Was :
$90
Today :
$50
Was :
$108
Today :
$60
Was :
$126
Today :
$70
What Is the ANS-C01 Certification Exam?
The ANS-C01 certification exam is a standardized assessment designed to measure a candidate's knowledge, competencies, and practical understanding within a defined professional field. It serves as the primary requirement for earning the AWS Certified Specialty, a credential that represents a recognized level of proficiency in its respective industry. Depending on the field, this may involve theoretical knowledge, applied problem-solving, regulatory understanding, or hands-on procedural competence.
The exam is typically developed and maintained by an accrediting body or professional organization that sets the standards for the AWS Certified Specialty. This ensures that anyone who earns the credential has met a consistent benchmark, regardless of where they studied or gained their experience. For many professionals, the ANS-C01 Certification Exam represents a formal checkpoint in their career, one that confirms readiness to take on greater responsibility within their chosen field.
Why the AWS Certified Specialty Certification Matters?
Certifications like the AWS Certified Specialty exist because industries need a reliable way to verify competence beyond a resume or a job title. Earning this credential signals to employers, clients, and colleagues that a professional has invested time in building a structured foundation of knowledge and has been evaluated against an established standard.
Beyond individual recognition, the AWS Certified Specialty certification often supports broader professional development. It can influence hiring decisions, contribute to internal advancement, or serve as a prerequisite for more specialized roles within the field. In many industries, certifications also help standardize expectations across organizations, making it easier for professionals to move between employers or sectors while carrying a credential that is widely understood and respected.
Who Should Take the ANS-C01 Exam?
The ANS-C01 exam is generally relevant to individuals who are either entering a field or looking to formalize skills they have already developed through experience. This can include early-career professionals seeking a credential to support their first steps into the industry, as well as experienced practitioners who want official recognition of knowledge gained on the job.
Students preparing to enter the workforce may also pursue the ANS-C01 exam as a way to strengthen their qualifications before graduating or applying for their first roles. In some fields, employers actively encourage or require staff to pursue this certification as part of ongoing professional development, particularly in industries where standards, safety, or compliance play a significant role in daily responsibilities.
Knowledge and Skills Evaluated in the Amazon AWS Certified Advanced Networking - Specialty
The Amazon AWS Certified Advanced Networking - Specialty is built to evaluate both foundational knowledge and the practical judgment needed to apply that knowledge in real situations. Candidates are generally expected to understand core principles and terminology relevant to their field, along with the reasoning behind established procedures, standards, or best practices.
Depending on the industry, this may include understanding regulatory requirements, following established protocols, applying analytical or technical methods, or exercising sound judgment in situations that require careful decision-making. Rather than testing isolated facts in a vacuum, the Amazon AWS Certified Advanced Networking - Specialty tends to reward candidates who can connect concepts to realistic scenarios, reflecting the kind of thinking expected in day-to-day professional practice.
ANS-C01 Exam Preparation Resources
Preparing for the ANS-C01 certification exam becomes more effective when using high-quality and up-to-date study materials. MyCertsHub provides resources designed to help candidates build knowledge, practice consistently, and become familiar with the actual exam format.
How to Prepare for the ANS-C01 Certification Exam?
Effective preparation for the ANS-C01 certification exam usually begins with a clear understanding of the exam's objectives and structure. Reviewing official guidelines or documentation published by the certifying body provides the most accurate picture of what will be covered and how heavily different areas are weighted.
From there, many candidates benefit from building a structured study plan that breaks preparation into manageable sections over a set period of time. A well-organized ANS-C01 Study Guide can help sequence this material logically, especially for those approaching a topic for the first time. Consistent review, paired with realistic practice, tends to produce better retention than concentrated last-minute studying.
Practical experience, where applicable to the field, also plays an important role in preparation. Working through ANS-C01 Practice Questions and a ANS-C01 practice test can help candidates identify gaps in their understanding and become familiar with the format and pacing of the actual exam. In fields where hands-on skill is assessed, supplementing study with real-world practice or supervised experience often makes the difference between recognizing correct information and genuinely understanding it.
Benefits of Earning the AWS Certified Specialty Certification
Successfully earning the AWS Certified Specialty certification offers benefits that extend well beyond passing a single exam. It provides documented proof of competence that can be referenced on a resume, professional profile, or internal performance review, offering a clear, third-party validation of skill and knowledge.
The credential can also strengthen professional credibility when working with clients, patients, stakeholders, or colleagues who may not be positioned to evaluate technical or specialized knowledge directly. Over time, this recognition often contributes to expanded career opportunities, whether through new responsibilities, higher-level roles, or eligibility for additional certifications that build on this foundational credential.
Prepare for the ANS-C01 Exam with MyCertsHub
Preparing for the ANS-C01 exam is a process that benefits from organized, consistent effort rather than rushed, last-minute review. MyCertsHub is designed to support that process by offering study resources, practice materials, and educational content that help candidates understand what the Amazon AWS Certified Advanced Networking - Specialty covers and how to approach their preparation thoughtfully.
Whether someone is just beginning to explore the AWS Certified Specialty or is in the final stages of reviewing material before their exam date, MyCertsHub aims to serve as a dependable resource throughout that journey. Every candidate's path to certification looks a little different, and the goal remains the same: to provide clear, genuinely useful information that supports real understanding of the subject matter.
