How to Cost-Effectively Monitor School Site-to-Site VPN Connectivity Loss?

ANS-C01 By islever Editorial Last updated

Short answer

AE Monitor the state of the VPN tunnels by using Amazon CloudWatch. Create a CloudWatch alarm that uses Amazon Simple Notification Service (Amazon SNS) to notify people at the affected school if the tunnels are down. Create a scheduled AWS Lambda function to monitor the existence of each school's routes in the VPC route table where VPN routes are propagated. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if failure occurs.

Question

An education agency is preparing for its annual competition between schools. In the competition, students at schools from around the country solve math problems, complete puzzles, and write essays. The IP addressing plan of all the schools is well-known and is administered centrally. The competition is hosted in the AWS Cloud and is not publicly available. All competition traffic must be encrypted in transit. Only authorized endpoints can access the competition. All the schools have firewall policies that block ICMP traffic. A network engineer builds a solution in which all the schools access the competition through AWS Site-to-Site VPN connections. The network engineer uses BGP as the routing protocol. The network engineer must implement a solution that notifies schools when they lose connectivity and need to take action on their premises to address the issue. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
  1. Monitor the state of the VPN tunnels by using Amazon CloudWatch. Create a CloudWatch alarm that uses Amazon Simple Notification Service (Amazon SNS) to notify people at the affected school if the tunnels are down. Correct Answer
  2. Create a scheduled AWS Lambda function that pings each school's on-premises customer gateway device. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if the ping fails.
  3. Create a scheduled AWS Lambda function that uses the VPC Reachability Analyzer API to verify the connectivity. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if failure occurs.
  4. Create an Amazon CloudWatch dashboard for each school to show all CloudWatch metrics for each school's Site-to-Site VPN connection. Share each dashboard with the appropriate school.
  5. Create a scheduled AWS Lambda function to monitor the existence of each school's routes in the VPC route table where VPN routes are propagated. Configure the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) notification to people at the affected school if failure occurs. Correct Answer

Key Takeaways

This question tests your understanding of how AWS Site-to-Site VPN tunnel metrics and BGP route propagation can be used together as low-cost connectivity signals. The common trap is picking a generic reachability or ping solution without considering ICMP blocks and the per-invocation cost of advanced diagnostics.

The most cost-effective approach to notify schools when Site-to-Site VPN connectivity drops is to combine CloudWatch alarms on VPN tunnel state with a scheduled Lambda function that checks for the removal of BGP-propagated routes. Community consensus strongly favors AE because it relies on native monitoring and avoids expensive per-invocation tools or ICMP-based checks.

Common mistake: Many candidates select Option C because VPC Reachability Analyzer sounds like a precise way to verify connectivity, but it is not cost-effective for continuous monitoring and cannot detect failures entirely on the customer-premises side. Option B is another popular wrong choice because it relies on ICMP ping, which the schools' firewalls explicitly block.

Expert Analysis

Overview

When designing connectivity monitoring for AWS Site-to-Site VPN connections, you need a solution that detects loss of connectivity from both the AWS side and the school's on-premises side, while keeping costs low. The scenario already uses BGP as the routing protocol, so route propagation provides a built-in signal of a healthy BGP session.

Why Option A Is Correct

Option A uses Amazon CloudWatch to monitor the state of the VPN tunnels. AWS Site-to-Site VPN publishes a TunnelState CloudWatch metric for each VPN tunnel. A CloudWatch alarm can be set to trigger when this metric equals 0 (down). The alarm then publishes to an Amazon SNS topic, which can send email or other notifications to people at the affected school.

This approach is natively integrated, requires no additional compute, and is very cost-effective. CloudWatch alarms and SNS notifications have a predictable low pricing model, making them the first choice for tunnel health monitoring.

Why Option E Is Correct

Option E addresses the on-premises side of the connectivity. With a BGP-enabled Site-to-Site VPN, the school's on-premises routes are propagated to the VPC route table when the BGP session is established. If the BGP session fails, or the school loses connectivity, AWS removes those propagated routes from the VPC route table.

