ANS-C01 — AWS Certified Advanced Networking - Specialty
Amazon

AWS Certified Advanced Networking - Specialty (ANS-C01) Practice Questions

★★★★★★ 4.2 84 verified reviews
137 questions
July 8, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Network Design (30%)
  • Network Implementation (26%)
  • Network Management and Operation (20%)
  • Network Security, Compliance, and Governance (24%)

Sample Questions (14 of 137 shown)

Q1 Network Design
A company is planning to migrate an internal application to the AWS Cloud. The application will run on Amazon EC2 instances in one VPC. Users will access the application from the company's on-premises data center through AWS VPN or AWS Direct Connect. Users will use private domain names for the application endpoint from a domain name that is reserved explicitly for use in the AWS Cloud. Each EC2 instance must have automatic failover to another EC2 instance in the same AWS account and the same VPC. A network engineer must design a DNS solution that will not expose the application to the internet. Which solution will meet these requirements?
  1. Assign public IP addresses to the EC2 instances. Create an Amazon Route 53 private hosted zone for the AWS reserved domain name. Associate the private hosted zone with the VPC. Create a Route 53 Resolver outbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the outbound endpoint IP address for Route 53 Resolver. In the private hosted zone, configure primary and failover records that point to the public IP addresses of the EC2 instances. Create an Amazon CloudWatch metric and alarm to monitor the application's health. Set up a health check on the alarm for the primary application endpoint.
  2. Place the EC2 instances in private subnets. Create an Amazon Route 53 public hosted zone for the AWS reserved domain name. Associate the public hosted zone with the VPC. Create a Route 53 Resolver inbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the inbound endpoint IP address for Route 53 Resolver. In the public hosted zone, configure primary and failover records that point to the IP addresses of the EC2 instances. Create an Amazon CloudWatch metric and alarm to monitor the application's health. Set up a health check on the alarm for the primary application endpoint.
  3. Place the EC2 instances in private subnets. Create an Amazon Route 53 private hosted zone for the AWS reserved domain name. Associate the private hosted zone with the VPCreate a Route 53 Resolver inbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the inbound endpoint IP address for Route 53 Resolver. In the private hosted zone, configure primary and failover records that point to the IP addresses of the EC2 instances. Create an Amazon CloudWatch metric and alarm to monitor the application's health. Set up a health check on the alarm for the primary application endpoint.
  4. Place the EC2 instances in private subnets. Create an Amazon Route 53 private hosted zone for the AWS reserved domain name. Associate the private hosted zone with the VPC. Create a Route 53 Resolver inbound endpoint. Configure conditional forwarding in the on-premises DNS resolvers to forward all DNS queries for the AWS domain to the inbound endpoint IP address for Route 53 Resolver. In the private hosted zone, configure primary and failover records that point to the IP addresses of the EC2 instances. Set up Route 53 health checks on the private IP addresses of the EC2 instances.
✓ Correct Answer: C
  • Because the application uses private IP addresses and must not be exposed to the internet, a Route 53 Private Hosted Zone combined with an Inbound Resolver Endpoint is required so on-premises DNS servers can forward queries over the VPN/Direct Connect.
  • Route 53 cannot natively perform HTTP/TCP health checks directly on private IP addresses unless you use a workaround. The correct approach is to create a CloudWatch alarm monitoring the health of the EC2 instances and then map a Route 53 failover routing policy to that CloudWatch alarm health check.
Q2 Network Design
A company has two business units (BUs). The company operates in the us-east-1 Region and the us-west-1 Region. The company plans to extend to more Regions in the future. Each BU has a VPC in each Region. Each Region has a transit gateway with the BU VPCs attached. The transit gateways in both Regions are peered. The company will create several more BUs in the future and will need to isolate some of the BUs from the other BUs. The company wants to migrate to an architecture to incorporate more Regions and BUs. Which solution will meet these requirements with the MOST operational efficiency?
  1. Create a new transit gateway for each new BU in each Region. Peer the new transit gateways with the existing transit gateways. Update the route tables to control traffic between BUs.
  2. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Use segment actions to control traffic between segments.
  3. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Configure the segments to isolate attachments to control traffic between segments.
  4. Attach new VPCs to the existing transit gateways. Update route tables to control traffic between BUs.
✓ Correct Answer: B
AWS Cloud WAN is specifically built to simplify global, multi-Region networks with multiple business units. Instead of manually peering and configuring dozens of Transit Gateways, Cloud WAN allows you to manage everything via a centralized Core Network Policy. You can easily enforce isolation or controlled routing between business units globally by using segments and segment actions with maximum operational efficiency.
