Official Bank
0/291
Page
1/4
AWS Certified Advanced Networking – Specialty (ANS-C01) - AWS Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
291
Total Questions
1
Question
A company has a VPC that includes application workloads that run on Amazon EC2 instances in a single AWS Region. The company wants to use AWS Local Zones to deploy an extension of the application workloads that run in the Region. The extended workloads in the Local Zone need to communicate bidirectionally with the workloads in the VPC in the Region.
Which solution will meet these requirements MOST cost-effectively?
Which solution will meet these requirements MOST cost-effectively?
Options
A
Create a new subnet in the Local Zone. Deploy a third-party appliance in the VPC with interfaces in each subnet. Configure the new subnet to route the Local Zone through the appliance. Deploy instances in the new subnet.
B
Create a new VPC in the Local Zone. Attach all the VPCs to a transit gateway. Configure routing for the transit gateway and the VPCs. Deploy instances in the new VPC.
C
Create a new subnet in the Local Zone. Configure the new subnet to use a CIDR block that is within the VPC’s CIDR block. Deploy instances in the new subnet in the Local Zone.
D
Deploy a third-party appliance in a new VPC in the Region. Create a new VPC in the Local Zone.
Create VPN connections to the appliance for the VPCs. Deploy instances in the new VPC in the Local Zone.
Create VPN connections to the appliance for the VPCs. Deploy instances in the new VPC in the Local Zone.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
A company hosts its IT infrastructure in an on-premises data center. The company wants to migrate the infrastructure to the AWS Cloud in phases. A network engineer wants to set up a 10 Gbps AWS Direct Connect dedicated connection between the on-premises data center and VPCs. The company's network provider needs 3 months to provision the Direct Connect connection. In the meantime, the network engineer implements a temporary solution by deploying an AWS Site- to-Site VPN connection that terminates to a virtual private gateway. The network engineer observes that the bandwidth of the Site-to-Site VPN connection is capped at 1.25 Gbps despite a powerful customer gateway device.
What should the network engineer do to improve the VPN connection bandwidth before the implementation of the Direct Connect connection?
What should the network engineer do to improve the VPN connection bandwidth before the implementation of the Direct Connect connection?
Options
A
Create several additional Site-to-Site VPN connections that terminate on the same virtual gateway.
Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.
Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.
B
Contact AWS Support to request a bandwidth quota increase for the existing Site-to-Site VPN connection.
C
Create a transit gateway. Attach the VPCs to the transit gateway. Create several additional Site-to- Site VPN connections that terminate on the transit gateway. Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.
D
Discuss the issue with the hardware vendor. Buy a bigger and more powerful customer gateway device that has faster encryption and decryption capabilities.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
A company has started using AWS Cloud WAN with one edge location in the us-east-1 Region. The company has a production segment and a security segment in AWS Cloud WAN. The company also has a default core network policy. The company has created a production VPC for the production workload. The company has created an outbound inspection VPC to inspect internet-bound traffic from the production VPC. The company has attached the production VPC to the production segment and has attached the outbound inspection VPC to the security segment. The company has also created an AWS Network Firewall firewall in the outbound inspection VPC to inspect internet-based traffic. The company has updated a route table for the production VPC to send all internet-bound traffic to the AWS Cloud WAN core network. The company has updated a route table for the outbound inspection VPC to ensure that Network Firewall inspects any outgoing traffic and incoming traffic. During testing, an Amazon EC2 instance in the production VPC cannot reach the internet. The company checks the Network Firewall rules and confirms that the rules are not blocking the traffic.
Which combination of steps will meet these requirements? (Choose two.)
Which combination of steps will meet these requirements? (Choose two.)
Select 2
Options
A
Update the core network policy to create a static route for the production segment. Specify
0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
B
Update the core network policy to configure segment sharing. Share the production segment with
the security segment.
the security segment.
C
Update the core network policy to create a static route for the production segment. Specify
10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
D
Create an attachment to attach the outbound inspection VPC to the production segment. Update the core network policy to turn on isolated attachment for the production segment.
E
Update the core network policy to create a static route for the security segment. Specify 0.0.0.0/0
as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
A network engineer must provide additional safeguards to protect encrypted data at Application Load Balancers (ALBs) through the use of a unique random session key.
What should the network engineer do to meet this requirement?
What should the network engineer do to meet this requirement?
Options
A
Associate an AWS WAF web ACL with the ALBs. and create a security rule to enforce forward secrecy (FS)
B
Change the ALB security policy to a policy that supports TLS 1.2 protocol only
C
Change the ALB security policy to a policy that supports forward secrecy (FS)
D
Use AWS Key Management Service (AWS KMS) to encrypt session keys
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
A company has a global network and is using transit gateways to connect AWS Regions together. The company finds that two Amazon EC2 instances in different Regions are unable to communicate with each other. A network engineer needs to troubleshoot this connectivity issue.
What should the network engineer do to meet this requirement?
What should the network engineer do to meet this requirement?
Options
A
Use AWS Network Manager Route Analyzer to analyze routes in the transit gateway route tables.
Verify that the VPC route tables are correct. Use VPC flow logs to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.
Verify that the VPC route tables are correct. Use VPC flow logs to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.
B
Use AWS Network Manager Route Analyzer to analyze routes in the transit gateway route tables and in the VPC route tables. Use VPC flow logs to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.
C
Use VPC Reachability Analyzer to analyze routes in the transit gateway route tables. Verify that the VPC route tables are correct. Use VPC flow logs to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.
D
Use AWS Network Manager Route Analyzer to analyze routes in the transit gateway route tables.
Verify that the VPC route tables are correct. Use AWS Firewall Manager to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.
Verify that the VPC route tables are correct. Use AWS Firewall Manager to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.