CertArea
All AWS exams

Free ANS-C01 practice test: 30 questions with answers

30 original questions for AWS Certified Advanced Networking - Specialty, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions
Real exam
65 questions, 170 min

ANS-C01 exam guide: topics, cost and format

All 30 ANS-C01 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Network Implementation (8 questions)

  1. Question 1

    An EC2 instance in a private subnet must reach the internet for software updates while staying unreachable from the internet. Which combination fits?

    1. AA NAT gateway in a public subnet with a route from the private subnet to it
    2. BAn internet gateway attached directly to the private subnet's route table as the default target
    3. CA public IP on the instance with an allow-all security group rule
    4. DA site-to-site VPN tunnel to a home network over the public internet
    Show answer and explanation
    Correct answer: A

    A NAT gateway in a public subnet gives outbound-only internet access. Attaching an IGW to private subnets, public IPs with allow-all and home VPNs expose or do not solve the requirement.

  2. Question 2

    A VPC's security groups and network ACLs both apply to an instance's traffic. Which statement is accurate about how they evaluate traffic?

    1. ANetwork ACLs are stateless and apply at the subnet boundary; security groups are stateful and apply to the instance interface
    2. BBoth are stateful and apply at the internet gateway edge, so return traffic from the subnet is tracked by the gateway itself in flow logs
    3. CNeither applies to traffic leaving the instance, since outbound flows are exempt from both the subnet and interface filters by default
    4. DSecurity groups are stateless and evaluate each packet at the subnet boundary, while network ACLs are stateful and track connection state per interface
    Show answer and explanation
    Correct answer: A

    Network ACLs are stateless rules at the subnet level, and security groups are stateful at the interface. The other statements reverse or misstate these properties.

  3. Question 3

    An administrator must set up DNS so that instances in a VPC resolve private names for on-premises servers and on-premises clients resolve VPC names. Which service supports this hybrid resolution?

    1. AA public DNS record in a public hosted zone that maps private IPs
    2. BA hosts file edited manually on each instance and kept in sync with on-premises servers
    3. CDisabling DNS resolution in the VPC by turning off the Amazon resolver
    4. DAmazon Route 53 Resolver inbound and outbound endpoints with forwarding rules
    Show answer and explanation
    Correct answer: D

    Resolver endpoints with forwarding rules provide bidirectional hybrid DNS. Hosts files do not scale, public records do not resolve private IPs appropriately, and disabling DNS breaks resolution.

  4. Question 4

    A Route 53 private hosted zone must resolve names inside a VPC. Which setting must be enabled for the VPC?

    1. APublic IP auto-assign enabled on each subnet alone
    2. BAn internet gateway attached to the VPC with no route
    3. CDNS resolution and DNS hostnames enabled in the VPC settings
    4. DA NAT gateway in a public subnet with no DNS setting
    Show answer and explanation
    Correct answer: C

    DNS resolution and hostnames must be enabled for private hosted zones to work. Public IP settings, gateways without routes and NAT alone do not enable resolution.

  5. Question 5

    A Transit Gateway attachment to a VPC must be created for a subnet. Which requirement applies to the subnet selected for the attachment?

    1. AThe subnet must use the same CIDR as on-premises network
    2. BNo subnet is required; the attachment uses default routing
    3. CA dedicated subnet in each Availability Zone used for the attachment
    4. DThe subnet must be public with an internet gateway route in its route table
    Show answer and explanation
    Correct answer: C

    Transit Gateway attachments use dedicated subnets in chosen AZs. Public routing, matching CIDRs to on-premises and no subnet requirement are incorrect.

  6. Question 6

    A load balancer must preserve the client's source IP address for backend application logging. Which load balancer type and setting supports this for TCP traffic?

    1. AA NAT gateway in front of the targets, translating each client source address
    2. BNetwork Load Balancer with client IP preservation enabled for the target group
    3. CApplication Load Balancer for raw TCP listeners, which forwards traffic without a header
    4. DClassic Load Balancer with default settings for HTTP and TCP listeners, which hides client IP
    Show answer and explanation
    Correct answer: B

    Network Load Balancers can preserve client IP for TCP targets when enabled. Classic defaults, ALB for raw TCP and NAT gateways do not provide that behaviour for this requirement.

  7. Question 7

    An ALB must route requests to different target groups based on the host header for two websites. Which feature does this?

    1. ANetwork ACL rules applied at the subnet boundary to match the Host header
    2. BA NAT gateway route table with a default route entry
    3. CA VPC peering connection between two VPCs in a Region
    4. DHost-based listener rules on the Application Load Balancer
    Show answer and explanation
    Correct answer: D

    Host-based rules on ALB listeners route by host header. NACLs filter traffic, NAT routes outbound traffic, and peering connects networks.