Q3 Network Design
A company is building an API-based application on AWS and is using a microservices architecture for the design. The company is using a multi-account AWS environment that includes a separate AWS account for each microservice development team. Each team hosts its microservice in its own VPC that contains Amazon EC2 instances behind a Network Load Balancer (NLB). A network engineer needs to use Amazon API Gateway in a shared services account to create an HTTP API to expose these microservices to external applications. The network engineer must ensure that access to the microservices can occur only over a private network. Additionally, the company must be able to control which entities from its internal network can connect to the microservices. In the future, the company will create more microservices that the company must be able to integrate with the application. What is the MOST secure solution that meets these requirements?
  1. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALB. Create a VPC endpoint service in each microservice account. Create an AWS PrivateLink endpoint for those services in the shared services account. Add the elastic network interface IP addresses of the VPC endpoint as targets for the target group of the ALB.
  2. Create an Application Load Balancer (ALB) in a VPC in the shared services account. Configure the integration to the API Gateway API by using a VPC link. Associate the VPC link with the ALConnect all the VPCs to each other by using a central transit gateway. Add the IP addresses of the NLB as IP-based targets in the ALB target group.
  3. Configure the integration to the API Gateway API by using HTTP-based integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate HTTP integration to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the HTTP integration.
  4. Configure the integration to the API Gateway API by using VPC link integration. Connect all the VPCs to each other by using a central transit gateway. Create a separate VPC link to each NLB for each microservice. Add the HTTP endpoint of the NLB as the endpoint URL in the VPC link integration.
✓ Correct Answer: A
  • The HTTP API in API Gateway needs to securely route private traffic to multiple backend NLBs across multiple microservice accounts.
  • API Gateway VPC Links allow private integration with an Application Load Balancer (ALB) or Network Load Balancer inside your local VPC.
  • By placing a central ALB in the shared services account, you can route traffic out via AWS PrivateLink endpoint services mapped directly to the individual microservice NLBs in the other accounts. This keeps all communication strictly private and ensures clean separation of microservice architectures without managing complex routing tables or full mesh networks.
Q4 Network Design
Company A recently acquired Company B. Company A has a hybrid AWS and on-premises environment that uses a hosted AWS Direct Connect connection, a Direct Connect gateway, and a transit gateway. Company A has a transit VIF to access the resources in its production environment in the us-east-1 Region. Company B has applications that run across multiple VPCs in the us-west-2 Region in a single AWS account. A transit gateway connects all Company B's application VPCs. The CIDR blocks for both companies do not overlap. Company A needs to use the existing Direct Connect connection to access Company B’s applications from the on-premises environment. Which solution will meet these requirements?
  1. Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a transit VIF on the existing hosted connection for Company B.
  2. Create an association proposal from the Company B account to associate the Company B transit gateway with the Company A Direct Connect gateway. Accept the transit gateway association proposal by logging into the Company A account.
  3. Create multiple virtual private gateways. Attach the virtual private gateways to each of Company B's application VPCs. Create a hosted private VIF for each virtual private gateway.
  4. Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a hosted private VIF for Company B.
✓ Correct Answer: B
An AWS Direct Connect Gateway is a globally accessible resource. It can accept attachments from up to three Transit Gateways, even if those Transit Gateways reside in entirely different AWS accounts or Regions. Generating an association proposal from Company B's account to Company A's Direct Connect Gateway links the networks securely without needing to stand up redundant Direct Connect physical interconnects or provision complex new VIF allocations.
Q5 Network Design
A company is migrating an application to the AWS Cloud. The company has successfully provisioned and tested connectivity between AWS Direct Connect and the company's on-premises data center. The application runs on Amazon EC2 instances across multiple Availability Zones. The instances are in an Auto Scaling group. The application communicates through HTTPS to a third-party vendor's data service that is hosted at the company’s data center. The data service implements a static ACL through explicit allow listing of client IP addresses. A network engineer must design a network solution so that the migrated application can continue to access the vendor’s data service as the application scales. Which solution will meet these requirements with the LEAST amount of ongoing change to the vendor's allow list?