Amazon ANS-C01 Sample Question Answers
Question # 1
A company hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB).The instances are part of an Amazon EC2 Auto Scaling group.To comply with new security standards, the company must capture all application access data,including server response codes, request paths, latency, and client IP addresses. The company alsoneeds to query the captured data for performance analysis.Which solution will meet these requirements?
A.Enable VPC flow logs on the ALB subnets. Store the logs to an Amazon S3 bucket. Query the logs inthe S3 bucket by using Amazon Athena. B.Configure Amazon VPC Traffic Mirroring on all EC2 elastic network interfaces. Deploy a third-partymonitoring appliance from AWS Marketplace in a private subnet. Use Amazon Data Firehose to sendall mirrored traffic to the monitoring appliance. Query the logs directly from the monitoringappliance. C.Configure Amazon CloudWatch detailed monitoring on the EC2 instances Include all available logs.Use Amazon Data Firehose to send all the collected logs to an Amazon S3 bucket. Query the datadirectly from the S3 bucket. D.Enable access logs on the ALB. Store the logs in an Amazon S3 bucket. Query the logs in the S3bucket by using Amazon Athena.
Answer: D
Explanation:
ALB Access Logs: Enabling access logs on the ALB provides detailed information about incoming
requests, including server response codes, request paths, latency, and client IP addresses. These logs
are specifically designed to capture the required application access data.
S3 for Storage: The logs are stored in Amazon S3, providing a cost-effective and scalable solution for
retaining the data.
Athena for Querying: Amazon Athena can be used to query the data directly from the S3 bucket
without the need to move or transform the data, making it efficient for performance analysis.
Question # 2
A company is planning to migrate to AWS and use multiple VPCs in multiple AWS Regions. A networkengineer must connect the eu-west-1 and eu-central-1 Regions to the company headquarters and branch office, respectivelyThe network engineer created a production VPC, named Prod A, with a CIDR block of 10.0.0.0.Prod A runs in an account in eu-west-1. The network engineer then created another production VPC,named Prod B, with a CIDR block of 10.1.0.0. Prod Ð’ runs in a different account in eu-central-1.The network engineer performed the following steps to try to achieve the required connectivity:1.Created one transit gateway in each Region2.Shared and accepted the transit gateways with the production accounts in both Regions3.Configured the peering attachment between both transit gateways4.Attached both VPCs to the respective Region transit gateway5.Created both transit gateway route tables and associated the attachments with the route tables6.Configured a static route in both transit gateway route tables to send traffic to the remote VPC inthe other Region7.Activated route propagation on the VPC route tables in each RegionAfter the configuration, the network engineer tried to connect from Prod A to Prod B. However, theconnection was unsuccessful.What should the network engineer do to achieve the required connectivity?
A.Modify the IP address of the peering attachment to a wider range. B.Delete the static routes that were in the transit gateway route table to send traffic to the remoteVPC and enable route propagation instead. C.Create a new route destined to 10.0.0.0 in both production VPC route tables with the Regiontransit gateway as the target. D.Modify the transit gateway route tables from the production accounts to propagateroutes dynamically between the production VPCs.
Answer: C
Explanation:
Question # 3
A company is planning to use an AWS Transit Gateway hub and spoke architecture to migrate to AWS.The current on-premises multi-protocol label switching (MPLS) network has strict controls thatenforce network segmentation by using MPLS VPNs. The company has provisioned two 10 Gbps AWSDirect Connect connections to provide resilient, high-speed, low-latency connectivity to AWS.A security engineer needs to apply the concept of network segmentation to the AWS environment toensure that virtual routing and forwarding (VRF) is logically separated for each of the company'ssoftware development environments. The number of MPLS VPNs will increase in the future. OnpremisesMPLS VPNs will have overlapping address space. The company's AWS network design mustsupport overlapping address space for the VPNs.Which solution will meet these requirements with the LEAST operational overhead?
A.Deploy a software-defined WAN (SD-WAN) head-end virtual appliance and an SD-WAN controllerinto a Transit Gateway Connect VPC. Configure the company's edge routers to be managed by thenew SD-WAN controller and to use SD-WAN to segment the traffic into the defined segments foreach of the company's development environments. B.Configure IPsec VPNs on the company edge routers for each MPLS VPN for each of thecompany's development environments. Attach each IPsec VPN tunnel to a discrete MPLS VPN.Configure AWS Site-to-Site VPN connections that terminate at a transit gateway for each MPLSVPN. Configure a transit gateway route table that matches the MPLS VPN for each Transit GatewayVPN attachment. C.Create a transit VPC that terminates at the AWS Site-to-Site VRF-aware IPsec VPN. Configure IPsecVPN connections to each VPC for each of the company's development environment VRFs D.Configure a Transit Gateway Connect attachment for each MPLS VPN between the company's edgerouters and Transit Gateway. Configure a transit gateway route table that matches the MPLS VPN foreach of the company's development environments.
Answer: D
Explanation:
Transit Gateway Connect Attachments: Transit Gateway Connect attachments support dynamic
routing via BGP and can segment traffic using VRFs, which aligns with the company's requirement
for logical network segmentation similar to MPLS VPNs. Each Connect attachment can represent a
VRF from the on-premises MPLS network.
