Skip to main content

ANS-C01 Online Practice Questions

AWS Certified Advanced Networking - Specialty (ANS-C01)

285 questions available · Page 1 of 29

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

A company uses the us-east-1 Region and the ap-south-1 Region for its business units (BUs). The BUS are named BU-1 and BU-Z. For each BU, there are two VPCs in us-east-1 and one VPC in ap-south-1.

Because of workload isolation requirements, resources can communicate within the same BU but cannot communicate with resources in the other BU.

The company plans to add more BUs and plans to expand into more Regions Which solution will meet these requirements with the MOST operational efficiency?

  1. A

    Configure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the AWS Cloud WAN segment actions to configure new routes to deny traffic between the different BU segments.

  2. B

    Configure a transit gateway in each Region. Configure peering between the transit gateways. Attach the BU VPCs to the transit gateway in the corresponding Region. Configure the transit gateway and VPC route tables to isolate traffic between BU VPCs.

  3. C

    Configure an AWS Cloud WAN network that operates in the required Regions. Attach all BU VPCs to the AWS Cloud WAN core network. Update the core network policy by setting the isolate-attachments parameter for each segment.

  4. D

    Configure an AWS Cloud WAN network that operates in the required Regions. Create AWS Cloud WAN segments for each BU Configure VPC attachments for each BU's VPCs to the corresponding BU segment.

Show answer and explanation

Correct answer: D

Question 2 Single choice

A network engineer is using AWS Direct Connect connections and MACsec to encrypt data from a corporate data center to the Direct Connect location. The network engineer learns that the MACsec secret key might have been compromised.
The network engineer needs to update the connection with an uncompromised secure key.

Which solution will meet this requirement?

  1. A

    Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) AWS managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.

  2. B

    Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) customer managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.

  3. C

    Modify the existing MACsec secret key. Re-associate the existing pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.

  4. D

    Modify the existing MACsec secret key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.

Show answer and explanation

Correct answer: B

Question 3 Single choice

A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application must always be reachable on port 443 from the public internet. The application recently had an outage that resulted from an incorrect change to the EC2 security group.
A network engineer needs to automate a way to verify the network connectivity between the public internet and the EC2 instances whenever a change is made to the security group. The solution also must notify the network engineer when the change affects the connection.

Which solution will meet these requirements?

  1. A

    Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture REJECT traffic on port 443. Publish the flow log records to a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter for the log group for rejected traffic. Create an alarm to notify the network engineer.

  2. B

    Enable VPC Flow Logs on the elastic network interface of each EC2 instance to capture all traffic on port 443. Publish the flow log records to a log group in Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter for the log group for all traffic. Create an alarm to notify the network engineer

  3. C

    Create a VPC Reachability Analyzer path on port 443. Specify the security group as the source.
    Specify the EC2 instances as the destination. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the network engineer when a change to the security group affects the connection.
    Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS

    topic in case the analyses fail Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the security group occurs.

  4. D

    Create a VPC Reachability Analyzer path on port 443. Specify the internet gateway of the VPC as the source. Specify the EC2 instances as the destination. Create an Amazon Simple Notification Service (Amazon SNS) topic to notify the network engineer when a change to the security group affects the connection. Create an AWS Lambda function to start Reachability Analyzer and to publish a message to the SNS topic in case the analyses fail. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function when a change to the security group occurs.

Show answer and explanation

Correct answer: D

Explanation

https://aws.amazon.com/blogs/networking-and-content-delivery/automating-connectivity-assessments-with-vpc-reachability-analyzer/

Question 4 Single choice

Company A recently acquired Company B. Company A has a hybrid AWS and on-premises environment that uses a hosted AWS Direct Connect connection, a Direct Connect gateway, and a transit gateway.
Company A has a transit VIF to access the resources in its production environment in the us-east-1

Region.