  1. Configure a private NAT gateway in the subnets for each Availability Zone that the application runs in. Configure the application to target the NAT gateways instead of the data service directly. Update the data service's allow list to include the IP addresses of the NAT gateways.
  2. Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Associate the elastic network interfaces with the Auto Scaling group for the application. Update the data service's allow list to include the IP addresses of the elastic network interfaces.
  3. Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Launch an EC2 instance into each subnet. Attach the respective elastic network interfaces to the new EC2 instances. In the application subnet route tables, configure the new EC2 instances as the next destination for the data service. Update the data service’s allow list to include the IP addresses of the elastic network interfaces.
  4. Configure an Application Load Balancer (ALB) in the subnets for each Availability Zone that the application runs in. Configure an ALB-associated target group that contains a target that uses the IP address for the data service. Configure the application to target the ALB instead of the data service directly. Update the data service's allow list to include the IP addresses of the ALBs.
✓ Correct Answer: A
  • When instances sit in an Auto Scaling group, they scale out dynamically, which means new instances constantly bring new private IP addresses that would break a static third-party firewall allow list.
  • A Private NAT Gateway translates the private source IP addresses of all outbound instances inside an Availability Zone to a single, static private IP address assigned to the NAT Gateway itself. By creating a Private NAT Gateway in each AZ, you only have to provide a small, immutable list of static IPs to the vendor's data service allow list, regardless of how large the ASG scales.
Q6 Network Design
A company has a highly available application that is hosted in multiple VPCs and in two on-premises data centers. All the VPCs reside in the same AWS Region. All the VPCs require access to each other and to the on-premises data centers for the transfer of files that are multiple gigabytes in size. A network engineer is designing an AWS Direct Connect solution to connect the on-premises data centers to each VPC. Which architecture will meet the company's requirements with the LEAST operational overhead?
  1. Configure a virtual private gateway and a private VIF in each VPC in the Region. Configure a Direct Connect gateway. Associate the VIF of every VPC with the Direct Connect gateway. Create a new private VIF that connects the Direct Connect gateway to each on-premises data center. Configure the new private VIF to exchange BGP routes with the on-premises data centers and to have an MTU of 9001. Use VPC peering between each VPC. Configure static routing in each VPC to provide inter-VPC routing.
  2. Configure a virtual private gateway and a private VIF in each VPC in the Region. Configure a Direct Connect gateway. Associate the VIF of every VPC with the Direct Connect gateway. Create a new private VIF that connects the Direct Connect gateway to each on-premises data center. Configure the new private VIF to exchange BGP routes with the on-premises data centers and to have an MTU of 8500. Use VPC peering between each VPC. Configure static routing in each VPC to provide inter-VPC routing.
  3. Configure a transit gateway in the same Region of each VPAttach each VPC to the transit gateway. Configure a Direct Connect gateway. Associate the Direct Connect gateway with the transit gateway. Associate a new transit VIF with each Direct Connect connection. Configure the new transit VIF to exchange BGP routes and to have an MTU of 9001. Configure route propagation between each VPC and the transit gateway.
  4. Configure a transit gateway in the same Region of each VPC. Attach each VPC to the transit gateway. Configure a Direct Connect gateway. Associate the Direct Connect gateway with the transit gateway. Associate a new transit VIF with each Direct Connect connection. Configure the new transit VIF to exchange BGP routes and to have an MTU of 8500. Configure route propagation between each VPC and the transit gateway.
✓ Correct Answer: C
  • A multi-gigabyte cross-site file transfer configuration benefits massively from Jumbo Frames (9001 MTU), which reduces packet encapsulation overhead and maximizes throughput over Direct Connect. Standard VGW paths max out at 1500 MTU for VPNs, but Direct Connect Transit VIFs naturally support 9001 MTU.
  • Managing a mesh layout via a centralized Transit Gateway eliminates the operational overhead of manually maintaining dozens of individual VPC Peering links and static entry tables across separate spaces.
Q7 Network Design
A financial company offers investment forecasts and recommendations to authorized users through the internet. All the services are hosted in the AWS Cloud. A new compliance requirement states that all the internet service traffic from any host must be logged and retained for 2 years. In its development AWS accounts, the company has designed, tested, and verified a solution that uses Amazon VPC Traffic Mirroring with a Network Load Balancer (NLB) as the traffic mirror target. While the solution runs in one AWS account, the solution mirrors the traffic to another AWS account. A network engineer notices that not all traffic is mirrored when the solution is deployed into the production environment. The network engineer also notices that this behavior is random. Which statements are possible explanations for why not all the traffic is mirrored? (Choose two.)