Support for Overlapping Address Space: Transit Gateway Connect attachments allow the
segmentation of routing through the use of separate transit gateway route tables for each
development environment. This ensures that overlapping IP address spaces between the
and routing, minimizing the need for additional software-defined networking solutions or complex
VPN configurations
Question # 4
A company is planning to host a secure web application across multiple Amazon EC2 instances. Theapplication will have an associated DNS domain in an Amazon Route 53 hosted zone.The company wants to protect the domain from DNS poisoning attacks. The company also wants toallow web browsers to authenticate into the application by using a trusted third party.Which combination of actions will meet these requirements?
A.Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install self-signedX.509 certificates on the EC2 instances. B.Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install X 509certificates that are signed by a public certificate authority on the EC2 instances. C.Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install X.509certificates that are signed by a public certificate authority on the EC2 instances. D.Configure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install selfsignedX.509 certificates on the EC2 instances.
Answer: C
Explanation:
DNSSEC protects against DNS poisoning attacks by enabling authentication of DNS data integrity and
origin. When DNSSEC is enabled in the Route 53 hosted zone, it signs the DNS records, ensuring their
authenticity.
To enable web browsers to authenticate the application securely using a trusted third party, X.509
certificates signed by a public Certificate Authority (CA) are required. These certificates allow HTTPS
communication, ensuring that the web browsers trust the application.
Question # 5
A companys data center is connected to a single AWS Region by an AWS Direct Connect dedicatedconnection. The company has a single VPC in the Region. The company stores logs for all itsapplications locally in the data center.The company must keep all application logs for 7 years. The company decides to copy all applicationlogs to an Amazon S3 bucket.Which solution will meet these requirements?
A.Create a public VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint inthe VPC. B.Create a private VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint inthe VPC. C.Create a private VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint inthe VPC. D.Create a public VIF on the Direct Connect connection. Create an Amazon S3 interface endpointin the VPC.
Answer: B
Explanation:
Private VIF on Direct Connect: A private virtual interface (VIF) is used to establish a private
connection between your data center and your VPC over AWS Direct Connect. This allows traffic to
remain within the private network.
Amazon S3 Gateway Endpoint: A gateway endpoint provides a scalable and highly available way to
privately access Amazon S3 without requiring an internet gateway or NAT gateway. Gateway
endpoints are more cost-effective than interface endpoints for accessing S3, especially for highvolume
data transfers like application logs.
Question # 6
A global company is establishing network connections between the company's primary andsecondary data centers and a VPC. A network engineer needs to maximize resiliency and faulttolerance for the connections. The network bandwidth must be greater than 10 Gbps.Which solution will meet these requirements MOST cost-effectively?
A.Set up a 100 Gbps connection at the primary data center that terminates at an AWS DirectConnect location. Set up a second 100 Gbps connection at the secondary data center that terminatesat a second Direct Connect location. Ensure the connections are managed by separate providers. B.Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connectlocation. Set up a second 10 Gbps connection at the secondary data center that terminates at asecond Direct Connect location. Ensure the connections are managed by separate providers. C.Set up two 10 Gbps connections at the primary data center that terminate at one AWS Direct Connect location. Ensure the connections are managed by separate providers. Set up two 10 Gbpsconnections at the secondary data center that terminate at a second Direct Connect location. Ensurethe connections are managed by separate providers. D.Set up a 10 Gbps connection at the primary data center that terminates at an AWS Direct Connectlocation. Set up an AWS Site-to-Site VPN connection at the secondary data center that terminates ata virtual private gateway in the same Region as the companys VPC.
Answer: C
Explanation:
Multiple 10 Gbps Connections: By setting up two 10 Gbps connections at each data center, the
solution achieves an aggregate bandwidth of 20 Gbps per data center, exceeding the requirement of
10 Gbps. Using multiple 10 Gbps links is more cost-effective than deploying 100 Gbps links.
Separate Providers: Ensuring that the connections are managed by separate providers minimizes the
risk of a single provider's failure affecting the network.
Two Direct Connect Locations: Terminating connections at two Direct Connect locations ensures
geographic redundancy. This setup minimizes the impact of outages or disruptions at a single Direct
Connect location.
Question # 7
A company has 10 Amazon EC2 instances that run web server software in a production VPC. Thecompany also has 10 web servers that run in an on-premises data center. The company has a 10 GbpsAWS Direct Connect connection between the on-premises data center and the production VPC. Thedata center uses the 10.100.0.0 CIDR block.The company needs to implement a load balancing solution that receives HTTPS traffic fromthousands of external users. The solution must distribute the traffic across the web servers on AWSand the web servers in the data center. Regardless of the location of the web servers, HTTPS requestsmust go to the same web server for the duration of the session.Which solution will meet these requirements?
A.Deploy a Network Load Balancer (NLB) in the production VPC. Create one target group for the EC2Instances and a second target group for the on-premises servers. Specify IP as the target type.Register the EC2 instances and the on-premises servers with the target groups. Enable connectiondraining on the NLB. B.Deploy an Application Load Balancer (ALB) in the production VPC. Create one target group for theEC2 Instances and a second target group for the on-premises servers. Specify IP as the target type.Register the EC2 instances and the on-premises servers with the target groups. Enable applicationbasedsticky sessions on the ALB. C.Deploy a Network Load Balancer (NLB) in the production VPC. Create one target group for theEC2 Instances and a second target group for the on-premises servers. Specify instance as the targettype. Register the EC2 instances and the on-premises servers with the target groups. Enable stickysessions on the NLB. D.Deploy an Application Load Balancer (ALB) in the production VPC. Create one target group forthe EC2 Instances and a second target group for the on-premises servers. Specify instance as the targettype. Register the EC2 instances and the on-premises servers with the target groups. Enableapplication-based sticky sessions on the ALB.
