Browse AWS Certification Guides

AWS ANS-C01 Sample Questions with Explanations

April 25, 2026

AWS ANS-C01 sample questions with explanations, traps, and topic labels.

On this page

These original sample questions are designed to help you check how the exam topics appear in decision-style prompts. They are not taken from the live exam.

Use these sample questions as a guided self-assessment for AWS Certified Advanced Networking - Specialty (ANS-C01) topics such as hybrid connectivity, Transit Gateway routing, VPC endpoint design, DNS resolution, network security, edge services, observability, encryption, optimization, and failover behavior. The prompts emphasize path reasoning rather than service-name memorization.

Where these questions fit in the ANS-C01 guide

The sample set below is part of the AWS ANS-C01 guide path:

ANS-C01 advanced networking sample questions

Work through each prompt before opening the explanation. ANS-C01 questions usually reward answers that trace source, destination, route, security control, DNS, return path, encryption boundary, and evidence source.

Question 1

Topic: Hybrid connectivity with resilience

A company connects an on-premises data center to AWS for latency-sensitive internal applications. The link must use private connectivity, support dynamic routing, and continue operating if one physical location or device path fails. Which design is strongest?

  • A. A single AWS Site-to-Site VPN tunnel from one on-premises router to one VPC.
  • B. Direct Connect connections in separate locations with BGP, redundant customer devices, and VPN backup if encryption or failover coverage requires it.
  • C. Public internet access through NAT gateways because NAT is highly available inside one Region.
  • D. One VPC peering connection from the data center to the application VPC.

Best answer: B

Explanation: The requirement combines private connectivity, dynamic routing, and resiliency across failure points. Redundant Direct Connect design with BGP and diverse locations is the strongest baseline, with VPN as a common backup or encryption complement when the scenario requires it.

Why the other choices are weaker:

  • A is a single-path design and does not satisfy the resilience requirement.
  • C uses public internet paths and does not solve private hybrid connectivity.
  • D misuses VPC peering; peering is not an on-premises connectivity primitive.

What this tests: Direct Connect, VPN backup, BGP, device/location diversity, and hybrid failover design.

Related topics: Direct Connect; VPN; BGP; Hybrid networking

Question 2

Topic: Scaling multi-VPC routing

An organization has dozens of VPCs across multiple accounts. Teams need controlled connectivity to shared services, inspection, and on-premises networks without building a full mesh of VPC peering connections. What is the strongest architecture?

  • A. Create peering connections between every VPC pair and manually update all route tables.
  • B. Use AWS Transit Gateway with segmented route tables, controlled propagation, and shared-services or inspection attachments as needed.
  • C. Put all workloads into one very large VPC so route design is no longer needed.
  • D. Use public IP addresses between VPCs and rely on security groups for segmentation.

Best answer: B

Explanation: Transit Gateway is the common advanced-networking answer for many VPCs, many accounts, shared services, hybrid reachability, and route segmentation. Multiple route tables help enforce which attachments can reach each other.

Why the other choices are weaker:

  • A creates an operationally brittle mesh and does not support transitive routing.
  • C weakens account and workload isolation and does not fit organizational scale.
  • D increases public exposure and avoids the private routing problem.

What this tests: Transit Gateway, route tables, propagation, segmentation, shared services, and peering limitations.

Related topics: Transit Gateway; Multi-account; Segmentation; Route tables

Question 3

Topic: Private endpoint troubleshooting

A workload in a private subnet should reach a supported AWS service through an interface VPC endpoint. The endpoint exists, but traffic still goes to the public service address and fails the compliance review. What should the network engineer check first?

  • A. Whether private DNS is enabled for the endpoint and whether the VPC resolver path returns the endpoint private addresses.
  • B. Whether the workload has a larger instance type.
  • C. Whether the service is added to a public hosted zone owned by the application team.
  • D. Whether the subnet has more available IPv6 addresses.

Best answer: A

Explanation: Interface endpoint success often depends on DNS resolution as much as endpoint creation. If names still resolve publicly, traffic can miss the intended private endpoint path.

Why the other choices are weaker:

  • B changes compute capacity, not name resolution or path selection.
  • C may make DNS more confusing and does not address the managed endpoint private-DNS behavior.
  • D is unrelated unless the stem specifically indicates IPv6 endpoint design.

What this tests: Interface VPC endpoints, private DNS, resolver behavior, compliance paths, and troubleshooting order.