  1. The security groups are misconfigured on the production AWS account that hosts the company’s services.
  2. The Amazon EC2 instance that is being monitored cannot handle the extra traffic that Traffic Mirroring has introduced.
  3. The IAM policy that allows the creation of traffic mirror sessions is misconfigured
  4. The mirrored traffic has a lower priority than the production traffic and is being dropped when network congestion occurs.
  5. The NLB is experiencing warm-up delay because of sudden and significant increases in traffic.
✓ Correct Answer: D, E
  • D is correct because AWS VPC Traffic Mirroring treats mirrored traffic as lower priority than standard production traffic. If the underlying network interface faces performance saturation or congestion, the hypervisor will drop mirrored packets first to preserve production uptime.
  • E is correct because a Network Load Balancer (NLB) serving as a mirror target might face an internal initialization or warming bottleneck during an immense, instantaneous surge of random production traffic, leading to dropped target delivery.
Q8 Network Design
A retail company is migrating its on-premises application to the AWS Cloud. Currently, the company has two on-premises data center locations. One data center is on the east coast of the United States, and one data center is on the west coast. Each data center hosts four database systems. The largest database system stores 500 GB of data. The data centers are interconnected by two 10 GbE circuits for data synchronization. Each data center has two separate 1 GbE upstream internet connections. The company plans to have eight total VPCs to service its multiple business units. Four VPCs will be in the us-east-1 Region, and four will be in the us-west-2 Region. A network engineer needs to design a connectivity solution that allows VPC-to-VPC connectivity. The solution must also allow secure connections between the on-premises data centers and AWS during the migration process. The company expects spikes in traffic among the VPCs during database synchronization. The company wants to run the migration plan during one weekend and as soon as technically possible. The company also wants to minimize long-term operational and human resources costs. Which combination of steps will meet these requirements? (Choose two.)
  1. Deploy one transit gateway and attach all VPCs to it. Update the transit gateway and VPC route tables to allow any VPC to connect to any other VPC.
  2. Configure VPC peering between all the VPCs. Update the VPC route tables to allow connectivity.
  3. Provision two AWS Direct Connect connections from two Direct Connect locations that serve us-east-1 and us-west-2 to provide connectivity between the data centers and AWS.
  4. Provision one transit gateway VPN attachment for each data center to build connectivity between the on-premises data centers and AWS VPCs.
  5. Provision one AWS Site-to-Site VPN connection for each data center and for each VPC to build connectivity between the on-premises data centers and AWS VPCs.
✓ Correct Answer: A, D
  • The company needs to link 8 total VPCs spanning two distant Regions (us-east-1 and us-west-2) over a single weekend with minimal operational complexity. Setting up a full mesh of individual VPC Peering links (B) scales horribly ($8 \times 7 / 2 = 28$ peering connections). Utilizing Transit Gateways (A) dramatically minimizes routing complexity.
  • To safely connect the physical on-premises sites to the cloud immediately over existing infrastructure without waiting weeks to engineer new physical lines, provisioning a Transit Gateway VPN attachment (D) for each data center sets up encrypted secure links instantly over the internet.
Q9 Network Design
A company has a web application that runs in eight AWS Regions. In each Region, the application is hosted on multiple compute resources behind an Application Load Balancer (ALB). The different Regions are using different domains. Each ALB is configured to accept only HTTPS traffic. Each ALB uses a certificate from AWS Certificate Manager (ACM). The company wants to simplify the application’s appearance on the web by using a new single domain for all Regions. A network engineer needs to implement this change by designing a solution that also will minimize latency for the application's end users. Which combination of actions will meet these requirements? (Choose three.)
  1. Use ACM to create an SSL/TLS certificate in the us-east-1 Region for the new domain.
  2. Set up latency-based routing in Amazon Route 53 for the new domain. Add the ALBs from all the Regions as targets.
  3. Create an alias record for the accelerator in Amazon Route 53 for the new domain.
  4. Create a standard accelerator in AWS Global Accelerator. Configure a listener for TCP traffic. Add all the ALBs as targets for the listener.
  5. Use ACM to create an SSLITLS certificate for each Region. Configure all the ALBs to use the certificate in their respective Regions.
  6. Create a custom routing accelerator in AWS Global Accelerator. Configure a listener for HTTPS traffic. Add all the ALBs as targets for the listener. Configure the accelerator to terminate TLS by using the SSLITLS certificate from ACM.
✓ Correct Answer: A, C, D
