AWS Certified Advanced Networking - Specialty (ANS-C01) Practice Exam
The AWS Certified Advanced Networking - Specialty practice exam simulates the real test, offering scenario-based questions that assess your ability to design, implement, and troubleshoot complex AWS networking solutions.
Exam domains
The ANS-C01 questions are grouped into 4 domains divided into 16 tasks.
ANS-C01 example questions
One example question per domain from the ANS-C01 question bank, with the correct answer and its explanation. Sign in to the simulator to answer them with all answer options.
A company runs an HTTPS application behind internet-facing Application Load Balancers (ALBs) in two AWS Regions. Route 53 latency alias records point to the ALBs, with Evaluate Target Health enabled. Each ALB has multiple listener rules that forward requests to separate production target groups. The company requires Route 53 to exclude a Region from new DNS responses if any production target group in that Region has no healthy targets, provided the other Region remains healthy. After a deployment, Route 53 stops returning one Region's ALB even though every production target group in that Region has healthy targets. Engineers discover that an obsolete preview listener rule on that ALB still references a target group with no registered targets. The preview service is permanently retired. Which change will restore latency-based routing to both Regions while preserving the required health-based exclusion behavior?
Show answer
CORRECT ANSWERRemove the obsolete preview listener rule and delete its unused target group. Keep Evaluate Target Health enabled on both latency alias records.
With Evaluate Target Health enabled, Route 53 considers an ALB healthy only when every associated target group has at least one healthy target. An associated target group with no registered targets is unhealthy. Removing the retired service's association eliminates the false regional failure while preserving health evaluation for every production target group.
A company connects its data center to an AWS Transit Gateway through AWS Site-to-Site VPN. A transit gateway VPC attachment provides access to an application on an EC2 instance. After a network change, an on-premises client cannot establish TCP connections to the instance on port 443. Transit Gateway Network Manager Route Analyzer reports that the VPN attachment can reach the VPC attachment in both directions. Before authorizing live test traffic, a network engineer must check whether the VPC configuration permits the client's inbound connection and identify any blocking configuration. Which approach best meets these requirements?
Show answer
CORRECT ANSWERUse VPC Reachability Analyzer to model the inbound path from the VPC's transit gateway attachment to the instance's network interface. Specify TCP destination port 443 and the on-premises client's source IP address, and inspect the analysis for blocking VPC components.
Reachability Analyzer performs configuration-based analysis without sending packets. Modeling the inbound AWS-side path with the client's source address and destination port can identify blocking security groups, network ACLs, and route configuration. This complements Route Analyzer's attachment-level results; it does not independently validate the on-premises network or live VPN data plane.
A financial analytics application transfers data between two Amazon EC2 instances in the same Availability Zone by using a single long-lived TCP connection. Each instance supports 100 Gbps networking and ENA Express, but the connection currently achieves approximately 5 Gbps. Testing confirms that CPU, memory, storage, and TCP window sizes are not bottlenecks. The company needs at least 15 Gbps for this single connection and lower tail latency during network congestion. The application cannot be modified to use a different networking library or multiple connections. Which change best meets these requirements without increasing the instance sizes?
Show answer
CORRECT ANSWEREnable ENA Express on the network interfaces used by both instances for the connection.
ENA Express uses AWS Scalable Reliable Datagram (SRD) transparently for supported TCP and UDP traffic between eligible instances in the same Availability Zone. It supports single-flow bandwidth of up to 25 Gbps and reduces tail latency under congestion without requiring application changes. Both communicating interfaces must have ENA Express enabled.
A company connects workload VPCs in multiple AWS accounts through a centrally managed AWS Transit Gateway. Compliance requires all inter-VPC traffic to pass through stateful firewall appliances in an inspection VPC. The inspection VPC has a transit gateway attachment subnet and a firewall appliance in each of two Availability Zones. VPC routing directs traffic from each attachment subnet through the firewall in that Availability Zone. The transit gateway route tables send traffic from workload attachments to the inspection attachment and send inspected traffic to the destination workload attachment. No direct workload-to-workload routes bypass inspection. During testing, some connections between workloads in different Availability Zones fail. Packet captures show that the forward and return packets traverse different firewall appliances, which drop packets because connection state is not shared. Security groups and network ACLs permit the required traffic. Which change will resolve the failures while retaining stateful inspection and the two-Availability-Zone architecture?
Show answer
CORRECT ANSWEREnable appliance mode on the inspection VPC's transit gateway attachment and retain the existing inspection routing.
Transit Gateway appliance mode maintains flow affinity to the same Availability Zone in the inspection VPC attachment for the lifetime of a flow, including return traffic. With the existing per-AZ routing through the firewalls, both directions traverse the same stateful appliance. Both Availability Zones can remain available for inspection.
Exam mode and practice mode
| Exam mode | Practice mode | |
|---|---|---|
| Questions count | 65 | 1 - 75 |
| Time limit | 170 minutes | Optional, 1 - 200 minutes |
| Exam scope | 4 domains with the official questions ratio | Selected domains with the official questions ratio |
| Correct answers | After exam submission | After exam submission or after each answer |
| Question types | Mix of single and multiple correct answers | Single, multiple or both |
| Question hints | Never | Optional |
| Question domain | Revealed after exam submission | Revealed after submission or during the exam |
| Scoring | 15 of 65 questions do not count towards the result | Official AWS method or mathematical mean |
See all simulator features on the AWS Exam Simulator page.
