What are the prerequisites for taking the ANS-C01 exam?

AWS recommends that candidates have at least 5 years of IT networking experience and 2+ years of hands-on experience designing and implementing AWS solutions. While not strictly required, it's advisable to have AWS Solutions Architect Professional certification or equivalent knowledge before attempting this advanced specialty exam.

How long is the ANS-C01 exam and what is the passing score?

The ANS-C01 exam is 180 minutes (3 hours) long and consists of 50-65 questions in a multiple-choice or multiple-response format. The passing score is 750 out of 1000, which represents approximately 75% correct answers needed to pass.

What are the main topics covered in the ANS-C01 exam?

The exam covers network design, implementation and troubleshooting with focus on VPC architecture, routing and traffic management, security and compliance, AWS Direct Connect, hybrid connectivity, and network monitoring. It also includes topics on edge services, DNS, content delivery, and advanced networking scenarios.

How much does the ANS-C01 certification exam cost?

The ANS-C01 exam costs $300 USD. Some regions may have different pricing, and AWS occasionally offers exam discounts or promotional vouchers for training courses and events.

How long is the ANS-C01 certification valid for after passing?

AWS Certified Advanced Networking - Specialty certification is valid for 3 years from the date you pass the exam. After 3 years, you must retake the exam to maintain the certification status.

Free Amazon ANS-C01 Exam Questions

Q1 MultipleChoice

A company has its production VPC (VPC-A) in the eu-west-1 Region in Account 1. VPC-A is attached to a transit gateway (TGW-A) that is connected to an on-premises data center in Dublin, Ireland, by an AWS Direct Connect transit VIF that is configured for an AWS Direct Connect gateway. The company also has a staging VPC (VPC-B) that is attached to another transit gateway (TGW-B) in the eu-west-2 Region in Account 2.

A network engineer must implement connectivity between VPC-B and the on-premises data center in Dublin.

Which solutions will meet these requirements? (Choose two.)

AConfigure inter-Region VPC peering between VPC-A and VPC-B. Add the required VPC peering routes. Add the VPC-B CIDR block in the allowed prefixes on the Direct Connect gateway association.

BAssociate TGW-B with the Direct Connect gateway. Advertise the VPC-B CIDR block under the allowed prefixes.

CConfigure another transit VIF on the Direct Connect connection and associate TGW-B. Advertise the VPC-B CIDR block under the allowed prefixes.

DConfigure inter-Region transit gateway peering between TGW-A and TGW-B. Add the peering routes in the transit gateway route tables. Add both the VPC-A and the VPC-B CIDR block under the allowed prefix list in the Direct Connect gateway association.

EConfigure an AWS Site-to-Site VPN connection over the transit VIF to TGW-B as a VPN attachment.

Correct Answer: B, C

Explanation:

B . Associate TGW-B with the Direct Connect gateway. Advertise the VPC-B CIDR block under the allowed prefixes. This will allow traffic from VPC-B to be sent over the Direct Connect connection to the on-premises data center via TGW-B. C. Configure another transit VIF on the Direct Connect connection and associate TGW-B. Advertise the VPC-B CIDR block under the allowed prefixes. This will enable the use of the Direct Connect connection for VPC-B's traffic by connecting TGW-B to the Direct Connect gateway.

Q2 MultipleChoice

A company hosts application servers on premises and on Amazon EC2 instances in a VPC. The application servers access data that is hosted in an Amazon S3 bucket through the public internet. The EC2 instances in the VPC use an AWS Site-to-Site VPN for connectivity with the on-premises application servers.

New company regulations state that all traffic between the application servers and the S3 bucket must remain private and must not use public IP addresses.

Which solution will meet these requirements MOST cost-effectively?

AConfigure an S3 gateway endpoint Modify the route table with the appropriate route for the endpoint. Access the S3 bucket through the gateway endpoint from the EC2 instances.

BConfigure an S3 interface endpoint. Update the on-premises servers and EC2 instances to use the interface endpoint DNS name to access the S3 bucket.

CConfigure an S3 interface endpoint. Update the on-premises servers to use the interface endpoint DNS name to access the S3 bucket. Configure an S3 gateway endpoint. Modify the route table so that the EC2 instances use the gateway endpoint.

DConfigure an S3 gateway endpoint. Modify the route table with the appropriate route for the endpoint. Use an S3 bucket policy to restrict access to the gateway endpoint. Configure a proxy server fleet behind a Network Load Balancer in the VPC so that the on-premises servers can access the S3 bucket.

