AWS Advanced Networking Specialty (ANS-C01) - Full Practice Exam 1

1. A CDN origin must remain private to CloudFront over its public endpoint. The application requires authenticated origin requests rather than relying solely on an obscure hostname. Which S3 origin design is preferred?
2. A company acquires another network using the same IPv4 CIDR as its production VPC. Only a vendor API needs immediate private access; renumbering will take months. What is the best short-term design?
3. A company allocates CIDRs independently in 200 accounts and repeatedly discovers overlaps during network mergers. Which approach best prevents recurrence?
4. A company centralizes network logs in a security account. Which controls best protect the logs as audit evidence? Select 2 answers.
5. A company deploys AWS Network Firewall endpoints in two AZs. Which routing principle preserves stateful inspection for each AZ workload?
6. A company exposes a TLS service through a TCP NLB listener. Security requires the target application to terminate client TLS without load-balancer decryption. Which configuration fits?
7. A company hosts a private API on premises and wants VPC clients to resolve its corporate name and reach it privately. Which dependencies must be designed together? Select 2 answers.
8. A company is connecting 80 VPCs across accounts and an on-premises network. Production and development must remain isolated, but both need shared DNS services. Which design best avoids a full mesh while enforcing these routing boundaries?
9. A company must apply managed web attack protections to an internet-facing ALB while preserving application-layer inspection. Which control is appropriate?
10. A company must connect several Transit Gateways through Direct Connect using private routing. Which virtual interface type is intended for the Direct Connect gateway to Transit Gateway design?
11. A company requires encryption from its data center router to AWS VPN termination. A supported Direct Connect circuit offers MACsec. Why might the design still require an IPsec VPN?
12. A company shares a Transit Gateway with accounts through AWS RAM. What security responsibility remains with the network owner?
13. A company wants packet copies from selected EC2 network interfaces for an approved inspection tool while production traffic continues normally. Which service fits?
14. A company wants S3 access restricted to requests using its approved VPC endpoint. Which bucket-policy design needs particular care?
15. A critical hybrid workload must survive the loss of an entire Direct Connect location. Which design changes provide the most appropriate resilience? Select 2 answers.
16. A developer wants to use a broad public prefix in a security group because the corporate outbound IPs change. What is the best governed alternative?
17. A Direct Connect BGP session remains down after the physical connection becomes available. Which two checks most directly address establishment of the BGP adjacency? Select 2 answers.
18. A Direct Connect circuit is up and BGP is established, but one application prefix is unreachable. Which checks are most useful next? Select 2 answers.
19. A Direct Connect connection must carry private VPC routes and public AWS API routes with separate logical routing. Which implementation is appropriate?
20. A DNS change points a service to a new endpoint, but some users continue to reach the old address. What should be considered before assuming Route 53 failed?
21. A DNS Firewall policy must remain enforceable when clients try to use arbitrary external DNS resolvers directly. What additional control is required?
22. A failover exercise withdraws the preferred hybrid route, but traffic is blackholed rather than using the backup. Which verification is most relevant?
23. A gateway endpoint for S3 is added to a VPC, but one private subnet still sends S3 traffic through NAT. What configuration is most likely missing?
24. A Gateway Load Balancer fleet is healthy, but no application traffic reaches its appliances. Which configuration must exist in addition to healthy targets?
25. A global multiplayer service uses UDP and requires stable public IP addresses with health-based routing to regional endpoints. Which service best matches the front-door requirement?
26. A hybrid application requires encrypted private-IP connectivity over Direct Connect to a Transit Gateway. The company cannot use public VPN endpoint addresses. Which design is appropriate?
27. A network appliance is used as an EC2 router between subnets. Routes target its network interface, but transit traffic is dropped despite correct appliance rules. Which instance setting is relevant?
28. A network team deploys private IPv4 subnets with a NAT gateway but instances cannot reach the internet. Which two route requirements must be met? Select 2 answers.
29. A network team wants centrally governed inter-Region and branch connectivity with policy-defined segments across a large global organization. Which managed service most directly fits this operating model?
30. A new spoke can reach a Transit Gateway attachment but cannot reach shared services. Its subnet route is correct. Which distinction should the engineer check next?
31. A partner must expose one TCP service to customers whose VPC address ranges sometimes overlap. Customers must not gain general access to the partner network. Which architecture best meets these requirements?
32. A planned routing change must not silently expose isolated development VPCs to production. Which validation approach best addresses this risk?