About the ANS-C01 exam
The AWS Certified Advanced Networking - Specialty (ANS-C01) certification is a highly specialized credential aimed at professionals with advanced networking skills and extensive experience in designing and implementing AWS and hybrid IT network architectures at scale. The exam tests a deep understanding of a broad range of AWS networking services and concepts, along with the ability to design, develop, and deploy complex cloud-based solutions using the Amazon Web Services platform.
A significant portion of the exam focuses on networking fundamentals and concepts, requiring candidates to have a strong grasp of the OSI model and how various networking protocols map to it. Understanding IP addressing, particularly in IPv4 and IPv6, is crucial, including subnetting, CIDR (Classless Inter-Domain Routing), and the differences between these IP versions. Additionally, knowledge of routing and switching is vital, with an emphasis on static and dynamic routing protocols such as RIP, OSPF, and BGP, as well as concepts like route tables, network address translation (NAT), and switching mechanisms.
The exam extensively covers AWS networking services, beginning with Amazon VPC (Virtual Private Cloud), a core service that allows the creation of isolated networks within AWS. Candidates are expected to understand VPC components, including subnets, route tables, security groups, and Network ACLs (NACLs). Additionally, the exam delves into more advanced VPC features like VPC Peering, Transit Gateway, and VPC endpoints. AWS Direct Connect is another critical service, providing a dedicated network connection from an on-premises environment to AWS, and the exam assesses knowledge of its setup, configuration, and use cases.
AWS VPN is also a key service, with the exam focusing on both Site-to-Site VPN and Client VPN, including setup, encryption standards, and integration with VPCs and on-premises networks. Elastic Load Balancing (ELB) is another important topic, where candidates must have detailed knowledge of application, network, and gateway load balancers, including their use cases and configuration. The exam also evaluates understanding of AWS Global Accelerator, which is used to improve global application performance by leveraging AWS’s global network infrastructure.
Amazon Route 53, AWS’s DNS service, plays a significant role in the exam, with candidates needing to demonstrate knowledge of routing policies such as latency-based, geolocation, and failover, as well as domain registration and health checks. AWS Transit Gateway, which allows the interconnection of VPCs and on-premises networks via a central hub, is another critical topic, including concepts like route propagation, attachments, and segmentation. Amazon CloudFront, a content delivery network (CDN) service, is also covered, with a focus on edge locations, distribution types, and caching strategies.
Security is a major theme in the exam, with an emphasis on securing AWS networking components using security groups, NACLs, AWS Web Application Firewall (WAF), and Shield (DDoS protection). Candidates must also understand encryption, both in-transit and at-rest, as well as AWS compliance frameworks like PCI DSS, HIPAA, and GDPR, and how they impact network design. Disaster recovery and high availability strategies are also tested, including Multi-AZ and Multi-Region architectures, failover mechanisms, and data replication to ensure network resilience and data redundancy.
The exam also tests knowledge of network automation and monitoring. Candidates need to be proficient in using AWS CloudFormation, AWS CLI, and SDKs for automating network deployments, as well as third-party automation tools like Terraform. Monitoring and troubleshooting are equally important, with expertise in using Amazon CloudWatch, VPC Flow Logs, AWS Config, and AWS CloudTrail to monitor, troubleshoot, and audit network activity. The exam may present scenarios requiring the identification and resolution of network performance issues.
Hybrid networking and multi-account environments are also key areas of focus. Candidates must understand hybrid cloud architectures, including connecting on-premises networks with AWS using services like AWS Direct Connect and VPN. The exam also includes scenarios involving multiple AWS accounts, VPC peering, and shared services, and requires knowledge of AWS Organizations and best practices for managing networking across multiple AWS accounts, including the use of centralized logging and monitoring, shared VPCs, and resource access management.
The AWS Certified Advanced Networking - Specialty (ANS-C01) exam is known for its difficulty. It requires a deep understanding of AWS networking services and the ability to apply this knowledge to complex, real-world scenarios. The depth of knowledge required is significant, with the exam testing advanced networking concepts that go beyond basic AWS networking. The questions are often scenario-based, requiring candidates to design or troubleshoot a network architecture, which tests both knowledge and problem-solving skills. The breadth of services covered is also extensive, requiring candidates to understand how different AWS services integrate with each other, adding to the challenge. Additionally, the time pressure of the exam, with its detailed and time-consuming questions, makes effective time management crucial.
Overall, the AWS Certified Advanced Networking - Specialty (ANS-C01) certification is an excellent credential for professionals seeking to demonstrate their expertise in AWS networking. It validates a candidate’s ability to design, deploy, and maintain complex network architectures on AWS, making it a valuable certification for network engineers, architects, and systems administrators. However, due to its difficulty, it requires thorough preparation and substantial practical experience with AWS networking services.
Services on the exam
All 43 AWS services that can appear on the ANS-C01 exam.