AWS Certified Advanced Networking - Specialty ANS-C01

By Amazon · Browse Mode
About the Exam

This AWS Specialty exam is intended for individuals who perform an AWS networking specialist role. It validates the ability to design, implement, manage, and secure AWS and hybrid network architectures at scale. AWS describes the target candidate as having five or more years of networking experience, including at least two years of cloud and hybrid networking experience. AWS states the exam is being retired on August 25, 2026.

Exam Topics

  • Network Design30%
  • Network Implementation26%
  • Network Management and Operation20%
  • Network Security, Compliance, and Governance24%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated September 7, 2026 at 3:27 PM

Topic filter
Retired questions
Question sort
Questions per page

QuestionQ1

Network Design

An insurance company plans to migrate workloads from its on-premises data center to the AWS Cloud. The company needs end-to-end domain name resolution, including bi-directional DNS resolution between AWS and the existing on-premises environments. The workloads will be migrated into multiple VPCs, have dependencies on one another, and will not all migrate at the same time.

Which solution fulfills these requirements?

Explanation

Route 53 Resolver inbound endpoints allow on-premises DNS resolvers to forward AWS private-domain queries into AWS, while outbound endpoints and Resolver forwarding rules allow VPC workloads to resolve on-premises domains. A private hosted zone must be associated with the VPC that hosts the inbound endpoint for that endpoint to resolve records in the zone. Sharing Resolver rules through AWS Resource Access Manager lets the application VPCs use the centralized outbound DNS-forwarding configuration.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Network Management and Operation

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company recently had a network security breach. A network engineer needs to collect and analyze logs containing the client IP address, target IP address, target port, and user agent for every user who accesses the application.

What is the MOST operationally efficient solution that fulfills these requirements?

Explanation

Application Load Balancer access logs are delivered to an Amazon S3 bucket and include the client:port, target:port, and user_agent fields. Amazon Athena can query those logs directly in Amazon S3 using SQL, avoiding manual file downloads and avoiding the operational overhead of an unsupported direct ALB-to-Kinesis ingestion design.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Network Security, Compliance, and Governance

A company uses AWS Network Firewall to protect outbound traffic for multiple VPCs in the same AWS account. Each VPC contains Amazon EC2 instances that host the company’s applications. Every EC2 instance is tagged with the name of the application that it hosts. The EC2 instances are in Auto Scaling groups.

A Network Firewall stateful rule group must stay current even when an Auto Scaling group launches or terminates EC2 instances.

Which solution meets this requirement with the LEAST implementation and administrative effort?

Explanation

AWS Network Firewall tag-based resource groups can group EC2 instances by their application-name tag and be referenced by a stateful rule group. Network Firewall automatically updates the rule group with the IP addresses of matching resources as instances are added, changed, or removed, so Auto Scaling lifecycle changes require no custom update automation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Network Design

A company is migrating applications from a data center to AWS. Many applications will need to exchange data with the company’s on-premises mainframe.

The company must achieve transfer speeds of 4 Gbps to satisfy peak traffic demands. A network engineer must design a highly available solution that maximizes resiliency. The solution must withstand the loss of circuits or routers.

Which solution satisfies these requirements?

Explanation

AWS Direct Connect maximum resiliency uses separate connections that terminate on separate devices in more than one Direct Connect location, protecting against device, connectivity, and complete-location failures. Four 10-Gbps connections across two locations and two on-premises routers preserve far more than 4 Gbps of capacity after a circuit or router failure while maintaining redundancy at every layer.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Network Implementation

A company has an AWS environment containing multiple VPCs connected through a transit gateway. The company has chosen AWS Site-to-Site VPN to establish connectivity between its on-premises network and its AWS environment.

The company does not have a static public IP address for its on-premises network. A network engineer must implement a solution that initiates the VPN connection from the AWS side for traffic from the AWS environment to the on-premises network.

Which combination of steps should the network engineer take to establish VPN connectivity between the transit gateway and the on-premises network?

Choose three
Explanation

AWS-side IKE initiation is supported only for IKEv2. AWS also requires the public IP address of the customer gateway device to initiate IKE, so the customer gateway must specify its current external IP address even if that address is dynamic. Certificate-based Site-to-Site VPN authentication uses a private certificate from AWS Private Certificate Authority.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home