To simplify the application's appearance using a single new domain across all eight Regions and minimize latency, you should use AWS Global Accelerator (D). Global Accelerator provides Anycast static public IP addresses and terminates TCP/UDP connections close to users at edge locations. Because it acts globally, its SSL/TLS certificates must be created inside AWS Certificate Manager (ACM) specifically in the us-east-1 Region (A). Finally, you route your user-facing domain traffic to the accelerator by defining an Alias record in Amazon Route 53 (C).
Q10 Network Design
A logistics company has multiple VPCs in an AWS Region. The company uses a transit gateway to connect the VPCs. The company has several on-premises offices that connect to the transit gateway by using AWS Site-to-Site VPN connections over the internet. The company has configured one transit gateway VPN attachment for each office. Route propagation is enabled on all route tables. Each Site-to-Site VPN connection uses two tunnels in an active-passive configuration. The company configured each office with appropriate static routes on both the Site-to-Site VPN connection and the office’s customer gateway. The company wants to use both IPsec tunnels of every office to maximize the overall VPN connection bandwidth. Which design changes are necessary to meet these requirements?
  1. Create an AWS Transit Gateway Connect attachment for each office Use the existing VPN attachments as the transport for the new Connect attachments. Set up a Generic Routing
  2. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Enable ECMP on the Site-to-Site VPN connection. Ensure static routes on the customer gateways have equal metrics and administrative distance.
  3. Enable equal-cost multi-path (ECMP) routing on the transit gateway. (Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Remove related static routes from the customer gateways.
  4. Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supported by and enabled on the customer gateways. Change the routing configuration between the transit gateway and the customer gateways from static routing to BGP. Ensure the customer gateway applies the correct community strings to give the transit gateway the ability to perform ECMP forwarding.
✓ Correct Answer: C
Standard AWS Site-to-Site VPN connections terminate on a Transit Gateway in an active-passive state by default when using static routing. To turn both tunnels into an active-active layout to double your bandwidth capacity, you must enable Equal-Cost Multi-Path (ECMP) routing on the transit gateway and transition the routing configuration to BGP (C). BGP allows the dynamic exchange of paths, allowing ECMP to utilize both tunnels simultaneously to distribute multi-flow traffic evenly.
Q11 Network Design
A company is planning to use an AWS Transit Gateway hub and spoke architecture to migrate to AWS. The current on-premises multi-protocol label switching (MPLS) network has strict controls that enforce network segmentation by using MPLS VPNs. The company has provisioned two 10 Gbps AWS Direct Connect connections to provide resilient, high-speed, low-latency connectivity to AWS. A security engineer needs to apply the concept of network segmentation to the AWS environment to ensure that virtual routing and forwarding (VRF) is logically separated for each of the company's software development environments. The number of MPLS VPNs will increase in the future. On-premises MPLS VPNs will have overlapping address space. The company's AWS network design must support overlapping address space for the VPNs. Which solution will meet these requirements with the LEAST operational overhead?
  1. Deploy a software-defined WAN (SD-WAN) head-end virtual appliance and an SD-WAN controller into a Transit Gateway Connect VPC. Configure the company's edge routers to be managed by the new SD-WAN controller and to use SD-WAN to segment the traffic into the defined segments for each of the company's development environments.
  2. Configure IPsec VPNs on the company edge routers for each MPLS VPN for each of the company's development environments. Attach each IPsec VPN tunnel to a discrete MPLS VPN. Configure AWS Site-to-Site VPN connections that terminate at a transit gateway for each MPLS VPN. Configure a transit gateway route table that matches the MPLS VPN for each Transit Gateway VPN attachment.
  3. Create a transit VPC that terminates at the AWS Site-to-Site VRF-aware IPsec VPN. Configure IPsec VPN connections to each VPC for each of the company's development environment VRFs.
  4. Configure a Transit Gateway Connect attachment for each MPLS VPN between the company's edge routers and Transit Gateway. Configure a transit gateway route table that matches the MPLS VPN for each of the company's development environments.
✓ Correct Answer: D
AWS Transit Gateway Connect attachments let you extend native on-premises GRE (Generic Routing Encapsulation) tunnels and BGP sessions directly into AWS. Because Transit Gateway Connect supports multiple routing tables, you can map each separate Connect attachment directly to its own isolated Transit Gateway Route Table. This maps directly to your on-premises virtual routing and forwarding (VRF) segmentation architecture, handling overlapping IP address spaces with the absolute least operational overhead (D).
Q12 Network Design
A media company is planning to host an event that the company will live stream to users. The company wants to use Amazon CloudFront. A network engineer creates a primary origin and a secondary origin for CloudFront. The engineer needs to ensure that the primary origin can fail over to the secondary origin within 15 seconds if a disruption occurs. Which solution will meet this requirement with the LEAST operational overhead?
