
Common exam traps
Common exam trap: an active trunk can still block the VLAN you need
A trunk being up does not prove every VLAN is crossing it. Check allowed VLAN lists, native VLAN mismatch, VLAN existence and access-port assignment.
Detailed technical explanation
How to think about this question
VLAN questions usually combine access-port and trunking clues. The key is to identify whether the issue is local to one switchport, caused by the trunk, or caused by the VLAN not existing where it needs to exist.
KKey Concepts to Remember
Access ports place end devices into a single VLAN.
Trunk ports carry multiple VLANs between switches.
Allowed VLAN lists decide which VLANs can cross a trunk.
Native VLAN mismatch can create confusing symptoms.
TExam Day Tips
→Use show vlan brief to verify access VLANs.
→Use show interfaces trunk to verify trunk state and allowed VLANs.
→Do not treat every same-VLAN issue as a routing problem.
Key takeaway
A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related SOA-C02 questions on switching, trunking, and access-port configuration.
Networking and Content Delivery — This question tests Networking and Content Delivery — Access ports place end devices into a single VLAN..
What is the correct answer to this question?
The correct answer is: Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway — Option D is correct because for Direct Connect to work, the on-premises CIDR must be added to the VPC route table pointing to the virtual private gateway. Without this route, traffic from the VPC to on-premises is dropped. Option A is wrong because the security group controls inbound/outbound traffic but does not affect routing. Option B is wrong because network ACLs are stateless and would need to allow both inbound and outbound; but the primary issue is routing. Option C is wrong because the VGW is already attached and the virtual interface is up, indicating the physical connection is fine.
What should I do if I get this SOA-C02 question wrong?
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related SOA-C02 questions on switching, trunking, and access-port configuration.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Access ports place end devices into a single VLAN.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.