AWS Certified Advanced Networking Specialty ANS-C01 practice test

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The security team needs to centralize inspection of all traffic between VPCs using a third-party firewall appliance in a shared services VPC. What is the most scalable and highly available design?

Trap 1: Use VPC peering to connect all VPCs to the shared services VPC and…

VPC peering is not transitive and does not scale well for many VPCs.

Trap 2: Attach all VPCs to a Transit Gateway and configure a Network Load…

Network Load Balancer does not support packet inspection; a Gateway Load Balancer is needed.

Trap 3: Attach all VPCs to a Transit Gateway and use a single firewall…

Single firewall instance is not highly available.

A
Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.
Why wrong: VPC peering is not transitive and does not scale well for many VPCs.
B
Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.
This design is scalable and highly available, with Gateway Load Balancer for inspection and Transit Gateway for routing.
C
Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.
Why wrong: Network Load Balancer does not support packet inspection; a Gateway Load Balancer is needed.
D
Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.
Why wrong: Single firewall instance is not highly available.

Question 2easymultiple choice

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Trap 1: Use a public virtual interface (VIF) and route traffic through a…

Public VIF does not encrypt traffic.

Trap 2: Use a private virtual interface (VIF) and enable encryption on the…

Direct Connect does not provide encryption inherently.

Trap 3: Use a private VIF and enable TLS on all applications.

TLS is application-layer, not network-layer encryption.

A
Use a public virtual interface (VIF) and route traffic through a NAT gateway.
Why wrong: Public VIF does not encrypt traffic.
B
Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.
IPsec provides encryption over the Direct Connect link.
C
Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.
Why wrong: Direct Connect does not provide encryption inherently.
D
Use a private VIF and enable TLS on all applications.
Why wrong: TLS is application-layer, not network-layer encryption.

Read the full VPN explanation →

Question 3hardmultiple choice

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?

Trap 1: Create a VPC peering connection between VPC A and VPC B, and attach…

VPC peering does not support transitive routing; traffic would go directly.

Trap 2: Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and…

PrivateLink is for accessing services, not for routing VPC-to-VPC traffic.

Trap 3: Deploy AWS Network Firewall in each VPC and configure VPC route…

This is a valid approach but does not use Transit Gateway as specified.

A
Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.
This design uses Transit Gateway route tables to force traffic through the inspection VPC.
B
Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.
Why wrong: VPC peering does not support transitive routing; traffic would go directly.
C
Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.
Why wrong: PrivateLink is for accessing services, not for routing VPC-to-VPC traffic.
D
Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.
Why wrong: This is a valid approach but does not use Transit Gateway as specified.

Read the full VPN explanation →

Question 4hardmultiple choice

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

Trap 1: Change the VPN connection from static to dynamic routing.

Routing type does not affect latency.

Trap 2: Enable BGP route propagation on the transit VPC's route tables.

Route propagation is likely already enabled.

Trap 3: Deploy a new transit VPC in eu-west-1.

Adding another transit VPC increases complexity.

A
Change the VPN connection from static to dynamic routing.
Why wrong: Routing type does not affect latency.
B
Enable jumbo frames on the transit VPC's EC2-based virtual appliances.
Jumbo frames reduce overhead and improve throughput for large packets.
C
Enable BGP route propagation on the transit VPC's route tables.
Why wrong: Route propagation is likely already enabled.
D
Deploy a new transit VPC in eu-west-1.
Why wrong: Adding another transit VPC increases complexity.

Question 5easymultiple choice

A company is designing a multi-VPC architecture in the same region. The VPCs need to communicate with each other using private IP addresses. The company must minimize cost and operational overhead. Which solution should the company use?

Trap 1: Set up AWS Site-to-Site VPN connections between each VPC.

VPN is more expensive and complex than peering.

Trap 2: Use ClassicLink to connect the VPCs.

ClassicLink is for EC2-Classic, not VPC-to-VPC.

Trap 3: Create a Transit Gateway and attach all VPCs.

Transit Gateway is more expensive and complex than peering for few VPCs.

A
Set up AWS Site-to-Site VPN connections between each VPC.
Why wrong: VPN is more expensive and complex than peering.
B
Use ClassicLink to connect the VPCs.
Why wrong: ClassicLink is for EC2-Classic, not VPC-to-VPC.
C
Create VPC peering connections between each pair of VPCs.
VPC peering is simple, low-cost, and uses private IPs.
D
Create a Transit Gateway and attach all VPCs.
Why wrong: Transit Gateway is more expensive and complex than peering for few VPCs.

Question 6mediummultiple choice

A company is deploying an application that requires low-latency communication between EC2 instances in two different AWS Regions. The application traffic is latency-sensitive and the company wants to minimize jitter. Which network design provides the lowest and most consistent latency?

Trap 1: Create a VPC peering connection between the two VPCs and route…

VPC peering does not support inter-region peering? Actually it does, but traffic traverses the AWS backbone, but still may not be optimized for latency. Global Accelerator is better.

Trap 2: Use internet gateways and route traffic over the public internet…

Public internet introduces variable latency and jitter.

Trap 3: Use a Site-to-Site VPN connection between the two VPCs over the…

VPN adds latency due to encryption and uses the public internet which is variable.

A
Create a VPC peering connection between the two VPCs and route traffic through the peering connection.
Why wrong: VPC peering does not support inter-region peering? Actually it does, but traffic traverses the AWS backbone, but still may not be optimized for latency. Global Accelerator is better.
B
Use internet gateways and route traffic over the public internet between the instances.
Why wrong: Public internet introduces variable latency and jitter.
C
Use a Site-to-Site VPN connection between the two VPCs over the internet.
Why wrong: VPN adds latency due to encryption and uses the public internet which is variable.
D
Deploy an AWS Global Accelerator with endpoints in both Regions and use the accelerator's static IP addresses for communication.
Global Accelerator uses the AWS global network to route traffic over optimized paths, reducing latency and jitter.