1. Home
  2. Amazon
  3. ANS-C00

Amazon ANS-C00 Online Practice Questions and Exam Preparation

ANS-C00 Exam Details

  • Exam Code
    :ANS-C00
  • Exam Name
    :AWS Certified Advanced Networking - Specialty (ANS-C00)
  • Certification
    :Amazon Certifications
  • Vendor
    :Amazon
  • Total Questions
    :414 Q&As
  • Last Updated
    :May 30, 2026

Amazon ANS-C00 Online Questions & Answers

  • Question 81:

    What are three services that help mitigate a DDoS? (Choose two.)

    A. AWS Shield
    B. DynamoDB
    C. Elastic Beanstalk
    D. CloudFront

  • Question 82:

    A company is connecting to a VPC over an AWS Direct Connect using a private VIF, and a dynamic VPN connection as a backup. The company's Reliability Engineering team has been running failover and resiliency tests on the network and the existing VPC by simulating an outage situation on the Direct Connect connection. During the resiliency tests, traffic failed to switch over to the backup VPN connection.

    How can this failure be troubleshot?

    A. Ensure that Bidirectional Forwarding Detection is enabled on the Direct Connect connection
    B. Confirm that the same routes are being advertised over both the VPN and Direct Connect.
    C. Reconfigure the Direct Connect session from static routes to Border Gateway Protocol (BGP) peering.
    D. Configure a virtual private gateway for the VPN and another virtual private gateway for Direct Connect.

  • Question 83:

    A company has a message queue application that is based on Apache Kafka. The company runs the application across a fleet of Amazon EC2 instances in a VPC. The EC2 instances are deployed across multiple Availability Zones.

    A network engineer must ensure that the application is highly available and scalable. Additionally, the load on the EC2 instances must be automatically distributed. For security compliance, application clients must be able to create an allow list

    of the IP addresses for the application.

    Which solution meets these requirements?

    A. Add an Application Load Balancer (ALB) in front of the EC2 instances. Provide the ALB IP addresses to the application clients to create an allow list.
    B. Add a Network Load Balancer (NLB) in front of the EC2 instances. Provide the NLB IP addresses to the application clients to create an allow list.
    C. Add an Application Load Balancer in front of the EC2 instances. Provide the CNAME to the application clients to create an allow list.
    D. Add a Network Load Balancer (NLB) in front of the EC2 instances. Provide the NLB's default alias to the application clients to create an allow list.

  • Question 84:

    A company has two AWS accounts: one for Production and one for Connectivity. A network engineer needs to connect the Production account VPC to a transit gateway in the Connectivity account. The feature to auto accept shared attachments is not enabled on the transit gateway.

    Which set of steps should the network engineer follow in each AWS account to meet these requirements?

    A. 1. In the Production account: Create a resource share in AWS Resource Access Manager for the transit gateway. Provide the Connectivity account ID. Enable the feature to allow external accounts. 2. In the Connectivity account: Accept the resource. 3. In the Connectivity account: Create an attachment to the VPC subnets. 4. In the Production account: Accept the attachment. Associate a route table with the attachment.
    B. 1. In the Production account: Create a resource share in AWS Resource Access Manager for the VPC subnets. Provide the Connectivity account ID. Enable the feature to allow external accounts. 2. In the Connectivity account: Accept the resource. 3. In the Production account: Create an attachment on the transit gateway to the VPC subnets. 4. In the Connectivity account: Accept the attachment. Associate a route table with the attachment.
    C. 1. In the Connectivity account: Create a resource share in AWS Resource Access Manager for the VPC subnets. Provide the Production account ID. Enable the feature to allow external accounts. 2. In the Production account: Accept the resource. 3. In the Connectivity account: Create an attachment on the transit gateway to the VPC subnets. 4. In the Production account: Accept the attachment. Associate a route table with the attachment.
    D. 1. In the Connectivity account: Create a resource share in AWS Resource Access Manager for the transit gateway. Provide the Production account ID. Enable the feature to allow external accounts. 2. In the Production account: Accept the resource. 3. In the Production account: Create an attachment to the VPC subnets. 4. In the Connectivity account: Accept the attachment. Associate a route table with the attachment.

