Free ANS-C01 mock test – Exam 2

AWS Certified Advanced Networking – Specialty (ANS-C01)

Free ANS-C01 practice exam for AWS Advanced Networking Specialty preparation.

Use this free AWS Certified Advanced Networking Specialty practice exam to review Transit Gateway, Direct Connect, hybrid DNS, Network Firewall, Cloud WAN, Route 53, WAF, IPv6, and advanced VPC networking.

10 exam-style questions Free ANS-C01 mock test Detailed option explanations No signup required

Start Practice Exam 2 below. Answer each question first, then use the explanations to review why each option is correct or incorrect.

AWS Certified Advanced Networking - Specialty (ANS-C01) Practice Exam 2

Free AWS Certified Advanced Networking Specialty ANS-C01 practice exam 2 with detailed explanations for every option.

1 / 10

Question

A company uses two Direct Connect connections at separate locations for production hybrid connectivity. The company needs high resilience and wants traffic to fail over automatically if one connection fails. Which design should the network engineer use?

Which option meets the requirement?

A. Create redundant Direct Connect connections at different locations, use BGP on private or transit virtual interfaces, and advertise the same prefixes with appropriate path preferences.

B. Use one Direct Connect connection and one internet gateway in the VPC as the backup path.

C. Configure static routes only and disable BGP to prevent route changes.

D. Use VPC peering between the two Direct Connect locations.

2 / 10

Question

A company has a centralized egress VPC with AWS Network Firewall. Private application subnets in many VPCs must send internet-bound traffic through inspection before reaching a NAT gateway and internet gateway. Which routing pattern is correct?

Which option meets the requirement?

A. Application VPC route tables send default traffic directly to their local internet gateways.

B. Application VPC route tables send default traffic to Transit Gateway; inspection VPC route tables steer traffic through firewall endpoints before NAT and internet egress.

C. All VPCs share a single NAT gateway through VPC peering without route-table changes.

D. Network Firewall endpoints are placed in the application subnets and bypass the egress VPC.

3 / 10

Question

A company uses AWS Cloud WAN with production and security segments. Production VPC attachments must be able to send internet-bound traffic to an inspection VPC in the security segment, but production VPCs must not communicate with each other. What should be configured?

Which option meets the requirement?

A. One flat Cloud WAN segment for every VPC attachment.

B. VPC peering between all production VPCs and the inspection VPC.

C. Cloud WAN segment actions and attachment policies that share only the required security segment routes into the production segment.

D. A public subnet in every production VPC with a local internet gateway route.

4 / 10

Question

A non-web application runs on on-premises servers and is exposed through an AWS load balancer over Direct Connect. The application must preserve the original client source IP address. Which load balancer type and target configuration should be used?

Which option meets the requirement?

A. Application Load Balancer with Lambda targets.

B. Classic Load Balancer with HTTP listeners only.

C. Gateway Load Balancer with a target group of Auto Scaling instances only.

D. Network Load Balancer with IP targets for the on-premises servers.

5 / 10

Question

A microservices platform runs in many AWS accounts. Each team owns a service VPC, and consumers in other accounts need private access to services without transitive routing or overlapping CIDR issues. Which AWS pattern should be used?

Which option meets the requirement?

A. Full-mesh VPC peering between every producer and consumer VPC.

B. AWS PrivateLink with endpoint services backed by Network Load Balancers and interface endpoints in consumer VPCs.

C. One shared NAT gateway for all service calls.

D. Public load balancers restricted only by hidden URLs.

6 / 10

Question

A company wants consistent web filtering rules for VPC internet egress across 50 AWS accounts in AWS Organizations. The network team plans to use AWS Network Firewall. How can the team centrally enforce the rule groups?

Which option meets the requirement?