  8. Question 8

    An enterprise wants to inspect all outbound internet traffic from multiple VPCs using a managed firewall that filters by domain. Which service fits?

    1. AA security group on each instance's network interface, applied as stateful allow rules
    2. BAWS Network Firewall with domain filtering rules in a central inspection VPC
    3. CAmazon Route 53 health checks that monitor endpoints and fail over DNS records to a backup
    4. DAWS Shield Standard for DDoS protection on Elastic IPs and CloudFront
    Show answer and explanation
    Correct answer: B

    Network Firewall supports domain filtering and central inspection. Shield protects against DDoS, health checks monitor endpoints, and security groups are instance-level filters.

Network Security, Compliance and Governance (8 questions)

  1. Question 9

    A company must ensure that all traffic between its VPCs and the internet passes through a firewall that inspects TLS-encrypted traffic. Which design meets this requirement?

    1. ASecurity groups attached to each instance that filter by port and protocol, without inspecting payloads or TLS sessions
    2. BA centralized inspection VPC with decryption-capable firewall, reached through Gateway Load Balancer endpoints
    3. CRouting traffic through a VPN tunnel to an on-premises firewall for every user session before it reaches the internet
    4. DPublic IPs assigned to the instances, with stateless network ACL rules filtering subnet traffic and no inspection appliance
    Show answer and explanation
    Correct answer: B

    A centralized inspection design with decryption-capable firewalls, using Gateway Load Balancer endpoints to steer traffic, inspects encrypted traffic. Security groups do not inspect payloads, NACLs lack deep inspection, and VPN detours change the design without central inspection.

  2. Question 10

    A security team needs to control which Regions and services developers can use in a multi-account organization. Which control applies across all accounts?

    1. AService control policies at the organization root or OUs
    2. BNetwork ACLs in each subnet, filtering inbound and outbound packets
    3. CSecurity groups in each VPC for instance traffic
    4. DIAM policies attached in each member account, editable by its owners
    Show answer and explanation
    Correct answer: A

    SCPs set maximum permissions across member accounts. Per-account IAM policies can be changed locally, and security groups and NACLs control network traffic, not API actions.

  3. Question 11

    A regulated workload must not send traffic over the public internet, even for AWS service access. Which combination satisfies this requirement?

    1. AA NAT gateway in a public subnet that routes outbound service API calls to public AWS endpoints
    2. BPublic IPs on the instances and an internet gateway attached to the VPC, so service traffic reaches AWS endpoints over the internet
    3. CA site-to-site VPN tunnel over the internet to a virtual private gateway that carries traffic to AWS service endpoints
    4. DInterface VPC endpoints for required services, with routes and security groups limiting access to the VPC
    Show answer and explanation
    Correct answer: D

    Interface endpoints keep service traffic within the AWS network, and controls limit access. Public IPs, NAT paths over the internet and internet-based VPNs violate the requirement.

  4. Question 12

    A company must prevent any instance from being publicly reachable on SSH port 22. Which control enforces this across accounts?

    1. AAllowing 0.0.0.0/0 on port 22 in the default security group for convenience during developer onboarding
    2. BEnabling auto-assign public IPv4 addresses on subnets by default so each launched instance receives one
    3. CA service control policy or AWS Config rule that detects and prevents public SSH exposure
    4. DA note in the runbook asking engineers to avoid port 22 exposure, reviewed during annual audits
    Show answer and explanation
    Correct answer: C

    SCPs can prevent unsafe configurations and Config rules detect them. Notes, default public IPs and open SSH rules violate the requirement.

  5. Question 13

    A security team wants to detect unexpected outbound connections from VPC workloads to known malicious domains. Which service provides this detection?

    1. AAWS Artifact for compliance reports and agreement downloads
    2. BAmazon GuardDuty with VPC flow and DNS log analysis
    3. CAWS Budgets tracking monthly cost and usage levels
    4. DAmazon Macie discovering sensitive data stored in S3 buckets
    Show answer and explanation
    Correct answer: B

    GuardDuty analyses VPC flow and DNS logs to detect malicious connections. Macie finds sensitive data in S3, Artifact provides compliance reports, and Budgets track cost.

  6. Question 14

    An application must be protected from DDoS attacks at the network layer and receive support during large attacks. Which service fits best?

    1. AAWS Shield Standard, enabled by default with no added protection
    2. BAWS Shield Advanced with the protected resources defined
    3. CAWS Budgets tracking spend against limits
    4. DAWS Config recording resource configuration changes
    Show answer and explanation
    Correct answer: B

    Shield Advanced provides enhanced protection and response support for specified resources. Standard is automatic but lacks the advanced protections and response team, while Budgets and Config do not protect against DDoS.