  1. Configure a Lambda@Edge function to check the health status of both origins every 10 seconds. Reroute incoming requests when the origin health status is unhealthy.
  2. Create a Network Load Balancer (NLB) in front of both origins Configure the NLB as the origin in CloudFront.
  3. Set the CloudFront origin connection timeout value to 5 seconds Set the origin connection attempts value to 2.
  4. Configure a Lambda@Edge function to monitor incoming requests for an origin response. Reroute incoming requests if no response is received from the primary origin within 10 seconds.
✓ Correct Answer: C
Amazon CloudFront supports native origin failover using origin groups. By default, CloudFront attempts to connect to the primary origin 3 times with a timeout of 10 seconds per attempt (taking up to 30 seconds before failing over). To meet the requirement of failing over within 15 seconds with the least operational overhead, you can natively lower these values. Setting the connection timeout to 5 seconds and the connection attempts to 2 means CloudFront will spend a maximum of $5 \times 2 = 10$ seconds before cleanly failing over to the secondary origin.
Q13 Network Design
A company is migrating its containerized applications to AWS. The architecture will have an ingress VPC with a Network Load Balancer (NLB) to distribute traffic to frontend pods in an Amazon EKS cluster. The application frontend will determine which user is requesting access and send traffic to one of 10 service VPCs. Each service VPC will include an NLB to distribute traffic to service pods in the EKS cluster. The company is concerned about overall cost. User traffic will result in more than 10 TB of data transfer per month from the ingress VPC to the service VPCs. A network engineer needs to advise on how to design communication between VPCs. Which solution meets these requirements at the LOWEST cost?
  1. Create a transit gateway. Peer each VPC with the transit gateway. Use the Regional DNS name of the NLB in the service VPCs to minimize cross-AZ traffic from the ingress VPC to the service VPCs.
  2. Create an AWS PrivateLink endpoint in each AZ of the ingress VPC. Each PrivateLink endpoint points to the Regional DNS entry of the NLB in the service VPCs.
  3. Create VPC peering connections between the ingress VPC and each of the 10 service VPCs. Use the Regional DNS name of the NLB in the service VPCs to minimize cross-AZ traffic from the ingress VPC to the service VPCs.
  4. Create a transit gateway. Peer each VPC with the transit gateway. Turn off cross-AZ load balancing on the transit gateway. Use the Regional DNS name of the NLB in the service VPCs.
✓ Correct Answer: C
VPC peering has no additional cost for data transfer between VPCs within the same AZ and region, making it the lowest cost option for this scenario. Transit Gateway (A, D) charges per GB of data processed. PrivateLink (B) charges per endpoint hour and data processed. VPC peering with Regional DNS names minimizes cross-AZ traffic (which incurs charges). This provides the lowest cost for >10 TB/month data transfer.
Q14 Network Design
An infrastructure engineering team wants to use the AWS Cloud Development Kit (AWS CDK) to automate the deployment of Application Load Balancer (ALB) components. The CDK application must deploy a reusable infrastructure stack that is consistent across multiple environments, AWS Regions, and AWS accounts. The lead network architect for the project has already bootstrapped the target accounts. The lead network architect has also deployed core networking components such as VPCs and Amazon Route 53 private hosted zones across multiple environments and Regions. The infrastructure engineers must design the ALB components in the CDK application to use the existing core networking components. Which combination of steps meets this requirement with the LEAST manual effort? (Choose two.)
  1. Design the CDK application to read AWS CloudFormation parameters whose values vary by environment and Region. Reference these variables in the CDK stack for resources that need these variables.
  2. Design the CDK application to read environment variables at runtime that contain the account and Region details. Use these variables as properties of the CDK stack. Use context methods in the CDK stack to retrieve the variable values.
  3. Create a dedicated account for shared application services in the multi-account environment. Deploy a CDK pipeline to the dedicated account. Create stages in the pipeline to deploy the CDK application in different environments and Regions.
  4. Write a script to automatically deploy the CDK application across multiple environments and Regions. Distribute the script to engineers working on the project.
  5. Use the CDK toolkit locally to deploy the stack to each environment and Region. Use the --context flag to pass in variables that the CDK application can reference at runtime.
✓ Correct Answer: B, C
The most efficient approach uses CDK context methods to retrieve environment variables (B) for environment-specific configuration, and a dedicated shared-account CDK pipeline (C) for cross-account/cross-Region deployments. The pipeline uses stages to deploy to different environments consistently. This minimizes manual effort compared to local deployment scripts or manual toolkit usage.