  • Question 85:

    A Network Engineer is provisioning a subnet for a load balancer that will sit in front of a fleet of application servers in a private subnet. There is limited IP space left in the VPC CIDR. The application has few users now but is expected to grow quickly to millions of users.

    What design will use the LEAST amount of IP space, while allowing for this growth?

    A. Use two /29 subnets for an Application Load Balancer in different Availability Zones.
    B. Use one /29 subnet for the Network Load Balancer. Add another VPC CIDR to the VPC to allow for future growth.
    C. Use two /28 subnets for a Network Load Balancer in different Availability Zones.
    D. Use one /28 subnet for an Application Load Balancer. Add another VPC CIDR to the VPC to allow for future growth.

  • Question 86:

    Your company runs an HTTPS application using an Elastic Load Balancing (ELB) load balancer/PHP on nginx server/RDS in multiple Availability Zones. You need to apply Geographic Restriction and identify the client's IP address in your application to generate dynamic content.

    How should you utilize AWS services in a scalable fashion to perform this task?

    A. Modify the nginx log configuration to record value in X-Forwarded-For and use CloudFront to apply the Geographic Restriction.
    B. Enable ELB access logs to store the client IP address and parse these to dynamically modify a blacklist.
    C. Use X-Forwarded-For with security groups to apply the Geographic Restriction.
    D. Modify the application code to use value of X-Forwarded-For and CloudFront to apply the Geographic Restriction.

  • Question 87:

    You have just configured an Elastic Load Balancer. Assuming all settings are configured properly, about how long will it take an instance to become healthy with a 6 second HealthCheck Interval, an unhealthy threshold of 5 and a healthy threshold of 10?

    A. 120 seconds
    B. 30 seconds
    C. 6 seconds
    D. 60 seconds

  • Question 88:

    You have many IAM users with the ability to create EC2 volumes. Most of the data your team works with is sensitive, so you would like to make sure all volumes are encrypted. How might you facilitate this requirement?

    A. Create an AWS KMS policy and attach it to all IAM users that can create EC2 volumes.
    B. Use AWS Config and create a rule that requires all volumes, upon creation, be encrypted.
    C. Use AWS Config to send out reminders to IAM users every time they create an EC2 volume.
    D. Set EC2 to notify creators to encrypt their EC2 volumes.

  • Question 89:

    A company recently migrated its Amazon EC2 instances to VPC private subnets to satisfy a security compliance requirement. The EC2 instances now use a NAT gateway for internet access. After the migration, some long-running database queries from private EC2 instances to a publicly accessible third-party database no longer receive responses. The database query logs reveal that the queries successfully completed after 7 minutes but that the client EC2 instances never received the response.

    Which configuration change should a network engineer implement to resolve this issue?

    A. Configure the NAT gateway timeout to allow connections for up to 600 seconds
    B. Enable enhanced networking on the client EC2 instances
    C. Enable TCP keepalive on the client EC2 instances with a value of less than 300 seconds
    D. Close idle TCP connections though the NAT gateway

  • Question 90:

    You have two VPCs that require DNS resolution from your on-premises data center. You want to have a DNS server in the cloud, but you don't want to have multiple DNS servers. What two steps should you take? (Choose two.)

    A. Peer the VPCs and set up routes between them.
    B. Create a VPN between the two VPCs
    C. Configure DHCP option sets in both VPCs to point to the DNS server.
    D. Configure a Route 53 record to forward all DNS requests to the DNS server.

Related Exams:

Tips on How to Prepare for the Exams

Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only Amazon exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your ANS-C00 exam preparations and Amazon certification application, do not hesitate to visit our Vcedump.com to find your solutions here.