A. Manually copy rule groups into every account with the console.

B. Use AWS WAF web ACLs attached to NAT gateways.

C. Use AWS Firewall Manager Network Firewall policies scoped to the organization accounts and OUs.

D. Use Route 53 Resolver query logs as an enforcement point for HTTP filtering.

7 / 10

Question

A public mobile banking application is IPv4-only today. The company wants to support IPv6 clients while keeping backend instances private and dual-stack ready. Which approach is appropriate?

Which option meets the requirement?

A. Use NAT gateways to translate all inbound IPv6 client traffic to private IPv4 instances.

B. Add an egress-only internet gateway and expect it to accept inbound IPv6 client traffic.

C. Create IPv6 addresses only on the database subnets and leave the application entry point IPv4-only.

D. Assign IPv6 CIDR blocks to the VPC and subnets, use dual-stack public entry points such as ALB or CloudFront, and update security controls for IPv6.

8 / 10

Question

A web application runs behind an ALB and CloudFront. The company must block common web exploits, inspect HTTP headers, and apply managed protections close to the edge. Which service should be associated with the CloudFront distribution?

Which option meets the requirement?

A. AWS Network Firewall stateful rule group.

B. AWS WAF web ACL with AWS Managed Rules.

C. VPC network ACLs on the ALB subnets only.

D. Route 53 Resolver DNS Firewall domain lists only.

9 / 10

Question

An application requires HTTPS with TLS certificates that use Elliptic Curve Cryptography. The application also needs stateful connections at Layer 4. Which front-end design is the best fit?

Which option meets the requirement?

A. Use an internet gateway with a certificate attached directly to the route table.

B. Use a NAT gateway with an ACM certificate.

C. Use a Network Load Balancer TLS listener with an ACM ECDSA certificate.

D. Use Route 53 health checks to terminate TLS.

10 / 10

Question

A network operations team wants to centrally manage a cloud networking environment while allowing application teams to deploy their own infrastructure. The teams must not be able to change shared routing and inspection controls. Which governance approach is most appropriate?

Which option meets the requirement?

A. Give every application team administrator access to the shared networking account.

B. Place all workloads and networking resources in one VPC so route changes are easier.

C. Use only resource tags to prevent changes to route tables and firewall policies.

D. Use separate AWS accounts and OUs, centralized networking accounts, AWS Organizations service control policies, and delegated network administration where supported.

Your score is

The average score is 0%

What Practice Exam 2 covers

Direct Connect resiliency, BGP communities, and transit VIFs
AWS Network Firewall, centralized egress, and Firewall Manager
Cloud WAN segments, attachment policies, and route sharing
PrivateLink, Network Load Balancers, and source IP preservation
IPv6 dual-stack design, WAF, CloudFront, and TLS security

Who should take this free mock test

Use this ANS-C01 practice exam if you are preparing for AWS Certified Advanced Networking – Specialty and want focused, free practice with detailed explanations.

Browse AWS practice exams Study AWS articles

FAQ

Is this ANS-C01 practice exam free?

Yes. This AWS Certified Advanced Networking Specialty mock test is free to open and retake.

Does this replace hands-on AWS practice?

No. Use it with hands-on labs for Transit Gateway, Direct Connect, Route 53 Resolver, Network Firewall, Cloud WAN, Global Accelerator, WAF, and VPC Flow Logs.

How should I review missed questions?

Read every option explanation, identify the AWS advanced networking pattern, and review the relevant service documentation before retaking the free practice exam.

Free AWS Advanced Networking Specialty Practice Exam 2 | ANS-C01 Mock Test

Free ANS-C01 practice exam for AWS Advanced Networking Specialty preparation.

Question

Correct Answer: A

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: C

Explanation

Question

Correct Answer: D

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: C

Explanation

Question

Correct Answer: D

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: C

Explanation

Question

Correct Answer: D

Explanation

What Practice Exam 2 covers

Who should take this free mock test

FAQ

Is this ANS-C01 practice exam free?

Does this replace hands-on AWS practice?

How should I review missed questions?

Leave a Reply Cancel reply