Official Bank
0/291
Page
1/4
AWS Certified Advanced Networking – Specialty (ANS-C01) - AWS Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
291
Total Questions
1
Question
A company has a web application that runs in eight AWS Regions. In each Region, the application is hosted on multiple compute resources behind an Application Load Balancer (ALB). The different Regions are using different domains. Each ALB is configured to accept only HTTPS traffic. Each ALB uses a certificate from AWS Certificate Manager (ACM). The company wants to simplify the application’s appearance on the web by using a new single domain for all Regions. A network engineer needs to implement this change by designing a solution that also will minimize latency for the application's end users.
Which combination of actions will meet these requirements? (Choose three.)
Which combination of actions will meet these requirements? (Choose three.)
Select 3
Options
A
Create an alias record for the accelerator in Amazon Route 53 for the new domain.
B
Use ACM to create an SSL/TLS certificate in the us-east-1 Region for the new domain.
C
Create a standard accelerator in AWS Global Accelerator. Configure a listener for TCP traffic. Add all the ALBs as targets for the listener.
D
Create a custom routing accelerator in AWS Global Accelerator. Configure a listener for HTTPS traffic. Add all the ALBs as targets for the listener. Configure the accelerator to terminate TLS by using the SSLITLS certificate from ACM.
E
Use ACM to create an SSLITLS certificate for each Region. Configure all the ALBs to use the certificate in their respective Regions.
F
Set up latency-based routing in Amazon Route 53 for the new domain. Add the ALBs from all the Regions as targets.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
A financial trading company is using Amazon EC2 instances to run its trading platform. Part of the company's trading platform includes a third-party pricing service that the EC2 instances communicate with over UDP on port 50000. Recently, the company has had problems with the pricing service. Some of the responses from the pricing service appear to be incorrectly formatted and are not being processed successfully. The third-party vendor requests access to the data that the pricing service is returning. The third-party vendor wants to capture request and response data for debugging by logging in to an EC2 instance that accesses the pricing service. The company prohibits direct access to production systems and requires all log analysis to be performed in a dedicated monitoring account.
Which set of steps should a network engineer take to capture the data and meet these requirements? A.
1. Configure VPC flow logs to capture the data that flows in the VPC.
2. Send the data to an Amazon S3 bucket.
3. In the monitoring account, extract the data that flows to the EC2 instance's IP address and filter
the traffic for the UDP data.
4. Provide the data to the third-party vendor.
B.
1. Configure a traffic mirror filter to capture the UDP data.
2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface.
3. Configure a packet inspection package on a new EC2 instance in the production environment. Use
the elastic network interface of the new EC2 instance as the target for the traffic mirror.
4. Extract the data by using the packet inspection package.
5. Provide the data to the third-party vendor.
C.
1. Configure a traffic mirror filter to capture the UDP data.
2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface.
3. Configure a packet inspection package on a new EC2 instance in the monitoring account. Use the
elastic network interface of the new EC2 instance as the target for the traffic mirror.
4. Extract the data by using the packet inspection package.
5. Provide the data to the third-party vendor.
D.
1. Create a new Amazon Elastic Block Store (Amazon EBS) volume. Attach the EBS volume to the EC2
instance.
2. Log in to the EC2 instance in the production environment. Run the tcpdump command to capture
the UDP data on the EBS volume.
3. Export the data from the EBS volume to Amazon S3.
4. Provide the data to the third-party vendor.
Which set of steps should a network engineer take to capture the data and meet these requirements? A.
1. Configure VPC flow logs to capture the data that flows in the VPC.
2. Send the data to an Amazon S3 bucket.
3. In the monitoring account, extract the data that flows to the EC2 instance's IP address and filter
the traffic for the UDP data.
4. Provide the data to the third-party vendor.
B.
1. Configure a traffic mirror filter to capture the UDP data.
2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface.
3. Configure a packet inspection package on a new EC2 instance in the production environment. Use
the elastic network interface of the new EC2 instance as the target for the traffic mirror.
4. Extract the data by using the packet inspection package.
5. Provide the data to the third-party vendor.
C.
1. Configure a traffic mirror filter to capture the UDP data.
2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface.