  7. Question 15

    A WAF is deployed in front of an application, and the team needs to block requests from specific countries. Which rule type applies?

    1. AA route table entry matching country
    2. BA security group rule scoped to source country
    3. CA DNS record using TTL values per country
    4. DA geographic match rule in the web ACL
    Show answer and explanation
    Correct answer: D

    Geographic match rules in a WAF web ACL block requests by country. Security groups and route tables do not evaluate geography, and DNS records are not country filters.

  8. Question 16

    A company's auditors ask for evidence of the network configuration history of its security groups over the past year. Which service provides this history?

    1. ACloudWatch dashboards showing metrics
    2. BAWS Snowball job logs and device state
    3. CAmazon SES sending statistics and logs
    4. DAWS Config configuration history
    Show answer and explanation
    Correct answer: D

    AWS Config records configuration history for resources, including security groups. Dashboards, SES and Snowball logs do not provide this resource history.

Network Design (7 questions)

  1. Question 17

    A company connects several VPCs in one Region to an on-premises data centre. The design must scale to many VPCs with centralized routing. Which AWS service should be used as the hub?

    1. AAWS Transit Gateway
    2. BVPC peering between every pair of VPCs
    3. CA NAT gateway in each VPC
    4. DDirect Connect with a public VIF only
    Show answer and explanation
    Correct answer: A

    Transit Gateway acts as a regional hub that scales with centralized routing. Full-mesh peering does not scale, NAT gateways translate addresses, and a public VIF is for public AWS endpoints.

  2. Question 18

    A hybrid network requires private connectivity from on-premises to a VPC with a dedicated, consistent bandwidth. Which service fits best?

    1. ASite-to-site VPN over the public internet alone, using IPsec tunnels to a virtual private gateway
    2. BPublic IP addresses on EC2 instances in a private subnet, reached over the internet gateway
    3. CA Client VPN endpoint for each remote user, authenticated with certificates or SAML over TLS
    4. DAWS Direct Connect with a private virtual interface to a Direct Connect gateway
    Show answer and explanation
    Correct answer: D

    Direct Connect with a private VIF provides dedicated connectivity into VPCs through a Direct Connect gateway. Internet-based VPN lacks guaranteed bandwidth, client VPN serves users, and public IPs expose traffic.

  3. Question 19

    A company must have resilient Direct Connect connectivity to protect against the failure of a single location. Which design is recommended?

    1. AA single connection at one location, upgraded to a larger bandwidth tier for peak load
    2. BConnections at two different Direct Connect locations with redundant routers
    3. CA site-to-site VPN backup that is not configured for dynamic routing, so it remains idle
    4. DNo redundancy because Direct Connect is a highly reliable managed service with an uptime SLA
    Show answer and explanation
    Correct answer: B

    Redundant connections at separate locations protect against site failure. A single connection, assumed reliability and unconfigured backups do not meet a resilience goal.

  4. Question 20

    An architect needs to route traffic between VPCs through a centralized inspection firewall using Transit Gateway. Which configuration achieves this?

    1. AAttaching the inspection firewall to a single subnet in one VPC alone, with no Transit Gateway attachment or route entries
    2. BRoute tables that send inter-VPC traffic to the inspection VPC attachment through the Transit Gateway
    3. CPeering the VPCs directly with VPC peering connections and disabling routing on the inspection subnets in both VPCs
    4. DSending inter-VPC traffic out through an internet gateway and back in through a public NAT path before final delivery
    Show answer and explanation
    Correct answer: B

    Transit Gateway route tables steer traffic through the inspection VPC attachment. Direct peering bypasses inspection, single-subnet attachment does not route between all VPCs, and internet loops are inefficient and insecure.

  5. Question 21

    A company needs to allow overlapping CIDR blocks between two VPCs that must communicate with a shared service. Which design addresses the overlap?

    1. ADisable IP routing entirely on the Transit Gateway route tables, which blocks the shared service VPC
    2. BRoute the overlapping CIDR ranges directly through a static route and hope the route tables resolve the overlap
    3. CUse a NAT-based solution such as AWS PrivateLink or an intermediate service that avoids routing the overlapping ranges directly
    4. DRenumber the on-premises network without planning the change windows, DHCP scopes, DNS zones or BGP sessions
    Show answer and explanation
    Correct answer: C

    Overlapping CIDRs cannot be routed directly, so PrivateLink or NAT-based designs are used. Direct routing of overlaps fails, renumbering without planning is disruptive, and disabling routing breaks connectivity.

  6. Question 22

    A global application uses a set of endpoints in several Regions and needs users to reach the nearest healthy endpoint with static IP addresses. Which service fits?