33. A private subnet has no internet gateway route but reaches the internet through a centralized transit egress VPC. Why is the label private insufficient for a compliance conclusion?
34. A regulated workload requires private connectivity to an AWS API. Which two statements correctly describe the additional security work? Select 2 answers.
35. A SaaS application needs path-based routing, WebSocket support, and AWS WAF protection at the regional load balancer. Which design best fits?
36. A security analyst asks for HTTP request bodies from VPC Flow Logs. What should the network engineer explain?
37. A security team requests protection against large network-layer DDoS attacks for critical supported public resources, along with enhanced response capabilities. Which AWS service should be evaluated?
38. A service reachable through PrivateLink must allow only approved consumer accounts to create endpoints and must require manual approval of new connections. What should be configured?
39. A service uses an ALB with HTTP health checks. Instances accept client requests only when the Host header is app.example, so health checks fail. What is the most appropriate fix?
40. A shared private hosted zone must be resolvable in another account VPC. The zone exists, but the consumer VPC receives NXDOMAIN. Which cross-account setup is needed?
41. A TCP client can initiate connections after a network ACL update, but replies are dropped. Security groups allow the session. What is the most likely ACL issue?
42. A team deploys Resolver endpoints into two AZs. What additional network configuration is required for reliable DNS forwarding over a hybrid connection?
43. A VPN connection has two tunnels. Only one is configured on the customer gateway, and a maintenance event interrupts traffic. What is the appropriate implementation change?
44. A workload must accept inbound HTTPS only from a corporate network. Which security group rule is the most appropriate baseline?
45. After a route change, an EC2 instance cannot connect to a database. The engineer wants a configuration-based analysis identifying blocking network components without sending test packets. Which tool fits?
46. An ALB is configured for HTTPS from clients and HTTP to targets. Security now requires encrypted transport on both legs. Which change directly addresses the missing leg?
47. An application fails immediately after a security group change. Reachability Analyzer reports a valid path, but the service still refuses connections. What is the correct next step?
48. An AWS Network Firewall policy is intended to inspect traffic between workloads and the internet. Which limitation must be addressed in the architecture?
49. An inspection VPC hosts stateful appliances for traffic between two spoke VPCs in different Availability Zones. Which two design elements are essential for symmetric inspection? Select 2 answers.
50. An interface endpoint is reachable by its endpoint-specific DNS name, but applications using the normal regional service hostname still connect publicly. What should be checked?
51. An internet-facing IPv6 workload must initiate outbound connections but must not accept unsolicited inbound IPv6 connections. Which VPC component is appropriate?
52. An NLB using security groups fronts a PrivateLink endpoint service. Some consumer addresses overlap with internal networks and are blocked by NLB inbound rules. Which setting specifically controls evaluation of inbound rules for PrivateLink traffic?
53. An operator needs to know whether packets to a private instance were accepted or rejected at its network interface during an incident. Which data source is most appropriate?
54. An organization needs domain-based control of DNS queries made through VPC Resolver. Which control is designed for this purpose?
55. An organization wants centrally managed WAF policies across member-account ALBs with detection of resources missing protection. Which service best fits?
56. An S3 endpoint policy permits a bucket, but the application role has an explicit deny for that bucket. What is the result?
57. IPv6-only application instances must call an IPv4-only internet API without an inbound IPv4 address. Which combination provides the required connectivity?
58. NAT gateway ErrorPortAllocation rises while many clients connect to the same destination and port. Which response best targets this condition?
59. On-premises clients must resolve a Route 53 private hosted zone without making it public. Which architecture should the network engineer choose?
60. Private subnets in three Availability Zones need resilient IPv4 internet egress. The team wants to avoid cross-AZ NAT traffic and a single-AZ egress dependency. Which design is best?
61. Security requires proof that a workload has no unintended internet access path after an infrastructure update. Which approach best combines prevention and verification?
62. Several VPCs must resolve the corporate suffix corp.example through on-premises DNS. The company wants centrally managed forwarding configuration. Which design is most suitable?
63. Small requests succeed over a VPN, but large transfers stall after an MTU change. Which investigation is most appropriate?
64. The network team changes a Transit Gateway route table and needs to identify who performed the management operation. Which evidence is most appropriate?
65. Two VPCs are connected through Transit Gateway. Traffic from AZ A works, but resources in AZ B cannot reach the gateway. Which implementation detail should be checked first?

Comments — 0