Skip to main content

Practice exam · AWS

AWS Advanced Networking Specialty ANS-C01 practice exam

65
questions
170
minutes
75%
to pass the practice exam
143
questions in the bank

Short answer

The AWS Advanced Networking Specialty ANS-C01 practice exam has 65 questions in 170 minutes, with a 75% passing mark, as configured here. The fastest way to know whether you are ready is to sit a full exam on the clock and read your score by domain, not only the total.

Domains covered

  • Network Implementation
  • Network Design
  • Network Management and Operation
  • Network Security, Compliance, and Governance

Sample questions, with explanations

Three questions from the bank, open to read.

Question 1 · Network Implementation

A media company serves a video portal from Application Load Balancers in us-east-1 and eu-west-1. They want users to be sent to the Region that gives them the lowest network latency, but they also need traffic to stop flowing to any Region whose ALB is failing health checks. Each Region currently has a single alias record pointing at its ALB. What Route 53 configuration meets both requirements with the least operational overhead?

  1. Create a single weighted record set with 50/50 weights to each ALB and enable health checks on both records.
  2. Create geolocation records mapping continents to each Region, and attach health checks so unhealthy continents fail over.
  3. Create simple alias records for each ALB in the same record name and let Route 53 round-robin between them based on client latency.
  4. Create latency alias records for each Region pointing to the regional ALB, and associate a Route 53 health check (or rely on the alias 'Evaluate Target Health' setting) so that an unhealthy Region is excluded from latency selection. ✓ (correct)
Why this is correct

Latency-based routing is the policy that selects the Region offering the lowest latency to the user, which is exactly the stated goal; combining it with health checks (or the alias 'Evaluate Target Health' flag on the ALB alias) removes an unhealthy Region from the candidate set, satisfying both requirements with native behavior and no extra automation. Mapping continents to Regions describes geolocation routing, which routes by the user's geographic location rather than measured latency, so a user physically near a slower-responding endpoint would not get the lowest-latency Region. A 50/50 weighted record distributes traffic by fixed proportion regardless of where the user is, so it ignores latency entirely. Simple records do not support attaching health checks per value and do not perform latency selection; Route 53 returns all values in random order to the client, which is not latency-based and cannot exclude an unhealthy endpoint.

Question 2 · Network Design

A retailer needs to connect a new branch office to its AWS environment within 48 hours to support a seasonal launch. Traffic volume is light (under 200 Mbps), but the data is sensitive and must be encrypted in transit. The branch has only a standard business internet connection and no presence at any Direct Connect location. Cost should be minimized and the solution should be operational quickly. Which connectivity option fits best?

  1. Order a Direct Connect hosted connection through a partner and request a private VIF for the branch.
  2. Deploy a Site-to-Site VPN but run it over a newly ordered Direct Connect public VIF for guaranteed bandwidth.
  3. Configure a Site-to-Site VPN with two tunnels to a Transit Gateway (or virtual private gateway), using the existing internet connection. ✓ (correct)
  4. Order a 1 Gbps Direct Connect dedicated connection and configure MACsec for encryption.
Why this is correct

A Site-to-Site VPN over the existing internet connection can be stood up in hours, provides IPsec encryption for the sensitive data, offers dual-tunnel redundancy, and is the lowest-cost option for light traffic, which exactly matches the 48-hour and under-200 Mbps requirements. A hosted connection requires partner provisioning and physical cross-connects that typically take days to weeks, so it cannot meet the 48-hour deadline. A dedicated connection with MACsec requires the branch to have a presence at a Direct Connect location and physical port turn-up that takes weeks, and MACsec only protects the direct connection itself, not traffic across the internet from a branch with no facility presence. Running a VPN over a Direct Connect public VIF still requires a Direct Connect connection to exist first, so it inherits the same multi-week provisioning delay and misses the deadline.

Question 3 · Network Management and Operation

A platform team runs a fleet of EC2 instances behind an internal Network Load Balancer in a single VPC. After a recent application deployment, instances intermittently fail to retrieve temporary IAM credentials from the Instance Metadata Service at 169.254.169.254, and the team also reports that internal name resolution against the VPC's Amazon-provided DNS occasionally times out. The network engineer enabled VPC Flow Logs (default fields) for the entire VPC hoping to see the metadata and DNS requests, but neither type of request appears in the log records. They need to capture and inspect the actual packets for these requests to diagnose the failure. Which approach will let the team see this traffic?

  1. Switch the Flow Logs destination from CloudWatch Logs to an S3 bucket with Parquet formatting so the previously suppressed metadata and DNS records are written out
  2. Add a custom Flow Logs format that includes the pkt-srcaddr and pkt-dstaddr fields so that metadata-service and Amazon DNS traffic begin to appear in the existing log group
  3. Enable Reachability Analyzer between the instances and 169.254.169.254 to capture the dropped metadata packets and surface the failed DNS queries
  4. Configure a VPC Traffic Mirroring session on the instances' elastic network interfaces with a mirror filter for the relevant traffic and forward the mirrored packets to a packet-analysis appliance, because Flow Logs do not record metadata-service or Amazon DNS traffic ✓ (correct)
Why this is correct

VPC Flow Logs, regardless of field set or destination, deliberately omit several categories of traffic, including traffic to and from 169.254.169.254 (Instance Metadata Service) and traffic to the Amazon-provided DNS server. Because the missing records are excluded by design rather than by configuration, the only way to actually observe the packets is to copy them off the wire. The correct choice uses VPC Traffic Mirroring on the ENIs with a mirror filter and forwards full packet copies to an out-of-band analysis tool, which captures exactly these flows for deep inspection. Adding pkt-srcaddr/pkt-dstaddr custom fields is wrong because changing the field schema never lifts the underlying capture exclusions; those addresses still never produce records. Reachability Analyzer is a static configuration-reasoning tool that evaluates whether a path could work based on route tables, security groups, and NACLs; it does not capture live packets or observe runtime DNS timeouts. Changing the Flow Logs destination to S3 with Parquet only alters where and how records are stored, not which traffic is eligible to be logged, so the suppressed metadata and DNS traffic still never appear.

Take the full practice exam

  • 65 questions drawn from the bank, with a 170-minute timer
  • Score by domain and a review of every question
  • An AI tutor to talk through each question you miss
  • What you miss feeds your study plan
Start the practice examStudy the path first

Independent, unofficial practice exam. AWS and the exam name are trademarks of their owners; UpSkillScore is not affiliated with them. Format and passing mark are the exam's configuration in UpSkillScore, not an official statement.

Frequently asked questions

How many questions does the AWS Advanced Networking Specialty ANS-C01 practice exam have?

It has 65 questions and a 170-minute limit. The passing mark of the practice exam is 75%.

Is this the official AWS Advanced Networking Specialty ANS-C01 exam?

No. It is an independent practice exam built to match the structure of the real one. It does not replace the official exam.

Do I need an account to take it?

You can read the structure and sample questions without an account. Taking the full timed exam, scoring by domain and the AI tutor need one.