Courseiva
← Back to AWS Certified Advanced Networking Specialty ANS-C01 questions

Scenario-based practice

Hard Difficulty Questions

Practise AWS Certified Advanced Networking Specialty ANS-C01 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
ANS-C01
exam code
Amazon Web Services
vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related ANS-C01 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Network Management and Operations practice questions

Practise ANS-C01 questions linked to Network Management and Operations.

Network Security, Compliance and Governance practice questions

Targeted ANS-C01 practice covering Network Security, Compliance and Governance.

Network Design practice questions

Work through ANS-C01 questions on Network Design.

Network Implementation practice questions

Sharpen your ANS-C01 knowledge of Network Implementation.

ANS-C01 fundamentals practice questions

Targeted ANS-C01 practice covering ANS-C01 fundamentals.

ANS-C01 scenario practice questions

Sharpen your ANS-C01 knowledge of ANS-C01 scenario.

ANS-C01 troubleshooting practice questions

Sharpen your ANS-C01 knowledge of ANS-C01 troubleshooting.

Practice set

Practice scenarios

Question 1hardmulti select
Full question →

Which THREE of the following are valid considerations when designing a multi-Region active-active application using AWS Global Accelerator?

Question 2hardmulti select
Full question →

Which THREE factors should be considered when designing a VPC for a multi-tier application that requires high availability and security? (Choose three.)

Question 3hardmultiple choice
Review the full subnetting walkthrough →

A company has deployed an application in a VPC with public and private subnets. The application uses an Amazon RDS for MySQL database in a private subnet. To meet security requirements, the database must not be accessible from the internet. The application team needs to connect to the database for maintenance using SSH over a bastion host. Which architecture is the most secure?

Question 4hardmultiple choice
Full question →

A company is designing a network architecture for a critical application that requires high availability and low latency. The application will be deployed on EC2 instances in an Auto Scaling group across three Availability Zones in a single region. The instances will communicate with an Amazon RDS database. Which configuration will provide the MOST resilient and performant network connectivity?

Question 5hardmultiple choice
Full question →

A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?

Exhibit

Refer to the exhibit.

Resource Policy:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::example-bucket/confidential/*",
      "Condition": {
        "StringEquals": {
          "s3:ExistingObjectTag/classification": "public"
        }
      }
    }
  ]
}
Question 6hardmulti select
Read the full NAT/PAT explanation →

A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?

Question 7hardmulti select
Review the full subnetting walkthrough →

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team observes that traffic between two VPCs (VPC A and VPC B) is not being forwarded correctly. The transit gateway route table is configured with static routes for the VPC CIDRs. Which THREE steps should the engineer take to troubleshoot this issue? (Choose THREE.)

Question 8hardmultiple choice
Review the full subnetting walkthrough →

A network engineer has created a gateway VPC endpoint for S3 as shown in the exhibit. The endpoint is associated with route table rtb-12345678. An EC2 instance in a subnet that uses route table rtb-12345678 tries to download an object from my-bucket. The request fails with an access denied error. Which change should the engineer make to resolve the issue?

Network Topology
$ aws ec2 describe-vpc-endpointsvpc-endpoint-ids vpce-12345678Refer to the exhibit.Exhibit (AWS CLI output):"VpcEndpoints": ["VpcEndpointId": "vpce-12345678","VpcEndpointType": "Gateway","ServiceName": "com.amazonaws.us-east-1.s3","VpcId": "vpc-0a1b2c3d4e5f6g7h8","RouteTableIds": ["rtb-12345678"],"PolicyDocument": {"Version": "2012-10-17","Statement": ["Effect": "Allow","Principal": "*","Action": ["s3:GetObject"],"Resource": ["arn:aws:s3:::my-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-0a1b2c3d4e5f6g7h8"},"CreationTimestamp": "2023-01-01T00:00:00Z"
Question 9hardmultiple choice
Full question →

A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?

Question 10hardmultiple choice
Study the full multicast explanation →

A company is migrating a legacy on-premises application to AWS. The application requires multicast traffic between instances within a VPC. The network engineer must design a solution that supports multicast without modifying the application. Which AWS service or feature should be used?