Correct Answer: A

Explanation:

S3 Gateway Endpoint for VPC Access: A gateway endpoint is a highly cost-effective and scalable solution for providing private access to Amazon S3 from within a VPC. By creating an S3 gateway endpoint and modifying the route table, EC2 instances in the VPC can access S3 without using public IPs or traversing the internet.

No Need for Interface Endpoints or Additional Proxies: Interface endpoints are more expensive and generally not required for accessing S3 unless you need fine-grained network traffic control or private DNS resolution. Similarly, deploying a proxy fleet introduces unnecessary complexity and costs.

Simplicity and Cost-Effectiveness: The S3 gateway endpoint meets the requirement of keeping traffic private and is the simplest, most cost-effective solution for accessing S3 from the EC2 instances in the VPC.

Q3 MultipleChoice

A company has established connectivity between its on-premises data center in Paris, France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway.

The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center.

In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet.

Which set of steps should a network engineer take to meet these requirements?

A1. Create public subnets in the Tokyo VPC to migrate the workloads into.
2. Configure an internet gateway for the Tokyo office to reach the Tokyo VPC.
3. Configure security groups on the Tokyo workloads to only allow traffic from the Tokyo office and the Paris workloads.
4. Create peering connections between the Tokyo VPC and the Paris VPCs.
5. Configure a VPN connection between the Paris data center and the Tokyo office by using existing routers.

B1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.
2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway.
3. Set up a new Direct Connect connection from the Tokyo office to the Tokyo transit gateway.
4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.

C1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.
2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway.
3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target.
4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.

D1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway.
2. Create an association between the Paris transit gateway and the Tokyo VPC.
3. Configure routing on the Paris transit gateway to allow data to flow between sites and the VPCs.

Correct Answer: C

Explanation:

Option C is the best solution because it allows the company to use transit gateways to connect the VPCs in different regions and the on-premises sites. Transit gateways support inter-region peering and VPN attachments, which enable secure and scalable connectivity. Option A is not valid because public subnets are not suitable for workloads that cannot be directly accessible from the internet. Option B is not valid because Direct Connect connections take longer than 5 days to provision.

Q4 MultipleChoice

A company has deployed a web application on AWS. The web application uses an Application Load Balancer (ALB) across multiple Availability Zones. The targets of the ALB are AWS Lambda functions. The web application also uses Amazon CloudWatch metrics for monitoring.

Users report that parts of the web application are not loading properly. A network engineer needs to troubleshoot the problem. The network engineer enables access logging for the ALB.

What should the network engineer do next to determine which errors the ALB is receiving?

ASend the logs to Amazon CloudWatch Logs. Review the ALB logs in CloudWatch Insights to determine which error messages the ALB is receiving.

BConfigure the Amazon S3 bucket destination. Use Amazon Athena to determine which error messages the ALB is receiving.

CConfigure the Amazon S3 bucket destination. After Amazon CloudWatch Logs pulls the ALB logs from the S3 bucket automatically, review the logs in CloudWatch Logs to determine which error messages the ALB is receiving.

DSend the logs to Amazon CloudWatch Logs. Use the Amazon Athena CloudWatch Connector to determine which error messages the ALB is receiving.

Correct Answer: B

Explanation:

Access logs is an optional feature of Elastic Load Balancing that is disabled by default. After you enable access logs for your load balancer, Elastic Load Balancing captures the logs and stores them in the Amazon S3 bucket that you specify as compressed files. You can disable access logs at any time. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

Q5 MultipleChoice

A company's network engineer is designing a hybrid DNS solution for an AWS Cloud workload. Individual teams want to manage their own DNS hostnames for their applications in their development environment. The solution must integrate the application-specific hostnames with the centrally managed DNS hostnames from the on-premises network and must provide bidirectional name resolution. The solution also must minimize management overhead.

Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

AUse an Amazon Route 53 Resolver inbound endpoint.

BModify the DHCP options set by setting a custom DNS server value.

CUse an Amazon Route 53 Resolver outbound endpoint.

DCreate DNS proxy servers.

ECreate Amazon Route 53 private hosted zones.

FSet up a zone transfer between Amazon Route 53 and the on-premises DNS.

Correct Answer: A, B, E

ANS-C01 Exam Questions & Answers

Sample ANS-C01 Questions

Frequently Asked Questions

Pass ANS-C01 First Time