    1. AAmazon Route 53 simple routing only
    2. BAmazon CloudFront for TCP traffic
    3. CAWS Direct Connect
    4. DAWS Global Accelerator
    Show answer and explanation
    Correct answer: D

    Global Accelerator provides static anycast IPs and routes to the nearest healthy endpoint. Simple DNS routing does not give static IPs, Direct Connect is a dedicated link, and CloudFront is for HTTP content.

  7. Question 23

    A company's applications need to access an AWS service privately from its VPC, without traffic crossing the internet. Which feature provides private access to many AWS services?

    1. AA public IP on each instance's network interface
    2. BAn internet gateway attached with a public route table
    3. CInterface VPC endpoints powered by AWS PrivateLink
    4. DA NAT gateway with public routing tables
    Show answer and explanation
    Correct answer: C

    Interface endpoints deliver private access to many AWS services through PrivateLink. Public IPs, NAT with public routing and internet gateways use the internet path.

Network Management and Operations (7 questions)

  1. Question 24

    A network team wants to be alerted when a Site-to-Site VPN tunnel goes down. Which mechanism provides this?

    1. ARelying on users to report the outage through support tickets later
    2. BCloudWatch metrics for the VPN tunnel state with an alarm sending a notification
    3. CDisabling health monitoring on the tunnel to reduce alarm noise from brief route flaps at night
    4. DChecking the VPN console once a day and reviewing tunnel status manually
    Show answer and explanation
    Correct answer: B

    VPN tunnel metrics in CloudWatch with alarms provide automated notification. Daily checks, disabled monitoring and user reports are slow or absent.

  2. Question 25

    A team needs visibility into the path and latency between two applications across a hybrid network. Which tool provides this?

    1. AA weekly email summary sent by end users about slow apps
    2. BVPC Reachability Analyzer and Network Monitor for latency measurements
    3. CA local hosts file that maps application names to IP addresses
    4. DA spreadsheet of IP addresses maintained manually by the cloud team
    Show answer and explanation
    Correct answer: B

    Reachability Analyzer checks paths and Network Monitor measures latency and connectivity. Spreadsheets, hosts files and emails do not measure paths.

  3. Question 26

    A network engineer wants to confirm why traffic between two instances is being blocked. Which AWS feature analyzes the configured path and identifies the blocking component?

    1. AVPC Reachability Analyzer
    2. BAWS Cost Explorer Tags
    3. CAmazon Macie Findings
    4. DAWS Backup Vault Lock
    Show answer and explanation
    Correct answer: A

    Reachability Analyzer evaluates configuration to show whether a path is reachable and which component blocks it. Cost, data discovery and backups are unrelated.

  4. Question 27

    A team needs to capture traffic metadata for all instances in a subnet to investigate unusual connections. Which feature should be enabled?

    1. AAmazon Inspector scans
    2. BAWS Config only
    3. CEnabling payload capture on every packet
    4. DVPC Flow Logs at the subnet level
    Show answer and explanation
    Correct answer: D

    VPC Flow Logs at subnet level capture metadata for traffic in the subnet. Packet payload capture is not what flow logs provide, Config tracks configuration, and Inspector assesses vulnerabilities.

  5. Question 28

    An operator must analyze DNS query patterns from VPC resources to detect suspicious domains. Which logging feature should be enabled?

    1. ARoute 53 Resolver query logging
    2. BCloudTrail management events only
    3. CVPC flow logs only
    4. DAWS Budgets alerts
    Show answer and explanation
    Correct answer: A

    Resolver query logging records DNS queries from VPC resources. Flow logs show IP metadata but not DNS queries, CloudTrail records API calls, and Budgets track costs.

  6. Question 29

    A company uses Direct Connect and wants to monitor the physical connection's health, including link status and light levels. Which resource provides this data?

    1. AA network printer log showing paper jams and toner levels in the lobby
    2. BDirect Connect connection metrics in CloudWatch and the connection status in the console
    3. CThe VPC's DNS settings for hostname and resolution support on each subnet
    4. DThe EC2 instance's CPU utilization and memory metrics on the guest OS kernel
    Show answer and explanation
    Correct answer: B

    Direct Connect connection metrics and status show link health. Printer logs, DNS settings and CPU metrics do not reflect the physical link.

  7. Question 30

    A network architect wants to receive a notification when a BGP route is withdrawn over Direct Connect. Which approach supports this?

    1. AMonitor BGP-related metrics and events, and send notifications through an alarm or EventBridge
    2. BCheck the route table once a month in the VPC console and compare the entries with the on-premises routing table
    3. CRemove BGP from the Direct Connect gateway configuration and use static routes across attached VPCs
    4. DAsk the on-premises network team to tell you whenever a route is withdrawn during the next weekly review
    Show answer and explanation
    Correct answer: A

    Alarms and EventBridge notify on route events or metric changes. Monthly checks, removing BGP and informal reporting are not timely or reliable.