Question 11hardmultiple choice
Read the full VPN explanation →

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Network Topology
$ aws ec2 describe-vpn-connectionsvpn-connection-ids vpn-12345678Refer to the exhibit.```"VpnConnections": ["VpnConnectionId": "vpn-12345678","State": "available","CustomerGatewayConfiguration": "...","Type": "ipsec.1","CustomerGatewayId": "cgw-12345678","VpnGatewayId": "vgw-12345678","Options": {"TunnelOptions": ["OutsideIpAddress": "203.0.113.1","TunnelInsideCidr": "169.254.10.0/30"},"OutsideIpAddress": "203.0.113.2","TunnelInsideCidr": "169.254.10.4/30""Routes": ["DestinationCidrBlock": "172.16.0.0/16","Source": "static","State": "available"
Question 12hardmulti select
Review the full subnetting walkthrough →

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

Question 13hardmultiple choice
Review the full subnetting walkthrough →

A company has a VPC with a CIDR of 10.0.0.0/16 and uses AWS Direct Connect with a private VIF to connect to on-premises. The on-premises network uses 10.0.0.0/8. The company wants to access an AWS service (e.g., S3) privately from the VPC without using public endpoints. Which solution avoids IP overlap and meets the requirement?

Question 14hardmultiple choice
Full question →

A company is designing a network architecture for a critical application that requires sub-millisecond latency between EC2 instances in the same placement group. The instances will be launched in a single Availability Zone in us-east-1. Which combination of features should be used to achieve the lowest latency?

Question 15hardmultiple choice
Read the full NAT/PAT explanation →

A company is running a latency-sensitive application in a VPC with a public subnet and a private subnet. The application in the private subnet needs to access an Amazon S3 bucket in the same region. The company wants to minimize latency and avoid using a NAT gateway. Which solution meets these requirements?

Question 16hardmultiple choice
Read the full DNS explanation →

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Network Topology
$ aws ec2 describe-vpc-endpointsvpc-endpoint-ids vpce-12345678Refer to the exhibit.```"VpcEndpoints": ["VpcEndpointId": "vpce-12345678","VpcEndpointType": "Interface","ServiceName": "com.amazonaws.us-east-1.ecr.dkr","State": "available","SubnetIds": ["subnet-aaa", "subnet-bbb"],"NetworkInterfaceIds": ["eni-1111", "eni-2222"],"PrivateDnsEnabled": false
Question 17hardmultiple choice
Review the full routing breakdown →

A network engineer is setting up a cross-account Route 53 Resolver rule association. The engineer creates the above resource-based policy on a resolver rule in account 111111111111. The engineer then tries to associate the rule from account 222222222222 but receives an access denied error. What is the MOST likely reason for the failure?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:root"
      },
      "Action": [
        "route53resolver:AssociateResolverRule",
        "route53resolver:DisassociateResolverRule"
      ],
      "Resource": "*"
    }
  ]
}
```
Question 18hardmulti select
Full question →

A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)

Question 19hardmultiple choice
Open the full BGP breakdown →

A company is migrating its on-premises data center to AWS. As part of the migration, they need to establish connectivity between their on-premises network (10.0.0.0/8) and multiple VPCs in a single region. They are using AWS Transit Gateway with a Direct Connect gateway. They have two Direct Connect connections, each with a private virtual interface (VIF) to the Direct Connect gateway. The on-premises routers are configured with BGP and are advertising 10.0.0.0/8. The Transit Gateway has three VPC attachments: VPC1 (10.1.0.0/16), VPC2 (10.2.0.0/16), and VPC3 (10.3.0.0/16). All VPC attachments are in the same Transit Gateway route table, which also includes the Direct Connect gateway attachment. Initially, all VPCs can communicate with on-premises. After a maintenance window, the network team adds a new on-premises subnet (10.4.0.0/16) and updates the BGP advertisement to include 10.4.0.0/16. However, after the change, instances in VPC3 can no longer reach on-premises resources in any subnet, while VPC1 and VPC2 can still communicate with all on-premises subnets including the new one. The network engineer checks the Transit Gateway route table and sees that the route for 10.0.0.0/8 is present, pointing to the Direct Connect gateway attachment. What is the MOST likely cause of the issue?

Question 20hardmultiple choice
Full question →

A company has a Direct Connect connection with a private VIF and a public VIF. The private VIF is used to access VPC resources, and the public VIF is used to access AWS public services. Recently, the company enabled AWS Global Accelerator for its application. The network team notices that traffic to the application via Global Accelerator is not using the Direct Connect connection but is going over the internet. What should the team do to ensure traffic uses the Direct Connect public VIF?

These ANS-C01 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style ANS-C01 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.