Answer: B
Explanation:
Application Load Balancer (ALB) is the best choice for handling HTTPS traffic because it operates at
the application layer (Layer 7). It supports features such as sticky sessions, which are required to
ensure that requests from the same user are routed to the same server for the duration of the
session.
IP as the Target Type: To load balance traffic between both EC2 instances and on-premises servers,
the target type must be set to IP. This configuration allows the ALB to distribute traffic to servers
identified by IP addresses, including those in the on-premises data center.
Sticky Sessions: Application-based sticky sessions ensure that the load balancer uses cookies to route
requests consistently to the same web server, meeting the requirement for session persistence.
Question # 8
A company runs workloads in multiple VPCs in the us-east-1 Region. The VPCs are connected to atransit gateway. An AWS Direct Connect connection provides private connectivity between a datacenter that is in the US and the transit gateway. A Direct Connect gateway is associated with thetransit gateway.The company has recently opened a new office location in London. The company plans to launchcloud services in multiple VPCs in the eu-west-2 Region. Users in the new London office must haveprivate access to the workloads that run in us-east-1. Users in the US data center must have access toany workloads that are created in eu-west-2. A network engineer must implement a flexible solutionthat provides users the required access. The solution must be able to accommodate future growth.Which solution will meet these requirements with the LEAST operational effort?
A.Create an AWS Site-to-Site VPN connection from the London office to the Direct Connect gatewayin us-east-1. B.Establish a new Direct Connect connection for the London office. Attach the new Direct Connectconnection to the existing Direct Connect gateway. Create a transit gateway in eu-west-2. Associatethe new transit gateway with the existing Direct Connect gateway. Create a peering connectionbetween the transit gateways in us-east-1 and eu-west-2. C.Create an AWS Site-to-Site VPN connection from the London office to each of the VPCs that are inus-east-1. D.Establish a new AWS Direct Connect connection for the London office Create a new Direct Connectgateway and a transit gateway in eu-west-2. Attach the new Direct Connect connection to the newDirect Connect gateway. Create a peering connection between the transit gateways in us-east-1 andeu-west-2.
Answer: B
Explanation:
This solution provides a scalable and flexible architecture that accommodates future growth while
ensuring connectivity between regions and locations.
New Direct Connect Connection in London: Establishing a Direct Connect connection for the
London office provides a high-performance, private, and reliable connection between the office and
AWS. Use the Existing Direct Connect Gateway: By attaching the new Direct Connect connection to
the existing Direct Connect gateway, the solution leverages the existing infrastructure, reducing
operational complexity.
Transit Gateway in eu-west-2: The transit gateway in eu-west-2 enables centralized routing and
connectivity management for multiple VPCs in that Region.
Transit Gateway Peering: Peering the transit gateways in us-east-1 and eu-west-2 ensures seamless
private connectivity between the regions, allowing users in the US and London to access workloads
in both regions.
This design ensures low operational effort because it avoids creating and managing multiple
individual VPN connections. It also supports future growth by allowing additional VPCs, regions, or
office locations to connect with minimal configuration changes.
Question # 9
A finance company runs multiple applications on Amazon EC2 instances in two VPCs that are within asingle AWS Region. The company uses one VPC for stock trading applications. The company uses thesecond VPC for financial applications. Both VPCs are connected to a transit gateway that is configuredas a multicast router.In the stock trading VPC, an EC2 instance that has an IP address of 10.128.10.2 sends trading dataover a multicast network to the 239.10.10.10 IP address on UDP Port 5102. The company recentlylaunched two new EC2 instances in the financial application VPC. The new EC2 instances need toreceive the multicast stock trading data from the EC2 instance that is in the stock trading VPC.Which combination of steps should the company take to meet this requirement? (Choose three.)
A.Add the elastic network interfaces of the two new EC2 instances as members of the multicastgroup by using the group IP address of 239.10.10.10. B.Add an inbound rule to the security groups that are attached to the multicast receiver instances.Configure the rule as follows:Protocol: IGMP Version 2. Port: 5102, and Source: 239 10.10.10 C.Create associations to two EC2 instance IDs on the financial application VPC transit gatewayattachment under the transit gateway multicast domain D.Create an association to EC2 instance subnets on the financial application VPC transit gatewayattachment under the transit gateway multicast domain.Add an inbound rule to the security groups that are attached to the multicast receiver instances.Configure the rule as follows.E.Protocol: UDP, Port: 5102, and Source: 10.128.10.2F.Add an inbound rule to the security groups that are attached to the multicast receiver instances.Configure the rule as follows:Protocol: IGMP Version 2. Port: All, and Source: 0 0.0.0
Answer: A, C, E
Explanation:
Add ENIs to the multicast group: To receive multicast traffic, the ENIs of the receiver EC2 instances
must be explicitly added as members of the multicast group using the multicast group IP address
(239.10.10.10).
Create associations to the EC2 instance IDs: Multicast domains in a transit gateway allow multicast
traffic to flow between VPCs. To enable specific instances to receive the multicast traffic, the instance
IDs in the financial application VPC must be associated with the transit gateway multicast domain.