You've viewed 3 of 137 questions. Start the free practice exam to answer all questions with instant feedback.

What Our Customers Say 84 verified reviews

4.2 ★★★★★★ Based on 84 reviews
★★★★★★
Highly recommended for Amazon certification. The ANS-C01 practice questions are worth every penny.
— Andrew M.
★★★★★★
Really well-structured ANS-C01 practice set. I like that you can attempt questions multiple times and it tracks your progress.
— Lucas W.
★★★★★
My colleague recommended this for ANS-C01 and I’m glad I listened. Passed on my first go after two weeks of solid study.
— Logan T.
★★★★★
Passed the ANS-C01 exam today! The scenario-based questions here were extremely similar to what I saw on the test.
— Riley B.
★★★★★★
The ANS-C01 practice questions were incredibly helpful. The detailed explanations made all the difference. Passed on my first attempt!
— James K.
★★★★★★
The ANS-C01 practice test is spot-on. The multi-select questions and explanations are exactly what you need for the real exam.
— Emily R.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

The AWS Certified Advanced Networking - Specialty (ANS-C01) is an AWS Specialty-level certification exam. It is considered one of the most challenging AWS certifications due to its depth of networking knowledge required. Candidates typically need 5+ years of networking experience and 2+ years of cloud networking experience. The exam includes 65 scored questions across four domains with a 170-minute time limit.

AWS recommends 5+ years of networking experience and 2+ years of hands-on experience with AWS cloud and hybrid networking. There are no formal prerequisites, but thorough knowledge of Direct Connect, Transit Gateway, Route 53, CloudFront, Network Firewall, and BGP is expected. Prior AWS certification at the Associate or Professional level is helpful but not required.

Most candidates spend 8-12 weeks preparing for the ANS-C01 exam. The four domains to study are: Network Design (30%), Network Implementation (26%), Network Security, Compliance, and Governance (24%), and Network Management and Operation (20%). With 137 practice questions covering all domains, thorough preparation across each weighted area is essential.

AWS uses a scaled scoring model from 100 to 1000. The minimum passing score for AWS Specialty exams like ANS-C01 is 750/1000. The scaled score does not directly correspond to a percentage of correct answers. AWS Specialty exams are scored against a standard established by AWS professionals following industry best practices.

The actual ANS-C01 exam contains 65 total questions: 50 scored and 15 unscored pilot questions. Our compiled question bank contains 137 practice questions covering all four exam domains, designed to help you prepare thoroughly. The exam has a 170-minute time limit.

Our practice questions are compiled based on comprehensive coverage of the official exam domains, incorporating actual exam scenarios combined with professionally developed questions. The content is regularly reviewed and updated to reflect the latest exam objectives and AWS best practices, ensuring relevance for your preparation.

The ANS-C01 exam is designed for senior network engineers, cloud network architects, and IT professionals with 5+ years of networking experience who want to validate their expertise in designing, implementing, and securing AWS and hybrid network architectures. It is particularly relevant for those working with Direct Connect, Transit Gateway, Route 53, CloudFront, and Network Firewall on a daily basis.

Free Study Resources

Community-verified analysis of 104 topics from real test-taker discussions — 44 deep analyses and 20 FAQs.

Full Study Guide 104 topics, exam overview & domain breakdown Most Debated Topics Ranked by community disagreement Technical FAQ 20 community-vetted answers