AWS ANS-C01: Advanced Networking Specialty Practice Exam

What the AWS ANS-C01 exam covers

• Network Design191 questions
• Network Implementation142 questions
• Network Management and Operation180 questions
• Network Security, Compliance, and Governance164 questions

Free AWS ANS-C01 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 677.

1. Question 1Network Design

   What is the scope of an Amazon VPC and its subnets?

   • AA VPC is regional; each subnet is within a single Availability ZoneCorrect
   • BA VPC is global; each subnet spans all Availability Zones in the Region
   • CA VPC is per-Availability-Zone; each subnet spans the whole Region
   • DA VPC is per-account; each subnet is global across all Regions
   ✓ Correct answer: A

   An Amazon VPC is a regional construct - it spans all Availability Zones within a single AWS Region but does not cross Regions. Within that VPC, each subnet is bound to exactly one Availability Zone, which is how you achieve AZ-level fault isolation by distributing resources across multiple subnets in different AZs.

   Why the other options are wrong

   • BA VPC is regional, not global, and a subnet lives in one AZ rather than spanning all AZs.
   • CA VPC spans a Region while a subnet is confined to a single AZ, so this reverses the real scoping.
   • DA VPC is scoped to one Region and a subnet to one AZ; neither is account-wide or multi-Region.
2. Question 2Network Implementation

   When creating a Network Load Balancer that needs a fixed Elastic IP in a subnet, which mapping syntax is correct?

   • Aaws elbv2 create-load-balancer --type network --subnets subnet-a --elastic-ip eipalloc-123
   • Baws elbv2 create-load-balancer --type application --subnet-mappings SubnetId=subnet-a,AllocationId=eipalloc-123
   • Caws elbv2 create-load-balancer --type network --static-ip 52.1.2.3
   • Daws elbv2 create-load-balancer --type network --subnet-mappings SubnetId=subnet-a,AllocationId=eipalloc-123Correct
   ✓ Correct answer: D

   To assign a fixed Elastic IP to a Network Load Balancer subnet, you must use `--subnet-mappings` with the `SubnetId` and `AllocationId` key-value pairs in the same `create-load-balancer` call. The `--type network` flag is required for an NLB; using `--type application` would create an ALB, which does not support Elastic IP assignment.

   Why the other options are wrong

   • Aaws elbv2 create-load-balancer --type network --subnets ... --elastic-ip is incorrect because NLBs do not accept a standalone --elastic-ip flag; Elastic IPs must be specified inside --subnet-mappings as AllocationId.
   • BUsing --type application with --subnet-mappings is incorrect because Application Load Balancers do not support Elastic IP (AllocationId) assignment in subnet mappings - only Network Load Balancers support this.
   • Caws elbv2 create-load-balancer --type network --static-ip is not a valid AWS CLI syntax; there is no --static-ip parameter for NLB creation - the correct parameter is --subnet-mappings with AllocationId.
3. Question 3Network Management and Operation

   A team enabled VPC Flow Logs on a subnet but reports that some short-lived connections never appear. What is the most likely cause?

   • AFlow Logs record only the first packet of each new TCP session and drop the rest of the flow
   • BFlow Logs require Traffic Mirroring to be enabled on the ENI before any records appear
   • CFlow Logs capture only egress traffic unless ingress logging is also separately enabled
   • DFlow Logs aggregate over a 10-minute capture window and exclude categories like instance metadata and DNSCorrect
   ✓ Correct answer: D

   VPC Flow Logs aggregate network flows within a capture window that defaults to 10 minutes (or optionally 1 minute for per-minute granularity). Very short-lived connections that complete within the window will be included in the aggregate, but connections in excluded categories - such as instance metadata requests, DNS queries to the Amazon Resolver, DHCP, and Windows license activation - will never appear. The combination of the capture window and category exclusions can make certain short-lived or excluded connections invisible in the logs.

   Why the other options are wrong

   • AFlow Logs aggregate whole flows over a window, not just the first packet of a session.
   • BFlow Logs work independently and do not require Traffic Mirroring to be enabled.
   • CFlow Logs can capture ingress, egress, or all traffic based on the chosen traffic type, not egress-only.
4. Question 4Network Security, Compliance, and Governance

   AWS Network Firewall must export alert and flow logs for compliance. Which statement is correct about its logging?

   • AIt logs only to an S3 bucket in the same account as the firewall endpoint
   • BIt produces ALERT and FLOW logs to CloudWatch, S3 or Amazon Data FirehoseCorrect
   • CIt emits FLOW logs only and cannot produce stateful ALERT log entries
   • DIt writes logs directly to VPC Flow Logs rather than its own log types
   ✓ Correct answer: B

   AWS Network Firewall has a built-in logging subsystem that produces three log types: ALERT logs for traffic matching stateful or stateless drop/alert rules, FLOW logs for all network connections passing through, and TLS logs for TLS inspection activity. Each log type can be independently directed to Amazon CloudWatch Logs, an S3 bucket, or an Amazon Data Firehose delivery stream, satisfying compliance requirements for centralized, durable log storage.

   Why the other options are wrong

   • ANetwork Firewall can log to CloudWatch Logs, S3, or Kinesis Firehose, not only to S3.
   • CIt produces both ALERT and FLOW log types, so stateful alerts are supported.
   • DNetwork Firewall emits its own ALERT and FLOW log types rather than writing into VPC Flow Logs.
5. Question 5Network Management and Operation

   Instances in a private subnet suddenly lose internet egress while instances in another AZ are fine. VPC Flow Logs show the affected subnet's outbound packets reach the NAT gateway but no return traffic. What is the most likely cause?

   • AThe internet gateway was detached from the VPC, cutting off egress for that one subnet only
   • BThe instances' security group is blocking the ephemeral return ports on outbound rules
   • CThe subnet's NAT gateway is failed, deleted, or in an impaired AZ, while the route still points to itCorrect
   • DThe subnet's network ACL is denying the outbound return traffic on the ephemeral port range
   ✓ Correct answer: C

   Security, performance, and cost are interconnected in AWS network design. A secure architecture might require additional encryption overhead, centralized inspection adds processing costs, and high availability might necessitate replication across regions or AZs, each carrying distinct cost implications.

   Why the other options are wrong

   • AA detached IGW would affect the whole VPC, not just one AZ's subnet, and outbound packets already reach the NAT gateway.
   • BSecurity groups are stateful and automatically allow return traffic for outbound flows.
   • DA NACL deny would drop the outbound packets before the NAT gateway, but they are reaching it, so return traffic loss points to the NAT gateway itself.
6. Question 6Network Design

   A team is evaluating whether to deploy a Gateway Load Balancer (GWLB) for inline traffic inspection. Which statement correctly describes how GWLB integrates into a VPC traffic path?

   • AGWLB uses GENEVE protocol on port 6081 to transparently forward and return trafficCorrect
   • BGWLB terminates TLS and forwards decrypted HTTP traffic to inspection appliances via standard HTTP
   • CGWLB replaces security groups and NACLs by enforcing firewall rules directly on the load balancer
   • DGWLB requires routing all traffic through an internet gateway before the appliance can inspect it
   ✓ Correct answer: A

   Gateway Load Balancer operates at Layer 3 and uses the GENEVE encapsulation protocol (UDP port 6081) to send original packets to registered virtual appliance targets (firewalls, IDS/IPS) and receive them back unchanged. Traffic is then forwarded to its destination, making inspection completely transparent to the original source and destination. This design allows arbitrary third-party network appliances to be inserted inline without modifying the application or packet headers.

   Why the other options are wrong

   • BGWLB operates at Layer 3/4 and does not terminate TLS or perform any application-layer (Layer 7) processing; that is the role of an Application Load Balancer.
   • CGWLB does not replace security groups or NACLs; it provides a traffic forwarding path to appliances that enforce their own policies.
   • DGWLB does not require an internet gateway; it is designed for inspecting traffic inside a VPC regardless of whether that traffic is internet-bound.
7. Question 7Network Security, Compliance, and Governance

   A team must implement mutual TLS (mTLS) for an API hosted behind an Application Load Balancer so that only clients presenting valid certificates from a specific internal CA are accepted. Which ALB feature enables this?

   • AConfigure the ALB listener with HTTPS and attach a custom server certificate; clients authenticate via Cognito.
   • BEnable mutual TLS authentication on the ALB HTTPS listener by uploading a trust store containing the CA certificate; set the mode to verify.Correct
   • CPlace an AWS WAF web ACL in front of the ALB with a rule that checks the client certificate header injected by CloudFront.
   • DUse Network Load Balancer with TCP passthrough to the backend where application code validates client certificates.
   ✓ Correct answer: B

   Application Load Balancers support mutual TLS (mTLS) natively on HTTPS listeners. You create a trust store in ACM (or upload a CA bundle) containing the root/intermediate CA certificates that are trusted to sign client certificates. When mTLS mode is set to 'verify', the ALB requires clients to present a valid certificate signed by a CA in the trust store and rejects connections from clients that cannot present such a certificate. This offloads client certificate validation from application code to the load balancer.

   Why the other options are wrong

   • ACognito on an ALB listener provides OAuth2/OIDC-based user authentication, not certificate-based mTLS. This approach does not validate X.509 client certificates.
   • CAWS WAF inspects HTTP request headers and body but does not perform TLS-layer operations. CloudFront can inject headers with client certificate metadata, but this architecture adds unnecessary complexity and does not implement mTLS at the ALB.
   • DUsing NLB with TCP passthrough to application-layer mTLS handling is a valid approach but requires custom application code, is less operationally simple, and does not leverage the ALB's native mTLS feature. The question asks which ALB feature enables this.
8. Question 8Network Design

   A company runs an active-active multi-Region application and wants clients to connect to a static set of IP addresses while traffic is automatically routed to the nearest healthy Region with sub-minute failover. Which service should be in the design?

   • AAWS Global AcceleratorCorrect
   • BAmazon CloudFront with an S3 origin
   • CRoute 53 simple routing
   • DA single Network Load Balancer in one Region
   ✓ Correct answer: A

   Global Accelerator assigns two static anycast IP addresses at AWS edge locations and routes connections over the AWS backbone to the optimal healthy endpoint, with failover measured in seconds rather than DNS TTLs, satisfying the static-IP and rapid failover requirements.

   Why the other options are wrong

   • BCloudFront accelerates content delivery but does not provide static anycast IPs for arbitrary TCP/UDP application traffic with regional failover.
   • CRoute 53 simple routing offers no health-based failover and depends on DNS TTL caching, which is slow.
   • DA single-Region NLB provides no multi-Region failover or static global IPs.
9. Question 9Network Implementation

   You are deploying a Gateway Load Balancer (GWLB) for a fleet of third-party firewall appliances. Which protocol does the GWLB use to encapsulate and tunnel traffic between the GWLB and the appliances?

   • AGENEVE on port 6081Correct
   • BVXLAN on port 4789
   • CGRE on protocol 47
   • DIPsec ESP on protocol 50
   ✓ Correct answer: A

   The Gateway Load Balancer transparently inserts virtual appliances such as firewalls and IDS/IPS into the traffic path by encapsulating the original packets in GENEVE (Generic Network Virtualization Encapsulation) on UDP port 6081. The appliances must support GENEVE decapsulation/re-encapsulation to inspect traffic and return it to the GWLB.

   Why the other options are wrong

   • BVXLAN on port 4789 is used by some overlay networks but is not the encapsulation GWLB uses with its appliance targets.
   • CGRE (protocol 47) is a generic tunneling protocol but is not the GWLB encapsulation mechanism.
   • DIPsec ESP (protocol 50) is used for encrypted VPN tunnels, not for GWLB appliance encapsulation.
10. Question 10Network Security, Compliance, and Governance

    During an incident, responders need to immediately isolate a compromised EC2 instance so it can no longer communicate, while preserving it for forensic analysis. Which action best achieves immediate isolation without terminating the instance?

    • ADetach the instance's primary elastic network interface to sever all its connectivity
    • BReplace the instance's security groups with a quarantine security groupCorrect
    • CApply a restrictive subnet network ACL that denies all inbound and outbound traffic
    • DRemove the instance's default route to the NAT gateway to block outbound egress
    ✓ Correct answer: B

    Security groups are stateful and deny by default; assigning a quarantine group with no inbound or outbound rules instantly blocks all new and return traffic without stopping the instance, preserving volatile memory and disk state for forensics. This is the standard isolation step in AWS incident response.

    Why the other options are wrong

    • ADetaching the primary ENI disrupts the instance and can affect forensic state; swapping the security group is cleaner.
    • CA subnet NACL blocks every instance in the subnet, not just the suspect one, and is slower to scope precisely.
    • DRemoving the NAT route blocks only some outbound internet traffic and leaves inbound and intra-VPC paths open.

Who this AWS ANS-C01 practice exam is for

This practice set is for anyone preparing for the AWS ANS-C01: Advanced Networking Specialty exam at the advanced level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS ANS-C01 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS ANS-C01 exam.

Related AWS resources

• AWS ANS-C01 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS Certified CloudOps Engineer - Associate (SOA-C03) practice examRelated
• AWS Certified Data Engineer - Associate (DEA-C01) practice examRelated

AWS ANS-C01 practice exam FAQ