3. Configure a packet inspection package on a new EC2 instance in the monitoring account. Use the
elastic network interface of the new EC2 instance as the target for the traffic mirror.
4. Extract the data by using the packet inspection package.
5. Provide the data to the third-party vendor.
D.
1. Create a new Amazon Elastic Block Store (Amazon EBS) volume. Attach the EBS volume to the EC2
instance.
2. Log in to the EC2 instance in the production environment. Run the tcpdump command to capture
the UDP data on the EBS volume.
3. Export the data from the EBS volume to Amazon S3.
4. Provide the data to the third-party vendor.
Reveal Only
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
A company is establishing hybrid cloud connectivity from an on-premises environment to AWS in the us-east-1 Region. The company is using a 10 Gbps AWS Direct Connect dedicated connection. The company has two accounts in AWS. Account A has transit gateways in four AWS Regions. Account В has transit gateways in three Regions. The company does not plan to expand. To meet security requirements the company's accounts must have separate cloud infrastructure.
Which solution will meet these requirements MOST cost-effectively?
Which solution will meet these requirements MOST cost-effectively?
Options
A
Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway. Order a new 10 Gbps Direct Connect dedicated connection for Account
B
Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway. Create a transit VIF for Account
C
Create one Direct Connect gateway in us-east-1 for Account A. Create a second Direct Connect gateway in us-east-1 for Account
D
Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway in Account A. Order a new 10 Gbps Direct Connect dedicated connection for Account В. Create a transit VIF on the new Direct Connect connection for Account В. Associate the three transit gateways in Account В to the Direct Connect gateway in Account В.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
A company has several AWS Site-to-Site VPN connections between an on-premises customer gateway and a transit gateway. The company's application uses IPv4 to communicate through the VPN connections. The company has updated the VPC to be dual stack and wants to transition to using IPv6-only for new workloads. When the company tries to communicate through the existing VPN connections, IPv6 traffic fails.
Which solution will provide IPv6 support with the LEAST operational overhead?
Which solution will provide IPv6 support with the LEAST operational overhead?
Options
A
Update the existing Site-to-Site VPN connections to support IPv6.
B
Create a new Site-to-Site VPN connection that supports IPv6.
C
Update the on-premises customer gateway's public IP address from IPv4 to IPv6.
D
Create a new Site-to-Site VPN connection to a self-managed Amazon EC2 instance that runs open source software.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
A company is migrating an application to the AWS Cloud. The company has successfully provisioned and tested connectivity between AWS Direct Connect and the company's on-premises data center. The application runs on Amazon EC2 instances across multiple Availability Zones. The instances are in an Auto Scaling group. The application communicates through HTTPS to a third-party vendor's data service that is hosted at the company’s data center. The data service implements a static ACL through explicit allow listing of client IP addresses. A network engineer must design a network solution so that the migrated application can continue to access the vendor’s data service as the application scales.
Which solution will meet these requirements with the LEAST amount of ongoing change to the vendor's allow list?
Which solution will meet these requirements with the LEAST amount of ongoing change to the vendor's allow list?
Options
A
Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Launch an EC2 instance into each subnet. Attach the respective elastic network interfaces to the new EC2 instances. In the application subnet route tables, configure the new EC2 instances as the next destination for the data service. Update the data service’s allow list to include the IP addresses of the elastic network interfaces.
B
Configure a private NAT gateway in the subnets for each Availability Zone that the application runs in. Configure the application to target the NAT gateways instead of the data service directly. Update the data service's allow list to include the IP addresses of the NAT gateways.
C
Configure an Application Load Balancer (ALB) in the subnets for each Availability Zone that the application runs in. Configure an ALB-associated target group that contains a target that uses the IP address for the data service. Configure the application to target the ALB instead of the data service directly. Update the data service's allow list to include the IP addresses of the ALBs.
D
Configure an elastic network interface in the subnets for each Availability Zone that the application runs in. Associate the elastic network interfaces with the Auto Scaling group for the application.
Update the data service's allow list to include the IP addresses of the elastic network interfaces.
Update the data service's allow list to include the IP addresses of the elastic network interfaces.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.