Add a security group rule for UDP traffic: The receiver instances need a security group rule to allow
inbound UDP traffic on port 5102 from the sender EC2 instance (source IP: 10.128.10.2). This ensures
that multicast traffic is allowed to reach the receiving instances.
Question # 10
A logistics company has multiple VPCs in an AWS Region. The company uses a transit gateway toconnect the VPCs. The company has several on-premises offices that connect to the transit gatewayby using AWS Site-to-Site VPN connections over the internet. The company has configured onetransit gateway VPN attachment for each office.Route propagation is enabled on all route tables. Each Site-to-Site VPN connection uses two tunnelsin an active-passive configuration. The company configured each office with appropriate static routeson both the Site-to-Site VPN connection and the offices customer gateway.The company wants to use both IPsec tunnels of every office to maximize the overall VPN connectionbandwidth.Which design changes are necessary to meet these requirements?
A.Create an AWS Transit Gateway Connect attachment for each office Use the existing VPNattachments as the transport for the new Connect attachments. Set up a Generic RoutingEncapsulation (GRE) tunnel on each customer gateway that terminates on the Connect attachmentfor each office. Move the static routes from the transit gateway VPN attachment to the customergateway for the transit gateway Connect attachment. B.Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supportedby and enabled on the customer gateways. Enable ECMP on the Site-to-Site VPN connection. Ensurestatic routes on the customer gateways have equal metrics and administrative distance C.Enable equal-cost multi-path (ECMP) routing on the transit gateway. (Ensure ECMP is supported byand enabled on the customer gateways. Change the routing configuration between the transitgateway and the customer gateways from static routing to BGP. Remove related static routes fromthe customer gateways. D.Enable equal-cost multi-path (ECMP) routing on the transit gateway. Ensure ECMP is supportedby and enabled on the customer gateways. Change the routing configuration between the transitgateway and the customer gateways from static routing to BGP. Ensure the customer gateway applies the correct community strings to give the transit gateway the ability to perform ECMP forwarding.
Answer: C
Explanation:
To use both IPsec tunnels for maximizing bandwidth, equal-cost multi-path (ECMP) routing must be
enabled. ECMP allows the transit gateway to load balance traffic across multiple paths (in this case,
both IPsec tunnels). For ECMP to work:
Transit Gateway ECMP Support: The transit gateway must have ECMP routing enabled to distribute
traffic across multiple VPN tunnels.
BGP Configuration: Static routing cannot support ECMP. Switching to BGP allows dynamic route
advertisements and supports ECMP. Removing static routes ensures that the BGP-learned routes take
precedence.
Customer Gateway ECMP Support: The customer gateway must also support ECMP for the
configuration to work end-to-end.
By implementing these changes, both tunnels can be utilized simultaneously, effectively increasing
the available bandwidth for the Site-to-Site VPN connections.
Question # 11
A company has VPCs in the us-east-1 Region that are connected to each other through a transitgateway. A network engineer needs to establish an AWS Direct Connect connection between thecompany's on-premises data center and the transit gateway for the migration of a workload.The Direct Connect connection is UP according to the ConnectionState metric in AmazonCloudWatch. However, the VIF is DOWN. The network engineer has verified the transit VIF and BGPconfigurations on the on-premises router and has found no issues. However, the network engineer isunable to ping the Amazon peer IP address.Which combination of steps should the network engineer take to troubleshoot this issue? (Choosethree.)
A.Verify that the correct IP address and subnet mask are in use for the subinterface on the router. B.Ensure that VLAN trunking is disabled on the router. C.Verify that the router has a MAC address entry from the AWS endpoint in the AddressResolution Protocol (ARP) table. D.Verify that the optical signal that is received over the cross connect is optimal. E.Ensure that the correct VLAN tag is applied on the subinterface configuration on the router. F.Ensure that TCP port 179 is not being blocked at the on-premises router.
Answer: A, C, E
Explanation:
The IP address and subnet mask configuration on the router's subinterface must match the
configuration provided by AWS for the virtual interface (VIF). A mismatch will prevent successful
communication between the on-premises router and AWS.
A MAC address entry in the ARP table is essential for Layer 2 connectivity. If the AWS endpoint's MAC
address is not visible in the ARP table, it could indicate a connectivity or VLAN tagging issue.
The correct VLAN tag must be configured for the subinterface because AWS Direct Connect requires
VLAN tagging to separate traffic between different virtual interfaces.
Question # 12
A company has configured an AWS Cloud WAN core network with edge locations in the us-east1 Region and the us-west-1 Region. Each edge location has two segments: development andstaging. The segments use the default core network policy.The company has attached VPCs to the core network. A development VPC is attached to thedevelopment segment in us-east-1 and is configured to use the 10.0.0.0 CIDR block. A staging VPCis attached to the staging segment in us-west-1 and is configured to use the 10.5.0.0 CIDR block.The company has updated the route tables for both VPCs with a route that directs any traffic for0.0.0.0/0 to the core network.The companys network team needs to establish communication between the two VPCs by using theAWS Cloud WAN core network. The network team is not receiving a response during tests ofcommunication between the VPCs. The network team has verified that security groups and networkACLs are not blocking the traffic.What should the network team do to establish this communication?