Company B has applications that run across multiple VPCs in the us-west-2 Region in a single AWS account. A transit gateway connects all Company B's application VPCs. The CIDR blocks for both
companies do not overlap.

Company A needs to use the existing Direct Connect connection to access Company B's applications from the on-premises environment.

Which solution will meet these requirements?

  1. A

    Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a transit VIF on the existing hosted connection for Company B.

  2. B

    Create an association proposal from the Company B account to associate the Company B transit gateway with the Company A Direct Connect gateway. Accept the transit gateway association proposal by logging into the Company A account.

  3. C

    Create multiple virtual private gateways. Attach the virtual private gateways to each of Company B's application VPCs. Create a hosted private VIF for each virtual private gateway.

  4. D

    Create a new Direct Connect gateway in the Company B account. Associate the Company B transit gateway with the new Direct Connect gateway. Create a hosted private VIF for Company B.

Show answer and explanation

Correct answer: B

Question 5 Single choice

A company has deployed a software-defined WAN (SD-WAN) solution to interconnect all of its offices. The company is migrating workloads to AWS and needs to extend its SD-WAN solution to support connectivity to these workloads.
A network engineer plans to deploy AWS Transit Gateway Connect and two SD-WAN virtual appliances to provide this connectivity. According to company policies, only a single SD-WAN virtual appliance can handle traffic from AWS workloads at a given time.

How should the network engineer configure routing to meet these requirements?

  1. A

    Add a static default route in the transit gateway route table to point to the secondary SD-WAN virtual appliance. Add routes that are more specific to point to the primary SD-WAN virtual appliance.

  2. B

    Configure the BGP community tag 7224:7300 on the primary SD-WAN virtual appliance for BGP routes toward the transit gateway.

  3. C

    Configure the AS_PATH prepend attribute on the secondary SD-WAN virtual appliance for BGP routes toward the transit gateway.

  4. D

    Disable equal-cost multi-path (ECMP) routing on the transit gateway for Transit Gateway Connect.

Show answer and explanation

Correct answer: C

Explanation

A- incorrect , static routes are not possible in TGW
B- incorrect, these BGP communities are used for BGP over DX
C- correct , AS_PATH prepending is a standard BGP way of influencing return traffic for advertised prefixes and SDWAN supports this. D- incorrect, disabling ECMP will make sure the SDWAN>TGW traffic
is not load shared, but the return traffic TGW>SDWAN is not affected and therefore both appliances will
process traffic.

Question 6 Single choice

A company wants to implement a distributed architecture on AWS that uses a Gateway Load Balancer
(GWLB) and GWLB endpoints.

The company has chosen a hub-and-spoke model. The model includes a GWLB and virtual appliances that are deployed into a centralized appliance VPC and GWLB endpoints. The model also includes internet gateways that are configured in spoke VPCs.

Which sequence of traffic flow to the internet from the spoke VPC is correct?

  1. A

    1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration.
    2. Traffic is delivered securely and privately to the GWLB.
    3. The GWLB sends the traffic to a virtual appliance for inspection.
    4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.

  2. B

    1. An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route table configuration.
    2. Traffic is delivered securely and privately to the GWLB endpoint.
    3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection.
    4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.

  3. C

    1. An application in a spoke VPC sends traffic to the GWLB endpoint.
    2. Traffic is delivered securely and privately to the GWLB.
    3. The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliance for inspection.
    4. Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway.

  4. D

    1. An application in a spoke VPC sends traffic to the GWLB.
    2. Traffic is delivered securely and privately to the GWLB endpoint.
    3. The GWLB sends the traffic to a virtual appliance for inspection.
    4. Return traffic flows back to the GWLB and out to the internet through an internet gateway.

Show answer and explanation

Correct answer: A

Question 7 Single choice

A company is deploying AWS Cloud WAN with edge locations in the us-east-1 Region and the ap-southeast-2 Region. Individual AWS Cloud WAN segments are configured for the development environment, the production environment, and the shared services environment at each edge location.
Many new VPCs will be deployed for the environments and will be configured as attachments to the AWS Cloud WAN core network.

