ANS-C01PRACTICE QUESTIONS

ANS-C01 practice questions with answers

4 example questions from the AWS Certified Advanced Networking - Specialty question bank, grouped by exam domain. Pick an answer and check it to see the explanation.

Network Design

Question 1Select 1

null Design DNS solutions that meet public, private, and hybrid requirements

A company runs an HTTPS application behind internet-facing Application Load Balancers (ALBs) in two AWS Regions. Route 53 latency alias records point to the ALBs, with Evaluate Target Health enabled. Each ALB has multiple listener rules that forward requests to separate production target groups. The company requires Route 53 to exclude a Region from new DNS responses if any production target group in that Region has no healthy targets, provided the other Region remains healthy. After a deployment, Route 53 stops returning one Region's ALB even though every production target group in that Region has healthy targets. Engineers discover that an obsolete preview listener rule on that ALB still references a target group with no registered targets. The preview service is permanently retired. Which change will restore latency-based routing to both Regions while preserving the required health-based exclusion behavior?

A. Increase the unhealthy threshold for all production target group health checks on the affected ALB while retaining the preview listener rule and both latency alias records.

B. Remove the obsolete preview listener rule and delete its unused target group. Keep Evaluate Target Health enabled on both latency alias records.

C. Create a Route 53 HTTPS health check against a working production path on the affected ALB and associate it with that Region's latency alias record while keeping Evaluate Target Health enabled.

D. Disable Evaluate Target Health on the affected Region's latency alias record and retain the ALB's existing target group health checks.

Network Implementation

Question 1Select 1

null Implement routing and connectivity between on-premises networks and the AWS Cloud

A company connects its data center to an AWS Transit Gateway through AWS Site-to-Site VPN. A transit gateway VPC attachment provides access to an application on an EC2 instance. After a network change, an on-premises client cannot establish TCP connections to the instance on port 443. Transit Gateway Network Manager Route Analyzer reports that the VPN attachment can reach the VPC attachment in both directions. Before authorizing live test traffic, a network engineer must check whether the VPC configuration permits the client's inbound connection and identify any blocking configuration. Which approach best meets these requirements?

A. Enable VPC Flow Logs with the ALL traffic filter on the instance's network interface. Use the absence of REJECT records during the assessment period to confirm that the VPC configuration permits the connection.

B. Use VPC Reachability Analyzer to model the inbound path from the VPC's transit gateway attachment to the instance's network interface. Specify TCP destination port 443 and the on-premises client's source IP address, and inspect the analysis for blocking VPC components.

C. Run another bidirectional Route Analyzer analysis between the VPN and VPC attachments, specifying TCP port 443. Use its results to validate the instance security group and subnet network ACL.

D. Use VPC Reachability Analyzer with the instance's network interface as the source and the VPC's transit gateway attachment as the destination. Specify TCP destination port 443 and use a reachable result to validate the client's inbound connection.

Network Management and Operation

Question 1Select 1

null Optimize AWS networks for performance, reliability, and cost-effectiveness

A financial analytics application transfers data between two Amazon EC2 instances in the same Availability Zone by using a single long-lived TCP connection. Each instance supports 100 Gbps networking and ENA Express, but the connection currently achieves approximately 5 Gbps. Testing confirms that CPU, memory, storage, and TCP window sizes are not bottlenecks. The company needs at least 15 Gbps for this single connection and lower tail latency during network congestion. The application cannot be modified to use a different networking library or multiple connections. Which change best meets these requirements without increasing the instance sizes?

A. Enable ENA Express on the network interfaces used by both instances for the connection.

B. Configure Elastic Fabric Adapter interfaces on both instances and continue using the application's existing TCP socket connection without enabling ENA Express.

C. Attach a second ENA-backed network interface to each instance and configure equal-cost routes across both interfaces for the existing TCP connection.

D. Move both instances into a cluster placement group and enable jumbo frames, while continuing to use standard ENA networking.

Network Security, Compliance, and Governance

Question 1Select 1

null Implement and maintain network features to meet security and compliance needs and requirements

A company connects workload VPCs in multiple AWS accounts through a centrally managed AWS Transit Gateway. Compliance requires all inter-VPC traffic to pass through stateful firewall appliances in an inspection VPC. The inspection VPC has a transit gateway attachment subnet and a firewall appliance in each of two Availability Zones. VPC routing directs traffic from each attachment subnet through the firewall in that Availability Zone. The transit gateway route tables send traffic from workload attachments to the inspection attachment and send inspected traffic to the destination workload attachment. No direct workload-to-workload routes bypass inspection. During testing, some connections between workloads in different Availability Zones fail. Packet captures show that the forward and return packets traverse different firewall appliances, which drop packets because connection state is not shared. Security groups and network ACLs permit the required traffic. Which change will resolve the failures while retaining stateful inspection and the two-Availability-Zone architecture?

A. Enable appliance mode on every workload VPC attachment, but leave the inspection VPC attachment unchanged.

B. Associate each workload attachment with a separate transit gateway route table, giving each table the same routes to the inspection attachment as the current workload-facing table.

C. Enable appliance mode on the inspection VPC's transit gateway attachment and retain the existing inspection routing.

D. Replace the workload-facing default routes to the inspection attachment with more-specific static routes for every destination workload CIDR, still targeting the inspection attachment.

PRACTICE EXAMANS-C01 exam simulator

681 questions covering every domain and task, full-length exams, explanations for every answer and a pass probability indicator.

Open the simulator →