Related topics: VPC endpoints; Private DNS; Resolver; Troubleshooting

Question 4

Topic: Choosing the right load-balancing layer

A team is placing third-party inspection appliances between workloads and the internet. Traffic must be inserted transparently through the appliance fleet, scale horizontally, and preserve the network inspection pattern. Which AWS load-balancing option is the strongest fit?

  • A. Application Load Balancer because it offers HTTP routing rules.
  • B. Network Load Balancer because it handles TCP efficiently for every appliance pattern.
  • C. Gateway Load Balancer because it is designed for transparent insertion and scaling of virtual appliances.
  • D. Route 53 weighted records because DNS alone inserts appliances into the packet path.

Best answer: C

Explanation: Gateway Load Balancer is the AWS service built for deploying and scaling third-party virtual appliances in the traffic path. The clue is transparent inspection, not HTTP routing or ordinary TCP load balancing.

Why the other choices are weaker:

  • A fits layer-7 application routing, not transparent network appliance insertion.
  • B is strong for many TCP/UDP patterns, but GWLB is the appliance-insertion service.
  • D can influence name resolution but does not place appliances in the path.

What this tests: GWLB, inspection VPC patterns, load-balancer layer choice, and appliance scaling.

Related topics: Gateway Load Balancer; Inspection; Load balancing; Network security

Question 5

Topic: Hybrid DNS resolution

An enterprise has workloads in a VPC that must resolve internal names hosted by on-premises DNS servers. On-premises clients must also resolve private AWS names in Route 53 private hosted zones. The company wants a managed AWS DNS forwarding pattern rather than running custom DNS proxy instances. Which design is strongest?

  • A. Create a Route 53 public hosted zone for the internal domain and publish private records there.
  • B. Use Route 53 Resolver outbound endpoints and forwarding rules for VPC-to-on-premises resolution, and Resolver inbound endpoints for on-premises-to-VPC resolution.
  • C. Add a NAT gateway in every private subnet so DNS packets can reach the internet.
  • D. Use VPC peering because peering automatically forwards all DNS queries to on-premises resolvers.

Best answer: B

Explanation: Hybrid DNS usually needs Resolver endpoints in the correct direction. Outbound endpoints let VPC DNS forward selected queries to on-premises resolvers. Inbound endpoints let on-premises resolvers query the VPC Resolver for AWS private names.

Why the other choices are weaker:

  • A exposes internal-style DNS publicly and does not solve private hybrid forwarding.
  • C changes internet egress, not conditional DNS forwarding.
  • D confuses routing connectivity with DNS forwarding behavior.

What this tests: Route 53 Resolver, inbound/outbound endpoints, forwarding rules, private hosted zones, and hybrid DNS direction.

Related topics: Route 53 Resolver; Hybrid DNS; Private hosted zones

Question 6

Topic: Evidence selection for security audit

A security team needs to determine who changed a security group rule that temporarily allowed inbound TCP/22 from 0.0.0.0/0. They also need to know whether any traffic was accepted during the exposure window. Which evidence set is strongest?

  • A. VPC Traffic Mirroring only.
  • B. CloudTrail for the API change, plus VPC Flow Logs for accepted traffic during the relevant time window.
  • C. Route 53 Resolver query logs only.
  • D. AWS WAF logs only.

Best answer: B

Explanation: CloudTrail answers who made the AWS API change. VPC Flow Logs can show accepted or rejected flow metadata for matching source, destination, port, protocol, and time window. The two evidence sources answer different parts of the question.

Why the other choices are weaker:

  • A may provide packet-level copies if configured, but it does not identify the AWS API caller by itself.
  • C records DNS queries, not security group changes or TCP flow action.
  • D is useful for HTTP request filtering evidence, not generic SSH security group exposure.

What this tests: CloudTrail, VPC Flow Logs, control versus evidence, and audit correlation.

Related topics: CloudTrail; VPC Flow Logs; Security groups; Audit

Question 7

Topic: Direct Connect confidentiality

A company uses Direct Connect for predictable hybrid connectivity. A compliance requirement now states that data between the data center and AWS must be encrypted in transit. The team wants to preserve the Direct Connect path and use AWS-managed VPN endpoints rather than custom EC2 encryption appliances. Which option is strongest?

  • A. Keep the private virtual interface only because Direct Connect traffic is encrypted by default.
  • B. Run AWS Site-to-Site VPN over Direct Connect so the hybrid traffic is protected by IPsec while using the Direct Connect path.
  • C. Enable DNSSEC on the public hosted zone.
  • D. Replace Direct Connect with VPC peering.