A.Update both VPC route tables to have a new static route. Configure a route on the developmentVPC to direct the traffic for 10.0.0.0 to the development VPC attachment. Configure a route onthe staging VPC to direct the traffic for 10.5.0.0 to the staging VPC attachment B.Update the segment filter to allow traffic on the development and staging segments. C.Set the isolate-attachments parameter to False for the development and staging segments. D.Update the core network policy to add a static route for each segment. Configure a route to directthe traffic for 10.0.0.0 to the development VPC attachment. Configure a route to direct the trafficfor 10.5.0.0 to the staging VPC attachment.
Answer: D
Explanation:
Question # 13
A network engineer needs to provide a list of IP addresses that are sending traffic to an Amazon EC2instance. VPC flow logs are enabled. The EC2 instance has a single network interface and twoassigned IP addresses. However, the flow logs are logging traffic only for the primary IP address. Thenetwork engineer needs to determine whether any traffic is being sent to the second IP address ofthe EC2 instance.What should the network engineer do to locate the traffic flow for the second IP address?
A.Create a new flow log that includes the pkt-dstaddr field to capture the original destination IPaddress of the traffic. B.Create a new flow log that includes the dstaddr field to capture the original destination IPaddress of the traffic. C.Create a new flow log that includes the pkt-srcaddr field to capture the original destination IPaddress of the traffic. D.Create a new flow log that includes the srcaddr field to capture the original destination IPaddress of the traffic.
Answer: A
Explanation:
Question # 14
A company wants to implement a distributed architecture on AWS that uses a Gateway LoadBalancer (GWLB) and GWLB endpoints.The company has chosen a hub-and-spoke model. The model includes a GWLB and virtual appliancesthat are deployed into a centralized appliance VPC and GWLB endpoints. The model also includesinternet gateways that are configured in spoke VPCs.Which sequence of traffic flow to the internet from the spoke VPC is correct?
A.1.An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route tableconfiguration.2.Traffic is delivered securely and privately to the GWLB.3.The GWLB sends the traffic to a virtual appliance for inspection.4.Return traffic flows back to the GWLB endpoint and out to the internet through the internetgateway. B.1.An application in a spoke VPC sends traffic to the GWLB endpoint based on the VPC route tableconfiguration.2.Traffic is delivered securely and privately to the GWLB endpoint.3.The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliancefor inspection.4.Return traffic flows back to the GWLB and out to the internet through an internet gateway. C.1.An application in a spoke VPC sends traffic to the GWLB endpoint.2.Traffic is delivered securely and privately to the GWLB.3.The GWLB sets the X-Forwarded-For request header and sends the traffic to a virtual appliancefor inspection.4.Return traffic flows back to the GWLB endpoint and out to the internet through the internet gateway. D.1.An application in a spoke VPC sends traffic to the GWLB.2.Traffic is delivered securely and privately to the GWLB endpoint.3.The GWLB sends the traffic to a virtual appliance for inspection.4.Return traffic flows back to the GWLB and out to the internet through an internet gateway.
Answer: A
Explanation:
Question # 15
A company hosts a highly available, scalable, and resilient application on Amazon EC2 instances thatare part of an Auto Scaling group. A network engineer is planning to integrate IPv6 support with theapplication deployment in phases. The first phase is to enable IPv6 service consumption on thepublic Network Load Balancers (NLBs) that are deployed across the infrastructure. The target groupsfor the NLBS are configured as the Auto Scaling groups of the EC2 instances that host the application.The NLBs are configured for dual-stack operation.During the testing of the first phase, the IPv6 application queries are not reaching the backend servers.What is the cause of this issue?
A.The subnets where the EC2 instances are deployed do not have IPv6 addresses configured. B.The route tables for the NLB subnets do not have IPV6 routing configured. C.The route tables for the EC2 subnets do not have IPV6 routing configured. D.The security groups that are associated with the NLBs do not allow IPv6 traffic.
Answer: C
Explanation:
Question # 16
A company is using AWS Cloud WAN with one edge location in the us-east-1 Region and one edgelocation in the us-west-1 Region. A shared services segment exists at both edge locations. Eachshared services segment has a VPC attachment to each inspection VPC in each Region. Theinspection VPCs inspect traffic from a WAN by using AWS Network Firewall.The company creates a new segment for a new business unit (BU) in the us-east-1 edge location. Thenew BU has three VPCs that are attached to the new BU segment. To comply with regulations, the BUVPCs must not communicate with each other. All internet-bound traffic must be inspected in theinspection VPC.The company updates VPC route tables so any traffic that is bound for internet goes to the AWSCloud WAN core network.The company plans to add more VPCs for the new BU in the future. All future VPCs must comply withregulations.Which solution will meet these requirements in the MOST operationally efficient way? (Choose two.)
A.Update the network policy to share the shared services segment with the BU segment. B.Create a network policy to share the inspection service segment with the BU segment. C.Set the isolate-attachments field to True for the BU segment. D.Set the isolate-attachments field to False for the BU segment. E.Update the network policy to add static routes for the BU segment. Configure the shared servicessegment to route traffic related to VPC CIDR blocks to each respective VPC attachment.
Answer: B, C
Explanation:
Question # 17
A company has a VPC that includes application workloads that run on Amazon EC2 instances in asingle AWS Region. The company wants to use AWS Local Zones to deploy an extension of theapplication workloads that run in the Region. The extended workloads in the Local Zone need tocommunicate bidirectionally with the workloads in the VPC in the Region.Which solution will meet these requirements MOST cost-effectively?
