Free AWS Certified Advanced Networking - Specialty ANS-C01 Exam Questions and Answers

Last updated: September 11, 2026

Exam code

ANS-C01

Provider

Amazon

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   A company has deployed a web application on AWS. The web application uses an Application Load Balancer (ALB) across multiple Availability Zones. The targets of the ALB are AWS Lambda functions. The web application also uses Amazon CloudWatch metrics for monitoring. Users report that parts of the web application are not loading properly. A network engineer needs to troubleshoot the problem. The network engineer enables access logging for the ALB. What should the network engineer do next to determine which errors the ALB is receiving?

   • A. Send the logs to Amazon CloudWatch Log
   • B. Review the ALB logs in CloudWatch Insights to determine which error messages the ALB is receiving.
   • C. Configure the Amazon S3 bucket destinatio
   • D. Use Amazon Athena to determine which error messages the ALB is receiving.
   Reveal Answer

2. Question #2

   A real estate company is building an internal application so that real estate agents can upload photos and videos of various properties. The application will store these photos and videos in an Amazon S3 bucket as objects and will use Amazon DynamoDB to store corresponding metadata. The S3 bucket will be configured to publish all PUT events for new object uploads to an Amazon Simple Queue Service (Amazon SQS) queue. A compute cluster of Amazon EC2 instances will poll the SQS queue to find out about newly uploaded objects. The cluster will retrieve new objects, perform proprietary image and video recognition and classification update metadata in DynamoDB and replace the objects with new watermarked objects. The company does not want public IP addresses on the EC2 instances. Which networking design solution will meet these requirements MOST cost-effectively as application usage increases?

   • A. Place the EC2 instances in a public subne
   • B. Disable the Auto-assign Public IP option while launching the EC2 instance
   • C. Create an internet gatewa
   • D. Attach the internet gateway to the VP
   Reveal Answer

3. Question #3

   A network engineer must develop an AWS CloudFormation template that can create a virtual private gateway, a customer gateway, a VPN connection, and static routes in a route table. During testing of the template, the network engineer notes that the CloudFormation template has encountered an error and is rolling back. What should the network engineer do to resolve the error?

   • A. Change the order of resource creation in the CloudFormation template.
   • B. Add the DependsOn attribute to the resource declaration for the virtual private gatewa
   • C. Specify the route table entry resource.
   • D. Add a wait condition in the template to wait for the creation of the virtual private gateway.
   Reveal Answer

4. Question #4

   A company recently migrated its Amazon EC2 instances to VPC private subnets to satisfy a security compliance requirement. The EC2 instances now use a NAT gateway for internet access. After the migration, some long-running database queries from private EC2 instances to a publicly accessiblethird-party database no longer receive responses. The database query logs reveal that the queries successfully completed after 7 minutes but that the client EC2 instances never received the response. Which configuration change should a network engineer implement to resolve this issue?

   • A. Configure the NAT gateway timeout to allow connections for up to 600 seconds.
   • B. Enable enhanced networking on the client EC2 instances.
   • C. Enable TCP keepalive on the client EC2 instances with a value of less than 300 seconds.
   • D. Close idle TCP connections through the NAT gateway.
   Reveal Answer

5. Question #5

   A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group. A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection. Which solution will meet these requirements?

   • A. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443. Publish the flow log records to a log group
   • B. Create a CloudWatch Logs metric filter for the log group for rejected traffi
   • C. Create an alarm to notify the network engineer.
   • D. Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443. Publish the flow log records to a log group in
   Reveal Answer

6. Question #6

   A company has an AWS Direct Connect connection between its on-premises data center in the United States (US) and workloads in the us-east-1 Region. The connection uses a transit VIF to connect the data center to a transit gateway in us-east-1. The company is opening a new office in Europe with a new on-premises data center in England. A Direct Connect connection will connect the new data center with some workloads that are running in a single VPC in the eu-west-2 Region. The company needs to connect the US data center and us-east-1 with the Europe data center and eu-west-2. A network engineer must establish full connectivity between the data centers and Regions with the lowest possible latency. How should the network engineer design the network architecture to meet these requirements?

   • A. Connect the VPC in eu-west-2 with the Europe data center by using a Direct Connect gateway and a private VI
   • B. Associate the transit gateway in us-east-1 with the same Direct Connect gatewa
   • C. Enable SiteLink for the transit VIF and the private VIF.
   • D. Connect the VPC in eu-west-2 to a new transit gatewa
   Reveal Answer

7. Question #7

   An IoT company sells hardware sensor modules that periodically send out temperature, humidity, pressure, and location data through the MQTT messaging protocol. The hardware sensor modules send this data to the company's on-premises MQTT brokers that run on Linux servers behind a load balancer. The hardware sensor modules have been hardcoded with public IP addresses to reach the brokers. The company is growing and is acquiring customers across the world. The existing solution can no longer scale and is introducing additional latency because of the company's global presence. As a result, the company decides to migrate its entire infrastructure from on premises to the AWS Cloud. The company needs to migrate without reconfiguring the hardware sensor modules that are already deployed across the world. The solution also must minimize latency. The company migrates the MQTT brokers to run on Amazon EC2 instances. What should the company do next to meet these requirements?

   • A. Place the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listener
   • B. Use Bring Your Own IP (BYOIP) from the on-premises network with the NLB.
   • C. Place the EC2 instances behind a Network Load Balancer (NLB). Configure TCP listener
   • D. Create an AWS Global Accelerator accelerator in front of the NLUse Bring Your Own IP (BYOIP) from the on-premises network with Global Accelerator.
   Reveal Answer

8. Question #8

   A company has two AWS accounts one for Production and one for Connectivity. A network engineer needs to connect the Production account VPC to a transit gateway in the Connectivity account. The feature to auto accept shared attachments is not enabled on the transit gateway. Which set of steps should the network engineer follow in each AWS account to meet these requirements?

   • A. * 1. In the Production account: Create a resource share in AWS Resource Access Manager for the transit gatewa
   • B. Provide the Connectivity account I
   • C. Enable the feature to allow external accounts* 2. In the Connectivity account: Accept the resource.* 3. In the Connectivity account: Create an attachment to the
   • D. Associate a route table with the attachment.
   Reveal Answer

9. Question #9

   A company is deploying a non-web application on an AWS load balancer. All targets are servers located on-premises that can be accessed by using AWS Direct Connect. The company wants to ensure that the source IP addresses of clients connecting to the application are passed all the way to the end server. How can this requirement be achieved?

   • A. Use a Network Load Balancer to automatically preserve the source IP address.
   • B. Use a Network Load Balancer and enable the X-Forwarded-For attribute.
   • C. Use a Network Load Balancer and enable the ProxyProtocol v2 attribute.
   • D. Use an Application Load Balancer to automatically preserve the source IP address in the X-Forwarded-For header.
   Reveal Answer

10. Question #10

    A Network Engineer is provisioning a subnet for a load balancer that will sit in front of a fleet of application servers in a private subnet. There is limited IP space left in the VPC CIDR. The application has few users now but is expected to grow quickly to millions of users. What design will use the LEAST amount of IP space, while allowing for this growth?

    • A. Use two /29 subnets for an Application Load Balancer in different Availability Zones.
    • B. Use one /29 subnet for the Network Load Balance
    • C. Add another VPC CIDR to the VPC to allow for future growth.
    • D. Use two /28 subnets for a Network Load Balancer in different Availability Zones.
    Reveal Answer