Best answer: B

Explanation: Direct Connect provides private connectivity, but customer traffic over Direct Connect is not encrypted by default. VPN over Direct Connect keeps the private path while adding IPsec tunnel encryption.

Why the other choices are weaker:

  • A confuses private connectivity with encrypted connectivity.
  • C protects DNS integrity, not hybrid traffic payload confidentiality.
  • D is not an on-premises connectivity option and does not solve encryption.

What this tests: Direct Connect, VPN over Direct Connect, IPsec, encryption boundary, and shared responsibility.

Related topics: Direct Connect; Site-to-Site VPN; IPsec; Confidentiality

Question 8

Topic: Optimization and subnet capacity

An Auto Scaling group fails to launch new instances during traffic spikes in one Availability Zone. EC2 service quotas are available, target health checks are otherwise normal, and other Availability Zones still have capacity. What should the network engineer check first?

  • A. Whether the affected subnet has enough available private IP addresses.
  • B. Whether Route 53 latency routing is enabled.
  • C. Whether the VPC peering connection is transitive.
  • D. Whether CloudFront cache invalidation completed.

Best answer: A

Explanation: Instance launches require available IP addresses in the selected subnet. Subnet exhaustion can appear as a scaling or availability problem even when EC2 quotas and other AZs look healthy.

Why the other choices are weaker:

  • B changes DNS answer behavior, not subnet IP capacity.
  • C is a routing-design concept unrelated to launching instances in one subnet.
  • D affects cache behavior, not EC2 subnet capacity.

What this tests: Subnet sizing, ENI/IP consumption, Auto Scaling, and operations optimization.

Related topics: Subnet capacity; Auto Scaling; IP planning; Optimization

Question 9

Topic: Route maintenance and BGP preference

A company has two Direct Connect connections advertising the same private prefixes to AWS. The primary path should receive return traffic from AWS, and the secondary path should be used only during failure. After a maintenance window, AWS return traffic starts using the secondary connection even though the primary is healthy. What should be checked first?

  • A. Whether the application has an Application Load Balancer.
  • B. Direct Connect BGP local preference communities, prefix specificity, AS path, and route advertisements for the affected prefixes.
  • C. Whether the S3 bucket policy requires TLS.
  • D. Whether CloudFront origin shield is enabled.

Best answer: B

Explanation: The symptom is path preference over Direct Connect, so the first checks are BGP attributes and advertised prefixes. Local preference communities, prefix length, AS path, and advertisement changes can shift preferred return path behavior.

Why the other choices are weaker:

  • A might matter for application traffic distribution, but not DX return-path preference.
  • C is an S3 transport policy topic, not hybrid routing.
  • D applies to CloudFront origin behavior, not Direct Connect route choice.

What this tests: Direct Connect BGP, route preference, active/passive paths, and route maintenance.

Related topics: BGP; Direct Connect; Route priority; Hybrid maintenance

Question 10

Topic: Multiple response - centralized inspection

An organization uses many VPCs connected through Transit Gateway. Security requires outbound internet traffic from workload VPCs to pass through a centrally managed inspection VPC before reaching NAT gateways. Some traffic is bypassing inspection. Which two actions are most important? (Choose two.)

  • A. Update Transit Gateway route tables so workload attachments send the relevant default or inspected prefixes toward the inspection VPC.
  • B. Update workload subnet route tables so outbound traffic uses the intended Transit Gateway path rather than local NAT gateways.
  • C. Add AWS WAF to every private subnet.
  • D. Create a public hosted zone for the inspection VPC.
  • E. Enable VPC peering between every workload VPC and every other workload VPC.

Best answers: A and B

Explanation: Central inspection is a routing problem as much as a firewall problem. The Transit Gateway route tables and workload subnet route tables must steer traffic through the inspection VPC. If workload subnets still route directly to local NAT gateways, inspection is bypassed.

Why the other choices are weaker:

  • C misplaces WAF; WAF is for supported HTTP entry points, not generic subnet inspection.
  • D changes public DNS, not the routed packet path.
  • E creates peering sprawl and does not provide transitive centralized inspection.

What this tests: Transit Gateway route tables, subnet route tables, centralized inspection, GWLB/Network Firewall patterns, and multiple-response reasoning.

Related topics: Transit Gateway; Network Firewall; GWLB; Central inspection; Route steering

Independent study note

Tech Exam Lexicon and IT Mastery are independent study tools. They are not affiliated with, endorsed by, or sponsored by Amazon Web Services, AWS, or any certification body.

Revised on Monday, June 15, 2026
Study Plan
FAQ