AWS ANS-C01: AWS Certified Advanced Networking - Specialty

Last checked October 22, 2026 against the official AWS exam page.

1. Question 1Network Implementation

   An EC2 instance in a private subnet must reach the internet for software updates while staying unreachable from the internet. Which combination fits?

   1. AA NAT gateway in a public subnet with a route from the private subnet to it
   2. BAn internet gateway attached directly to the private subnet's route table as the default target
   3. CA public IP on the instance with an allow-all security group rule
   4. DA site-to-site VPN tunnel to a home network over the public internet
   Show answer and explanationHide answer

   Correct answer: A

   A NAT gateway in a public subnet gives outbound-only internet access. Attaching an IGW to private subnets, public IPs with allow-all and home VPNs expose or do not solve the requirement.

2. Question 2Network Security, Compliance and Governance

   A company must ensure that all traffic between its VPCs and the internet passes through a firewall that inspects TLS-encrypted traffic. Which design meets this requirement?

   1. ASecurity groups attached to each instance that filter by port and protocol, without inspecting payloads or TLS sessions
   2. BA centralized inspection VPC with decryption-capable firewall, reached through Gateway Load Balancer endpoints
   3. CRouting traffic through a VPN tunnel to an on-premises firewall for every user session before it reaches the internet
   4. DPublic IPs assigned to the instances, with stateless network ACL rules filtering subnet traffic and no inspection appliance
   Show answer and explanationHide answer

   Correct answer: B

   A centralized inspection design with decryption-capable firewalls, using Gateway Load Balancer endpoints to steer traffic, inspects encrypted traffic. Security groups do not inspect payloads, NACLs lack deep inspection, and VPN detours change the design without central inspection.

3. Question 3Network Design

   A company connects several VPCs in one Region to an on-premises data centre. The design must scale to many VPCs with centralized routing. Which AWS service should be used as the hub?

   1. AAWS Transit Gateway
   2. BVPC peering between every pair of VPCs
   3. CA NAT gateway in each VPC
   4. DDirect Connect with a public VIF only
   Show answer and explanationHide answer

   Correct answer: A

   Transit Gateway acts as a regional hub that scales with centralized routing. Full-mesh peering does not scale, NAT gateways translate addresses, and a public VIF is for public AWS endpoints.

4. Question 4Network Management and Operations

   A network team wants to be alerted when a Site-to-Site VPN tunnel goes down. Which mechanism provides this?

   1. ARelying on users to report the outage through support tickets later
   2. BCloudWatch metrics for the VPN tunnel state with an alarm sending a notification
   3. CDisabling health monitoring on the tunnel to reduce alarm noise from brief route flaps at night
   4. DChecking the VPN console once a day and reviewing tunnel status manually
   Show answer and explanationHide answer

   Correct answer: B

   VPN tunnel metrics in CloudWatch with alarms provide automated notification. Daily checks, disabled monitoring and user reports are slow or absent.

5. Question 5Network Implementation

   A VPC's security groups and network ACLs both apply to an instance's traffic. Which statement is accurate about how they evaluate traffic?

   1. ANetwork ACLs are stateless and apply at the subnet boundary; security groups are stateful and apply to the instance interface
   2. BBoth are stateful and apply at the internet gateway edge, so return traffic from the subnet is tracked by the gateway itself in flow logs
   3. CNeither applies to traffic leaving the instance, since outbound flows are exempt from both the subnet and interface filters by default
   4. DSecurity groups are stateless and evaluate each packet at the subnet boundary, while network ACLs are stateful and track connection state per interface
   Show answer and explanationHide answer

   Correct answer: A

   Network ACLs are stateless rules at the subnet level, and security groups are stateful at the interface. The other statements reverse or misstate these properties.