ANS-C01 Exam Preparation Material | Amazon AWS Certified Advanced Networking - Specialty

Prepare for the ANS-C01 with reliable study materials, practice questions, and key exam insights.

Prepare for the ANS-C01 Amazon AWS Certified Advanced Networking - Specialty exam with CertQueen's independently developed study resources. Review important concepts, practice scenario-based questions, and use clear explanations to identify areas that require further study.

Question#1

A company has a total of 30 VPCs. Three AWS Regions each contain 10 VPCs. The company has attached the VPCs in each Region to a transit gateway in that Region. The company also has set up inter-Region peering connections between the transit gateways.
The company wants to use AWS Direct Connect to provide access from its on-premises location for only four VPCs across the three Regions. The company has provisioned four Direct
Connect connections at two Direct Connect locations.
Which combination of steps will meet these requirements MOST cost-effectively? (Select THREE.)

A. Create four virtual private gateways. Attach the virtual private gateways to the four VPCs.
B. Create a Direct Connect gateway. Associate the four virtual private gateways with the Direct Connect gateway.
C. Create four transit VIFs on each Direct Connect connection. Associate the transit VIFs with the Direct Connect gateway.
D. Create four transit VIFs on each Direct Connect connection. Associate the transit VIFs with the four virtual private gateways.
E. Create four private VIFs on each Direct Connect connection to the Direct Connect gateway.
F. Create an association between the Direct Connect gateway and the transit gateways.

Explanation:
To connect to multiple VPCs across different Regions using Direct Connect, the best option is to use a Direct Connect gateway and transit gateways . A Direct Connect gateway allows you to associate multiple virtual private gateways and transit gateways with the same Direct Connect connection. A transit gateway acts as a network hub that connects multiple VPCs and on-premises networks. By creating inter-Region peering connections between the transit gateways, you can enable cross-Region communication.
Therefore, the steps are:
• Create four virtual private gateways and attach them to the four VPCs that need access from the on-premises location.
• Create a Direct Connect gateway and associate it with the four virtual private gateways.
• Create four transit VIFs on each Direct Connect connection and associate them with the Direct Connect gateway. A transit VIF allows you to connect to a Direct Connect gateway using a private ASN.
• Create an association between the Direct Connect gateway and the transit gateways in each Region. This will enable the on-premises location to access the VPCs that are attached to the transit gateways.

Question#2

A company needs to capture and log traffic for Nitro-based Amazon EC2 instances to comply with regulations. The company's network team has prepared a solution that enables VPC traffic mirroring and sends traffic to a second set of EC2 instances in an Auto Scaling group.
The network team has added a Network Load Balancer (NLB) in front of the EC2 instances the traffic will be sent to. However, the solution does not send any mirrored traffic to the EC2 instances that are behind the NLB.
How should the network team configure traffic mirroring to use the NLB endpoint?

A. Select the NLB as a source for traffic mirroring. Use a UDP listener.
B. Select the NLB as a target for traffic mirroring. Use a TCP listener and a UDP listener.
C. Select the NLB as a target for traffic mirroring. Use a TCP listener.
D. Select the NLB as a target for traffic mirroring. Use a UDP listener.

Explanation:
Traffic Mirroring with UDP: VPC traffic mirroring sends mirrored traffic as UDP packets encapsulated in VXLAN (Virtual eXtensible Local Area Network). Therefore, the target for traffic mirroring must have a UDP listener to accept the mirrored traffic.
NLB as a Target: The Network Load Balancer (NLB) can be configured as the target for traffic mirroring. By setting up a UDP listener on the NLB, it can properly receive the VXLAN-encapsulated mirrored traffic and forward it to the EC2 instances behind it.
Correct Listener Protocol: Since mirrored traffic uses UDP, setting up a TCP listener or using both TCP and UDP listeners will not work. Only a UDP listener can correctly handle the traffic.

Question#3

A company is replatforming a legacy data processing solution to AWS. The company deploys the solution on Amazon EC2 Instances in private subnets that are in one VPC.
The solution uses Amazon S3 for abject storage. Both the data that the solution processes and the data the solution produces are stored in Amazon S3. The solution uses Amazon DynamoDB to save its own state. The company collects flow logs for the VPC. The solution uses one NAT gateway to register its license through the internet. A software vendor provides a specific hostname so the solution can register its license.
The company notices that the AWS bill exceeds the projected budget for the solution. A network engineer uses AWS Cost Explorer to investigate the bill. The network engineer notices that the USE2-NatGateway-Bytes($) usage type is the root cause of the higher than expected bill.
What should the network engineer do to resolve the issue? (Choose two.)