The company's network team wants to ensure that VPC attachments are configured for the correct segment. The network team will tag the VPC attachments by using the Environment key with a value of the corresponding environment segment name. The segment for the production environment in us-east-1 must require acceptance for attachment requests. All other attachment requests must not require acceptance.

Which solution will meet these requirements?

  1. A

    Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag:Environment values to their respective segments.

  2. B

    Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag.Environment values to their respective segments.

  3. C

    Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1.

  4. D

    Create a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1.

Show answer and explanation

Correct answer: B

Explanation

https://aws.amazon.com/blogs/networking-and-content-delivery/achieving-traffic-segmentation-in-multi-aws-region-environments-using-aws-transit-gateway-and-aws-cloud-wan/

Question 8 Single choice

A company ran out of IP address space in one of the Availability Zones in an AWS Region that the company uses. The Availability Zone that is out of space is assigned the 10.10.1.0/24 CIDR block. The company manages its networking configurations in an AWS CloudFormation stack. The company' VPC is assigned the 10 10.0.0/16 CIDR block and has available capacity in the 10.10.1.0/22 CIDR block.

How should a network specialist add more IP address space in the existing VPC with the LEAST operational overhead?

  1. A

    Update the AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Change
    the CidrBlock property to 10.10.1.0/22.

  2. B

    Update the AWS::EC2::VPC resource in the CloudFormation stack. Change the CidrBlock property to
    10.10.1.0/22.

  3. C

    Copy the CloudFormation stack. Set the AWS::EC2::VPC resource CidrBlock property to 10.10.0.0/16.
    Set the AWS::EC2::Subnet resource CidrBlock property to 10.10.1.0/22 for the Availability Zone.

  4. D

    Create a new AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Set
    the CidrBlock property to 10.10.2.0/24.

Show answer and explanation

Correct answer: D

Question 9 Single choice

A company has multiple AWS Site-to-Site VPN connections between an on-premises environment and multiple VPCs. The Site-to-Site VPN connections use virtual private gateways and are configured with IPv4 addresses. The company hosts several internal applications in the VPCs.

Application users have reported that the applications are performing slowly. A networkengineer notices excessive latency in the network path that the VPN connections use. The network engineer needs to resolve the excessive latency.

Which solution will meet this requirement?

  1. A

    Use AWS Global Accelerator to deploy an accelerator on the existing Site-to-Site VPN connections.

  2. B

    Deploy a transit gateway and a new accelerated Site-to-Site VPN connection.

  3. C

    Replace the existing Site-to-Site VPN connections with new Site-to-Site VPN connections that use IPv6.

  4. D

    Replace the existing Site-to-Site VPN connections with AWS PrivateLink connections.

Show answer and explanation

Correct answer: B

Question 10 Single choice

A company is developing a new application that is deployed in multiple VPCs across multiple AWS Regions. The VPCs are connected through AWS Transit Gateway. The VPCs contain private subnets and public subnets.

All outbound internet traffic in the private subnets must be audited and logged. The company's network engineer plans to use AWS Network Firewall and must ensure that all traffic through Network Firewall is completely logged for auditing and alerting.

How should the network engineer configure Network Firewall logging to meet these requirements?

  1. A

    Configure Network Firewall logging in Amazon CloudWatch to capture all alerts. Send the logs to a log group in Amazon CloudWatch Logs.

  2. B

    Configure Network Firewall logging in Network Firewall to capture all alerts and flow logs.

  3. C

    Configure Network Firewall logging by configuring VPC Flow Logs for the firewall endpoint. Send the logs to a log group in Amazon CloudWatch Logs.

  4. D

    Configure Network Firewall logging by configuring AWS CloudTrail to capture data events.

Show answer and explanation

Correct answer: B