A.Create a new VPC in the Local Zone. Attach all the VPCs to a transit gateway. Configure routing forthe transit gateway and the VPCs. Deploy instances in the new VPC. B.Deploy a third-party appliance in a new VPC in the Region. Create a new VPC in the Local Zone.Create VPN connections to the appliance for the VPCs. Deploy instances in the new VPC in the LocalZone. C.Create a new subnet in the Local Zone. Deploy a third-party appliance in the VPC with interfaces ineach subnet. Configure the new subnet to route the Local Zone through the appliance. Deployinstances in the new subnet. D.Create a new subnet in the Local Zone. Configure the new subnet to use a CIDR block that is withinthe VPCs CIDR block. Deploy instances in the new subnet in the Local Zone.
Answer: D
Explanation:
Question # 18
A company has a web application that runs in eight AWS Regions. In each Region, the application ishosted on multiple compute resources behind an Application Load Balancer (ALB).The different Regions are using different domains. Each ALB is configured to accept only HTTPS raffic. Each ALB uses a certificate from AWS Certificate Manager (ACM).The company wants to simplify the applications appearance on the web by using a new singledomain for all Regions. A network engineer needs to implement this change by designing a solutionthat also will minimize latency for the application's end users.Which combination of actions will meet these requirements? (Choose three.)
A.Use ACM to create an SSL/TLS certificate in the us-east-1 Region for the new domain. B.Set up latency-based routing in Amazon Route 53 for the new domain. Add the ALBs from all theRegions as targets. C.Create an alias record for the accelerator in Amazon Route 53 for the new domain. D.Create a standard accelerator in AWS Global Accelerator. Configure a listener for TCP traffic. Addall the ALBs as targets for the listener. E.Use ACM to create an SSLITLS certificate for each Region. Configure all the ALBs to use thecertificate in their respective Regions. F.Create a custom routing accelerator in AWS Global Accelerator. Configure a listener for HTTPStraffic. Add all the ALBs as targets for the listener. Configure the accelerator to terminate TLS by usingthe SSLITLS certificate from ACM.
Answer: A, B, F
Explanation:
Question # 19
A network engineer needs to monitor internet metrics for an application that is in a VPC. The metricsinclude user experiences such as health events, latency, and traffic insights.The network engineer sets up Amazon CloudWatch Internet Monitor for the application. Theengineer wants to push the internet health events to a third-party target.Which solution will meet these requirements with the LEAST implementation effort?
A.Create a third-party API endpoint in Amazon EventBridge. Configure internet Monitor to send theevents to the third-party API endpoint in EventBridge. B.Create a third-party API endpoint in Amazon EventBridge. Create a rule in EventBridge that usesInternet Monitor as the source and the third-party API endpoint in EventBridge as the destination. C.Create a third-party API endpoint in internet Monitor. Configure Internet Monitor to send theevents to an Amazon S3 bucket. Configure an AWS Lambda function to send the events to the thirdpartyAPI endpoint in Internet Monitor D.Create a third-party API endpoint in Internet Monitor. Configure Internet Monitor to send theevents to the third-party API endpoint in Internet Monitor.
Answer: D
Explanation:
Question # 20
A company is running its application servers on Amazon EC2 instances. The EC2 instances run inseparate VPCs that are connected by a transit gateway. The EC2 instances launch in a private subnetwith a route to the transit gateway for internal and external connectivity. The external connectivity isprovided by a VPC with firewall devices that perform an inspection for packets that ingress andegress through an internet gateway.A network engineer needs to help the companys application team increase the payload size perpacket delivery between the EC2 instances. All network connectivity must be through thetransit gatewayWhat should the network engineer do to meet these requirements?
A.Enable jumbo frames on the transit gateway. Instruct the application team to set the maximumtransmission unit (MTU) of the system's network interfaces to 9001 bytes. B.Instruct the application team to set the maximum transmission unit (MTU) of the VPC to 8500bytes. C.Instruct the application team to set up enhanced networking on the system by using the enhancednetworking adapter. Set the maximum transmission unit (MTU) to 9001 bytes. D.Instruct the application team to set the maximum transmission unit (MTU) of the system'snetwork interfaces to 8500 bytes.
Answer: D
Explanation:
Question # 21
A company is replatforming a legacy data processing solution to AWS. The company deploys thesolution on Amazon EC2 Instances in private subnets that are in one VPC.The solution uses Amazon S3 for abject storage. Both the data that the solution processes and thedata the solution produces are stored in Amazon S3. The solution uses Amazon DynamoDB to save itsown state. The company collects flow logs for the VPC. The solution uses one NAT gateway to registerits license through the internet. A software vendor provides a specific hostname so the solution canregister its license.The company notices that the AWS bill exceeds the projected budget for the solution. A networkengineer uses AWS Cost Explorer to investigate the bill. The network engineer notices that the USE2-NatGateway-Bytes($) usage type is the root cause of the higher than expected bill.What should the network engineer do to resolve the issue? (Choose two.)
A.Set up Amazon VPC Traffic Mirroring. Analyze the traffic to identify the traffic that the NAT gatewayprocesses. B.Examine the VPC flow logs to identity the traffic that traverses the NAT gateway. C.Set up an AWS Cost and Usage Report in the AWS Billing and Cost Management console. Examinethe report to find more details about the NAT gateway charges. D.Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IPaddresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges forAmazon S3 and DynamoDB E.Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up andassociated with the route tables of the private subnets.
