SOA-C02 Networking and Content Delivery Practice Question
A SysOps administrator is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises data center connected via AWS Direct Connect. The EC2 instance can reach other instances in the same VPC but cannot reach the on-premises network. The virtual private gateway (VGW) is attached to the VPC and the Direct Connect virtual interface is up. Which configuration step should the administrator verify first?
⚠ Common exam trap
SOA-C02 often tests whether candidates jump to security groups or NACLs (familiar troubleshooting steps) instead of first verifying routing—the most common cause of hybrid connectivity failures is a missing route, not a security rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway
For an EC2 instance to reach an on-premises network via Direct Connect, the VPC route table must contain a route for the on-premises CIDR block pointing to the virtual private gateway (VGW). Since the instance can reach other VPC instances, local routing works; the missing piece is the route to the on-premises destination. Without this route, traffic has no path to the VGW and is dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the security group rules for the EC2 instance
Why it's wrong here
Security groups are stateful and instance-level; the instance already communicates with other instances in the VPC, proving the rules permit that traffic. Security groups are the first check when an instance cannot be reached by anything at all.
- ✗
Confirm that the Direct Connect virtual interface is associated with the correct VLAN
Why it's wrong here
A wrong VLAN would prevent the virtual interface from coming up at all, yet the stem states it is up, so the association is already functioning. VLAN tagging is what you verify when a hosted connection never reaches the BGP established state.
- ✓
Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway
Why this is correct
The VPC route table must contain a route for the on-premises CIDR targeting the virtual private gateway; without it, traffic to on-premises has no path despite the Direct Connect virtual interface being up. This is the most common cause of this symptom.
- ✗
Verify the network ACL inbound and outbound rules for the VPC subnet
Why it's wrong here
Network ACLs are stateless and subnet-level, but the instance already reaches peers in the same subnet, so those rules permit the required traffic; the missing path is the VPC route table entry targeting the VGW. ACLs would be the first check when traffic fails within a subnet.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.