Free AWS Certified Advanced Networking - Specialty (ANS-C01) Practice Questions

Sample ANS-C01 Practice Questions

Browse all 6 free AWS Certified Advanced Networking - Specialty practice questions below.

1. A company has an AWS Direct Connect connection between its on-premises data center in the United States and workloads in the us-east-1 Region. The connection uses a transit VIF to connect the data center to a transit gateway in us-east-1. The company is opening a new office in Europe with a new on-premises data center in England. A Direct Connect connection will connect the new data center with workloads running in a single VPC in the eu-west-2 Region. The company needs to connect the US data center and us-east-1 with the Europe data center and eu-west-2. A network engineer must establish full connectivity between the data centers and Regions with the lowest possible latency. How should the network engineer design the network architecture?

   • Create a private VIF from the Europe Direct Connect connection directly to the VPC in eu-west-2. Use the existing Direct Connect gateway to connect both private VIFs to the same virtual private gateway.
   • Create a Site-to-Site VPN connection from the Europe data center to the transit gateway in us-east-1. Configure BGP to advertise routes between both data centers through the VPN and Direct Connect connections.
   • Create a new VPC in us-east-1 and set up VPC peering between the new VPC and the VPC in eu-west-2. Use the existing transit gateway to route traffic between the US data center and Europe.
   • Connect the VPC in eu-west-2 to a new transit gateway. Connect the Europe data center to the new transit gateway by using a Direct Connect gateway and a new transit VIF. Associate the transit gateway in us-east-1 with the same Direct Connect gateway. Enable SiteLink for both transit VIFs. Peer the two transit gateways.

2. A company operates a multi-tier application across three VPCs in the same AWS Region. VPC-A hosts the web tier, VPC-B hosts the application tier, and VPC-C hosts the database tier. The security team requires that all traffic between VPCs be inspected by a centralized firewall appliance. The network team needs to implement this solution while maintaining high availability and minimizing operational overhead. Which architecture should the network team implement?

   • Create a transit gateway and attach all three VPCs. Deploy AWS Network Firewall in a dedicated inspection VPC attached to the transit gateway. Configure transit gateway route tables to route inter-VPC traffic through the inspection VPC.
   • Create a transit gateway and attach all three VPCs. Configure network ACLs on each VPC subnet to inspect and filter traffic based on source and destination IP addresses and ports.
   • Deploy a Gateway Load Balancer in VPC-A with firewall appliances. Configure all VPCs to use the Gateway Load Balancer endpoint as their default route for inter-VPC traffic.
   • Create VPC peering connections between all VPCs. Deploy firewall appliances in each VPC and configure security group rules to route traffic through the local firewall before reaching the destination.

3. A company is designing a hybrid DNS architecture. The company has an on-premises data center connected to AWS through AWS Direct Connect. Applications in AWS VPCs need to resolve on-premises DNS names, and on-premises servers need to resolve private DNS names for resources in AWS. The company uses Amazon Route 53 Resolver for DNS in AWS. Which configuration meets these requirements with the LEAST operational overhead?

   • Create Route 53 Resolver outbound endpoints in the VPC and configure forwarding rules to send queries for on-premises domains to the on-premises DNS servers. Create Route 53 Resolver inbound endpoints and configure on-premises DNS servers to forward AWS domain queries to the inbound endpoint IP addresses.
   • Extend Active Directory from on-premises to AWS using AWS Directory Service. Use Active Directory-integrated DNS zones for both on-premises and AWS resources.
   • Create a Route 53 private hosted zone and associate it with the VPC. Configure the on-premises DNS servers to use Route 53 public resolvers for AWS domain queries.
   • Deploy Amazon EC2 instances running BIND DNS servers in the VPC configured as forwarders. Configure the VPC DHCP options set to use these servers. Set up conditional forwarding on both the EC2 DNS servers and on-premises DNS servers.

4. A company has multiple AWS accounts connected through AWS Transit Gateway. The company uses AWS Site-to-Site VPN to connect an on-premises data center to the transit gateway. During peak hours, the VPN connection becomes a bottleneck, causing increased latency for critical applications. The company wants to increase bandwidth while maintaining the existing VPN for backup. Which solution provides the HIGHEST bandwidth for on-premises connectivity?

   • Create multiple transit gateway VPN attachments from different on-premises routers to distribute the load across independent connections.
   • Implement AWS Direct Connect with a dedicated 100 Gbps connection. Attach the Direct Connect gateway to the transit gateway using a transit VIF.
   • Enable Accelerated Site-to-Site VPN on the existing connection. Accelerated VPN increases throughput by using AWS Global Accelerator.
   • Add additional VPN connections to the transit gateway. AWS supports up to 4 VPN tunnels per VPN attachment for ECMP load balancing.

5. A company runs a content management system on Amazon EC2 instances. The system generates thumbnails by fetching images from an S3 bucket, processing them, and storing results back in S3. The EC2 instances are in a private subnet with no internet access. The company uses VPC endpoints for S3 access. Users report that thumbnail generation is failing intermittently. Logs show connection timeout errors when accessing S3. What is the MOST likely cause of this issue?

   • The security group for the EC2 instances does not allow outbound HTTPS traffic.
   • The route table for the private subnet does not have a route to the S3 gateway VPC endpoint.
   • The VPC endpoint policy is restricting access to the S3 bucket used for image processing.
   • The S3 bucket is in a different Region than the VPC endpoint.

6. A company is migrating to AWS and needs to maintain IP connectivity between on-premises servers and AWS workloads. The on-premises network uses the 10.0.0.0/8 address range extensively. The company realizes they cannot use these addresses in AWS because they already exist on-premises. The company needs a solution that allows bidirectional communication between overlapping IP ranges. Which solution enables this connectivity?

   • Configure NAT on the transit gateway to translate IP addresses between overlapping ranges.
   • Use AWS PrivateLink to expose AWS services to on-premises. PrivateLink uses unique endpoint IP addresses that don't overlap with existing networks.
   • Use secondary CIDR blocks on the VPC that don't overlap with on-premises. Route all hybrid traffic through the secondary CIDR.
   • Enable VPC peering between AWS and an on-premises virtual VPC to handle overlapping routes.