ANS-C01 Question 9
Select 2Your organization is migrating a hybrid workload to AWS. Part of the architecture includes a VPN connection between your on-premises data center and a VPC. During testing, you notice intermittent connectivity issues between the on-premises resources and AWS. After reviewing the setup, you need to determine the most likely cause of the issue. Which of the following could be potential causes? (Choose TWO)
- A
The VPN tunnel's pre-shared key (PSK) does not match between the on-premises router and AWS.
- B
The Security Group associated with the VPC does not allow traffic from the on-premises network.
- C
The Customer Gateway IP address configured in AWS does not match the public IP of the on-premises router.
- D
The on-premises router does not support Border Gateway Protocol (BGP).
- E
The VPC Route Table does not include a route for the on-premises network via the VPN.
Show answer and explanation
Correct answers: A, C
Explanation
Intermittent VPN connectivity issues are often caused by mismatched configurations between AWS and on-premises devices. A mismatched PSK (Option 1) or incorrect Customer Gateway IP address (Option 3) are common culprits because they directly affect the ability of the VPN tunnel to establish and maintain a stable connection. Other options, while important for overall connectivity, are less likely to cause intermittent issues in this specific scenario.
- A. Correct.
If the pre-shared key (PSK) does not match between the on-premises router and AWS, the VPN tunnel will not establish or will face intermittent connectivity issues due to authentication failures.
- B. Incorrect.
While Security Groups are essential for controlling inbound and outbound traffic to resources within the VPC, they do not directly affect the VPN connectivity between the on-premises network and AWS.
- C. Correct.
The Customer Gateway IP address in AWS must match the public IP of the on-premises router. If they do not match, the VPN tunnel cannot establish a stable connection.
- D. Incorrect.
BGP is not a strict requirement for the VPN connection to work. AWS also supports static routing instead of dynamic routing with BGP.
- E. Incorrect.
While the VPC Route Table must include a route for the on-premises network via the VPN, this issue would result in traffic not routing correctly, rather than intermittent connectivity issues.