Answer: B, E
Explanation:
Question # 22
A company has VPCs across 50 AWS accounts and is using AWS Organizations. The company wants toimplement web filtering. The requirements for how the traffic must be filtered are the same for allthe VPCs. A network engineer plans to use AWS Network Firewall. The network engineer needs toimplement a solution that minimizes the number of firewall policies and rule groups that arenecessary for this web filtering.Which combination of steps will meet these requirements? (Choose three.)
A.Create a firewall policy or rule group in each account. B.Use SCPs to share the firewall policy or rule group. C.Create a firewall policy or rule group in the management account D.Use AWS Resource Access Manager (AWS RAM) to share the firewall policy or rule group. E.Enable sharing within Organizations. F.Create OUs to share the firewall policy or rule group.
Answer: C, D, E
Explanation:
Question # 23
A company has two on-premises data centers. The first data center is in the us-east-1 Region. TheSecond data canter is in the us-east-2 Region. Each data center connects to the closest AWS Direct Connect facility. The company uses Direct Connect connections, transit VIFs, and a single DirectConnect gateway to establish connectivity to VPCs in us-east-1 and us-east-2 from the companysdata centers. The company also has private connectivity from a telecommunications provider thatconnects the first data center to the second data center.Recently, there have been multiple connection disruptions to the private connectivity between thedata centers. The company needs a solution to improve the reliability of the connection between thetwo data centers.Which solution will meet these requirements?
A.Create a new Direct Connect gateway. Enable the Direct Connect SiteLink feature on the transitVIF. Share the CIDR blocks from the first data center and the second data center with each other. B.Create a new public VIF to both Regions. Enable the Direct Connect SiteLink feature on the newpublic VIF. C.Enable the Direct Connect SiteLink feature on the existing Direct Connect connections. D.Enable the Direct Connect SiteLink feature on the existing transit VIFS that are attached to theexisting Direct Connect gateway.
Answer: D
Explanation:
Question # 24
A company needs to protect against potential botnet command and control traffic from any AmazonEC2 instances that is in in the companys AWS Environment.Which solution will meet these requirements?
A.Use AWS Shield Advanced. Activate Shield Advanced protections on the EC2 instances to filter andblock botnet traffic. B.Use Amazon Route 53 Resolver DNS Firewall. Add a rule to a rule group to use theAWSManagedDomainsBotnetCommandandControl managed domain list with an action to blockbotnet traffic C.Use AWS WAF Bot Control. Configure a managed rule group that uses an AWS managed rule set toblock botnet traffic. C.Use AWS WAF Bot Control. Configure a managed rule group that uses an AWS managed rule set toblock botnet traffic.
Answer: B
Explanation:
Question # 25
A company has deployed an application in which the front end of the application communicates withthe backend instances through a Network Load Balancer (NLB) in the same VPC. The application ishighly available across two Availability Zones. The company wants to limit the amount of traffic thattravels across the Availability Zones. Traffic from the front end of the application must stay in thesame Availability Zone unless there is no healthy target in that Availability Zone behind the NLB. Ifthere is no healthy target in the same Availability Zone, traffic must be sent to the other AvailabilityZone.Which solution will meet these requirements
A.Create a private hosted zone with weighted routing for each Availability Zone. Point the primaryrecord to the local Availability Zone NLB DNS record. Point the secondary record to the Regional NLBDNS record. Configure the front end of the application to perform DNS lookups on the local privatehosted zone records. B.Turn off cross-zone load balancing on the NLB. Configure the front end of the application toperform DNS lookups on the local Availability Zone NLB DNS record. C.Create a private hosted zone. Create a failover record for each Availability Zone. For eachfailover record, point the primary record to the local Availability Zone NLB DNS record and pointthe secondary record to the Regional NLB DNS record. Configure the front end of the application toperform DNS lookups on the local private hosted zone records. D.Enable sticky sessions (session affinity) so that the NLB can bind a users session to targets in thesame Availability Zone.
Answer: B
Explanation:
Feedback That Matters: Reviews of Our Amazon ANS-C01 Dumps
Olivia SeidelAug 14, 2026
Complex topics like hybrid connectivity, route propagation, and multi-VPC design were covered by MyCertsHub's practice questions. When I walked into the ANS-C01 exam, I felt well prepared.
Troy PerezAug 13, 2026
I scored 84% on ANS-C01, and a lot of credit goes to the scenario-based practice sets from MyCertsHub. Their focus on actual obstacles in networking made all the difference.
Nico WalkerAug 13, 2026
MyCertsHub nailed the ANS-C01 exam with case-based questions. The exam has a lot of practical questions. Instead of just memorizing terms, it helped me comprehend AWS network design best practices.
Lucas RobertsonAug 12, 2026
The way MyCertsHub explained each question, not just the answer but also the why, was something I appreciated. Helped a lot on tricky topics like Direct Connect and Transit Gateway integration.
Padmini PrakashAug 12, 2026
I’ve taken several AWS certs before, but ANS-C01 was the most detailed. I was able to pass with confidence thanks to MyCertsHub's updated dumps and advanced practice tests.
Olivia Seidel
Troy Perez
Lucas Robertson
Padmini Prakash