A. Set up Amazon VPC Traffic Mirroring. Analyze the traffic to identify the traffic that the NAT gateway processes.
B. Examine the VPC flow logs to identity the traffic that traverses the NAT gateway.
C. Set up an AWS Cost and Usage Report in the AWS Billing and Cost Management console. Examine the report to find more details about the NAT gateway charges.
D. Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IP addresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges for Amazon S3 and DynamoD
E. Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up and associated with the route tables of the private subnets.

Question#4

A company is using a shared services VPC with two domain controllers. The domain controllers are deployed in the company's private subnets. The company is deploying a new application into a new VPC in the account. The application will be deployed onto an Amazon EC2 for Windows Server instance in the new VPC. The instance must join the existing Windows domain that is supported by the domain controllers in the shared services VPC.
A transit gateway is attached to both the shared services VPC and the new VPC. The company has updated the route tables for the transit gateway, the shared services VPC, and the new VPC. The security groups for the domain controllers and the instance are updated and allow traffic only on the ports that are necessary for domain operations. The instance is unable to join the domain that is hosted on the domain controllers.
Which combination of actions will help identify the cause of this issue with the LEAST operational overhead? (Choose two.)

A. Use AWS Network Manager to perform a route analysis for the transit gateway network. Specify the existing EC2 instance as the source. Specify the first domain controller as the destination. Repeat the route analysis for the second domain controller.\
B. Use port mirroring with the existing EC2 instance as the source and another EC2 instance as the target to obtain packet captures of the connection attempts.
C. Review the VPC flow logs on the shared services VPC and the new VP
D. Issue a ping command from one of the domain controllers to the existing EC2 instance.
E. Ensure that route propagation is turned off on the shared services VP

Question#5

A network engineer is designing hybrid connectivity with AWS Direct Connect and AWS Transit Gateway. A transit gateway is attached to a Direct Connect gateway and 19 VPCs across different AWS accounts. Two new VPCs are being attached to the transit gateway. The IP address administrator has assigned 10.0.32.0/21 to the first VPC and 10.0.40.0/21 to the second VPC. The prefix list has one CIDR block remaining before the prefix list reaches the quota for the maximum number of entries.
What should the network engineer do to advertise the routes from AWS to on premises to meet these requirements?

A. Add 10.0.32.0/21 and 10.0.40.0/21 to both AWS managed prefix lists.
B. Add 10.0.32.0/21 and 10.0.40.0/21 to the allowed prefix list.
C. Add 10.0.32.0/20 to both AWS managed prefix lists.
D. Add 10.0.32.0/20 to the allowed prefix list.

Exam Code: ANS-C01
Q & A: 291 Q&As         Updated:  Sep 26,2026

 

 Access Complete ANS-C01 Preparation Material

What This ANS-C01 Study Resource Helps You Do

Review Key Concepts

Review the technologies, products, processes, and practical skills covered by the current ANS-C01 exam objectives.

Practice Scenario-Based Questions

Work through independently developed questions designed to strengthen your understanding of technical scenarios and decision-making.

Identify Knowledge Gaps

Use your results and the provided explanations to find weaker areas and focus your study more effectively.

How to Use This ANS-C01 Preparation Material

Review the Exam Scope

Start by reviewing the topics covered by the ANS-C01 exam. Compare them with the official exam objectives to understand the required technologies, operational tasks, and practical skills, then identify the areas that deserve the most attention.

Practice Independently

Complete a focused set of practice questions for each topic. On your first attempt, avoid referring to notes, answers, or other study resources so that you can evaluate your current understanding more accurately.

Study the Explanations

Review the answers and explanations after completing each practice session. Understand why the correct option is appropriate for the given scenario and why the other options may be incorrect or less suitable.

Close Knowledge Gaps

Keep track of incorrect answers, unfamiliar concepts, and weaker knowledge areas. Review these topics using official documentation and practical experience, then answer the related questions again to reinforce your understanding and monitor your progress.

Independent ANS-C01 Preparation Resource

CertQueen independently develops its certification study materials for educational purposes. The practice questions are not copied from, recalled from, or presented as live or official exam questions.

CertQueen is not affiliated with, endorsed by, sponsored by, or authorized by any certification provider. Certification names, exam codes, product names, and related trademarks are the property of their respective owners and are referenced only for identification and educational purposes.

Exam Code: ANS-C01
Q & A: 291 Q&As
Updated:  Sep 26,2026

 

 Access Complete ANS-C01 Preparation Material