A scheduled AWS Lambda function can check the VPC route table for the presence of each school's known routes. If a route disappears, the Lambda function can publish an SNS notification to that school. This is a lightweight, cost-effective monitoring method because it simply reads route table entries on a schedule and does not generate per-analysis charges or depend on ICMP.

Together, Options A and E monitor both the AWS-side tunnel state and the on-premises BGP route announcement, giving schools clear notification when they need to investigate their own equipment.

Why Option B Is Wrong

Option B proposes a scheduled Lambda function that pings each school's customer gateway device. However, the school firewall policies explicitly block ICMP traffic, so the ping will always fail. Even if ICMP were allowed, relying on ping is not a complete measure of VPN or BGP health. This option is therefore invalid in this scenario.

Why Option C Is Wrong

Option C suggests using the VPC Reachability Analyzer API on a schedule. While Reachability Analyzer can help debug network paths, it has per-invocation costs and is not designed as a continuous monitoring service. It also cannot look beyond AWS boundaries into the school's on-premises network. If the school's customer gateway or internet connection fails, Reachability Analyzer may still report that the AWS-side path is valid, or it may fail to verify end-to-end connectivity. Community comments highlight that it is not cost-effective and cannot detect issues that originate entirely at the school.

Why Option D Is Wrong

Option D creates CloudWatch dashboards for each school. Dashboards are passive views and do not proactively notify anyone when connectivity drops. They do not satisfy the requirement to notify schools when they lose connectivity and need to take action. Dashboards also add cost and management overhead without providing the necessary alerting capability.

Community Consensus

The community vote distribution is overwhelmingly in favor of AE (78 votes versus 22 for AC). Commenters correctly point out that Option B fails due to ICMP blocking, Option C is too expensive for continuous checks, and Option D is not a notification mechanism. Route table monitoring in Option E is a clever way to detect when BGP routes vanish, which is a strong indicator that the school's VPN connection is down and may need on-premises action.

Conclusion

The correct combination is Option A + Option E. It uses CloudWatch for tunnel-level monitoring and Lambda for BGP route presence monitoring, both connected to SNS for notifications. This gives a cost-effective, scalable, and accurate way to alert schools when they lose connectivity and need to act on their premises.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks for the most cost-effective solution, prefer options that use built-in AWS monitoring and event-driven notifications over scheduled, per-invocation diagnostics. Also, if ICMP is blocked, immediately eliminate ping-based options and look for solutions based on CloudWatch metrics or BGP route table state.

Community Votes

AE
78%
AC
22%

78% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. [Removed] 👍 5
    I would go for AE. The reachability analyzer (option C) cannot look beyond AWS/VPC. So if there is an issue with the school itself (their CGW for instance) it cannot detect this. But to my understanding if the VPN of a specific school goes down the propagated route would vanish and so option E looks feasible (not near real time of course).
  2. seochan 👍 4
    I think it's AE. Option B is not possible because the clients are blocking ICMP protocol. Option C is not cost-effective option because the VPC reachability analyzer has per-invoke cost. Option D is not a requirement in this scenario.
  3. woorkim 👍 2
    B: Pinging customer gateway devices is not viable since the schools block ICMP traffic. This option would fail due to the schools' firewall policies. C: While VPC Reachability Analyzer is a powerful tool, using it for frequent connectivity checks is more complex and potentially costlier than leveraging existing metrics and route table monitoring. D: CloudWatch dashboards are useful for monitoring but do not provide proactive notifications. They require someone to manually review the data, which does not align with the requirement for automated notifications.
  4. Spaurito 👍 1
    AE - This seems to be the best answer. You could use option C but the cost would add up. Monitoring the Route Table and having a CloudWatch monitor makes the most sense.
  5. 973b658 👍 2
    A&C is OK.
Show 1 more comment
  1. cas_tori 👍 1
    this is AE

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide