AWS ANS-C01: Advanced Networking Specialty Practice Exam

What the AWS ANS-C01 exam covers

• Network Design184 questions
• Network Implementation137 questions
• Network Management and Operation173 questions
• Network Security, Compliance, and Governance158 questions

Free AWS ANS-C01 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 652.

1. Question 1Network Design

   What is the scope of an Amazon VPC and its subnets?

   • AA VPC is regional; each subnet is within a single Availability ZoneCorrect
   • BA VPC is global; each subnet spans all Availability Zones in the Region
   • CA VPC is per-Availability-Zone; each subnet spans the whole Region
   • DA VPC is per-account; each subnet is global across all Regions
   ✓ Correct answer: A

   An Amazon VPC is a regional construct - it spans all Availability Zones within a single AWS Region but does not cross Regions. Within that VPC, each subnet is bound to exactly one Availability Zone, which is how you achieve AZ-level fault isolation by distributing resources across multiple subnets in different AZs.

   Why the other options are wrong

   • BA VPC is regional, not global, and a subnet lives in one AZ rather than spanning all AZs.
   • CA VPC spans a Region while a subnet is confined to a single AZ, so this reverses the real scoping.
   • DA VPC is scoped to one Region and a subnet to one AZ; neither is account-wide or multi-Region.
2. Question 2Network ImplementationSelect all that apply

   Which TWO commands together establish VPC peering between two VPCs and make it usable? (Choose TWO)

   • Aaws ec2 associate-vpc-peering-connection --vpc-id vpc-a --peer-vpc-id vpc-b
   • Baws ec2 accept-vpc-peering-connection --vpc-peering-connection-id pcx-123Correct
   • Caws ec2 attach-vpc-peering-connection --vpc-peering-connection-id pcx-123
   • Daws ec2 create-vpc-peering-connection --vpc-id vpc-a --peer-vpc-id vpc-bCorrect
   ✓ Correct answer: B, D

   Establishing VPC peering requires two steps: first, `aws ec2 create-vpc-peering-connection` initiates the request from the requester VPC, generating a pending-acceptance peering connection ID. Second, `aws ec2 accept-vpc-peering-connection` on the accepter side (same or different account) accepts the request, making the peering connection active and ready for route table configuration.

   Why the other options are wrong

   • Aaws ec2 associate-vpc-peering-connection is not a valid AWS CLI command; there is no association step in the VPC peering workflow - peering uses create and accept.
   • Caws ec2 attach-vpc-peering-connection is not a valid AWS CLI command; VPC peering does not use an attach verb - the correct flow is create followed by accept.
3. Question 3Network Management and Operation

   A health check on an ALB target group marks targets unhealthy intermittently. The team set the health check to a path that returns 301 redirects. What is the gotcha with ALB health check success codes?

   • AThe ALB treats any received HTTP response, even errors, as a healthy target
   • BThe ALB only accepts 500-series server-error responses as a healthy status
   • CThe ALB ignores the HTTP status code entirely and checks only TCP connectivity
   • DBy default the ALB expects HTTP 200; a 301 is unhealthy unless the matcher allows 3xx codesCorrect
   ✓ Correct answer: D

   The ALB target group health check success codes default to 200. If your health check path issues a 301 redirect, the ALB receives the 3xx response and considers the target unhealthy because 301 is not in the accepted range. You can fix this by editing the health check matcher in the target group settings to include additional status codes such as 200-301 or 200,301, explicitly allowing redirect responses to count as healthy.

   Why the other options are wrong

   • AThe ALB evaluates the status code against the matcher, so not every response is treated as healthy.
   • BThe default healthy matcher is 200, not the 500 series which indicates failure.
   • CHTTP health checks evaluate the status code, not just TCP reachability.
4. Question 4Network Security, Compliance, and Governance

   A security group references another security group as its source. An admin assumes this means traffic from the source SG's instances is allowed even across a VPC peering connection. What is the gotcha?

   • ASecurity group references are supported only when the peer VPCs share the exact same CIDR block
   • BSG references over peering work only when both peered VPCs are in the same Availability Zone
   • CSecurity group references work across any VPC peering connection, including cross-Region
   • DSG references over a peering connection work only in the same Region; cross-Region peering is unsupportedCorrect
   ✓ Correct answer: D

   Within the same Region, security group references across a peered VPC connection are supported as long as both VPCs are in the same account or the peering is configured for cross-account SG referencing. However, cross-Region VPC peering does not support security group references - you cannot use a security group from a VPC in another Region as a source in your security group rules. The admin must use CIDR-based rules for cross-Region peering scenarios.

   Why the other options are wrong

   • ASG references require non-overlapping CIDRs across the peering, not identical CIDR blocks.
   • BSG references work across AZs within the same Region; the AZ is not the constraint.
   • CCross-Region peering specifically does not support security group references, so this is false.
5. Question 5Network ImplementationSelect all that apply

   A team weighs a NAT gateway against a NAT instance. Which TWO statements are TRUE? (Choose TWO)

   • AA NAT instance scales automatically and requires no patching
   • BA NAT gateway can be used as a bastion host and supports port forwarding
   • CA NAT gateway is AWS-managed and scales automatically to a high bandwidth ceiling (up to ~100 Gbps) per gatewayCorrect
   • DA NAT instance can double as a bastion or support port forwarding, which a NAT gateway cannotCorrect
   ✓ Correct answer: C, D

   A NAT instance can double as a bastion or support port forwarding, which a NAT gateway cannot. Network design in AWS involves balancing multiple factors: availability across AZs, cost optimization through resource consolidation, security requirements including encryption and inspection, and performance metrics like throughput and latency. Each component adds layers of complexity that must be carefully evaluated against the overall architecture goals.

   Why the other options are wrong

   • AA NAT instance scales automatically and requires no patching is incorrect because this option does not provide the technical solution described in the correct answer.
   • BA NAT gateway can be used as a bastion host and supports port forwarding is incorrect because this option does not provide the technical solution described in the correct answer.
6. Question 6Network Security, Compliance, and Governance

   You must allow a third-party SaaS to assume access into your account for network monitoring without sharing long-lived credentials, while protecting against the confused-deputy problem. Which IAM mechanism is recommended?

   • AA resource-based policy on a shared S3 bucket granting the SaaS account monitoring access
   • BA security group permitting the SaaS provider's published IP range inbound
   • CA cross-account IAM role with sts:AssumeRole and an ExternalId condition the SaaS must supplyCorrect
   • DAn IAM user with an access key generated and emailed securely to the SaaS provider
   ✓ Correct answer: C

   AWS networking architecture requires careful planning of VPC design, subnet allocation, routing strategies, and security controls. Understanding the trade-offs between different services-such as the cost of Transit Gateway data-processing versus endpoint duplication, or NAT gateway overhead versus NAT instances-is essential for building cost-efficient networks. The choice of connectivity method (Direct Connect vs VPN), endpoint type (gateway vs interface), and inspection strategy directly impacts both operational costs and performance characteristics.

   Why the other options are wrong

   • AA bucket policy grants object access, not the assumable role identity needed for account-wide network monitoring.
   • BA security group controls network reachability and provides no cross-account identity or confused-deputy protection.
   • DAn IAM user access key is a long-lived shared credential, which the requirement explicitly avoids.
7. Question 7Network Security, Compliance, and Governance

   A network security team must log DNS queries made by EC2 instances in a VPC to detect data exfiltration via DNS tunneling. Which service provides this capability with minimal configuration?

   • AEnable VPC Flow Logs and filter for UDP port 53 traffic.
   • BEnable Route 53 Resolver Query Logging for the VPC; forward logs to CloudWatch Logs or S3.Correct
   • CDeploy a custom DNS server on EC2 with query logging enabled and route all DNS traffic through it.
   • DEnable AWS CloudTrail data events for Route 53 to capture DNS query API calls.
   ✓ Correct answer: B

   Amazon Route 53 Resolver Query Logging is a managed feature that captures all DNS queries resolved through the VPC's Route 53 Resolver (the .2 address). It records the queried domain name, query type, response, source IP, and timestamp. Logs can be sent to CloudWatch Logs, S3, or Kinesis Data Firehose. This is the native, zero-infrastructure solution specifically designed for DNS query visibility and is the recommended approach for detecting DNS-based exfiltration or tunneling.

   Why the other options are wrong

   • AVPC Flow Logs capture IP-level metadata (source/destination IP, port, bytes, action) but do not capture the payload or the queried domain name. Seeing UDP port 53 traffic tells you DNS occurred but not what was queried, making it insufficient for DNS tunneling detection.
   • CDeploying a custom DNS server introduces significant operational overhead, requires routing changes (DHCP option sets), and creates a single point of failure - this is unnecessary when Route 53 Resolver Query Logging exists as a managed feature.
   • DCloudTrail data events log API calls to AWS services. Route 53 DNS query resolution is not an API call - it is network resolution traffic and is not captured by CloudTrail.
8. Question 8Network Design

   An architect must design inter-Region connectivity between a Transit Gateway in us-east-1 and a Transit Gateway in eu-west-1 so VPCs in both Regions can route to each other over the AWS backbone. Which capability is used?

   • ATransit Gateway inter-Region peeringCorrect
   • BVPC peering between the two TGWs
   • CA single TGW spanning both Regions
   • DDirect Connect gateway between the TGWs
   ✓ Correct answer: A

   TGW inter-Region peering creates a peering attachment between Transit Gateways in different Regions, with traffic carried privately and encrypted over the AWS backbone. You then add static routes (propagation is not supported across the peering) to enable VPC-to-VPC routing across Regions.

   Why the other options are wrong

   • BVPC peering connects VPCs, not Transit Gateways.
   • CA Transit Gateway is a Regional resource and cannot span Regions.
   • DA Direct Connect gateway connects on-prem to VPCs/TGWs, not two TGWs across Regions for backbone peering.
9. Question 9Network Implementation

   An Application Load Balancer must route requests to different target groups based on a custom HTTP header value sent by a client SDK. Which ALB listener rule condition supports this?

   • AHTTP header conditionCorrect
   • BSource IP condition
   • CHost header condition only
   • DQuery string condition only
   ✓ Correct answer: A

   ALB supports listener rule conditions including host-header, path-pattern, http-request-method, source-ip, query-string, and http-header. The http-header condition matches any custom header (other than Host and Cookie) against specified values, enabling routing on a client SDK header.

   Why the other options are wrong

   • BSource IP matches the client network address, not a custom application header.
   • CHost header matches only the Host field; it cannot match an arbitrary custom header.
   • DQuery string matches URL parameters, not request headers sent by the SDK.
10. Question 10Network Management and Operation

    You want continuous, agentless monitoring of round-trip latency and packet loss between two subnets in different Availability Zones, with results visualized over time. Which AWS capability is purpose-built for this?

    • AAmazon CloudWatch Network Monitor (Internet Monitor's intra-AWS counterpart) / CloudWatch synthetic network probes between sources and destinationsCorrect
    • BVPC Flow Logs with a CloudWatch metric filter counting bytes between the two subnet CIDRs over time
    • CAWS Transit Gateway Network Manager route analysis validating the path between the two subnets
    • DVPC Reachability Analyzer paths between the subnet ENIs run on a recurring EventBridge schedule
    ✓ Correct answer: A

    CloudWatch Network Monitor creates monitors that measure round-trip time and packet loss between specified sources and destinations and publishes the results to CloudWatch metrics for dashboards and alarms, exactly matching continuous path-quality monitoring.

    Why the other options are wrong

    • BFlow logs report byte and packet counts, not continuous round-trip latency or packet-loss measurements.
    • CNetwork Manager route analysis validates reachability and paths but does not continuously measure latency and loss.
    • DReachability Analyzer evaluates configuration reachability, not live latency and packet-loss over time.

Related AWS resources

• AWS ANS-C01 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated

AWS ANS-C01 practice exam FAQ