Courseiva
← Back to AWS Certified Advanced Networking Specialty ANS-C01 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise AWS Certified Advanced Networking Specialty ANS-C01 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
ANS-C01
exam code
Amazon Web Services
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related ANS-C01 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Network Management and Operations practice questions

Practise ANS-C01 questions linked to Network Management and Operations.

Network Security, Compliance and Governance practice questions

Targeted ANS-C01 practice covering Network Security, Compliance and Governance.

Network Design practice questions

Work through ANS-C01 questions on Network Design.

Network Implementation practice questions

Sharpen your ANS-C01 knowledge of Network Implementation.

ANS-C01 fundamentals practice questions

Targeted ANS-C01 practice covering ANS-C01 fundamentals.

ANS-C01 scenario practice questions

Sharpen your ANS-C01 knowledge of ANS-C01 scenario.

ANS-C01 troubleshooting practice questions

Sharpen your ANS-C01 knowledge of ANS-C01 troubleshooting.

Practice set

Practice scenarios

Question 1mediummultiple choice
Full question →

A network engineer is monitoring a Direct Connect connection. The exhibit shows CloudWatch metric data for the ConnectionState metric. The engineer sees that the average value is 0.0 for most of the day. What does this indicate?

Network Topology
$ aws cloudwatch get-metric-statisticsnamespace AWS/DXmetric-name ConnectionStatedimensions Name=ConnectionIdstatistics Averageperiod 300start-time 2023-01-01T00:00:00Zend-time 2023-01-02T00:00:00ZRefer to the exhibit.```"Label": "ConnectionState","Datapoints": ["Timestamp": "2023-01-01T00:00:00Z","Average": 0.0},"Timestamp": "2023-01-01T01:00:00Z","Timestamp": "2023-01-01T02:00:00Z","Average": 1.0...
Question 2easymultiple choice
Full question →

Refer to the exhibit. A flow log record shows ACCEPT for traffic from 10.0.1.5 to 10.0.2.10 on port 443. Which AWS service is most likely the destination?

Exhibit

Refer to the exhibit.

VPC Flow Logs record:
2 123456789010 eni-12345 10.0.1.5 10.0.2.10 443 34567 6 25 7500 1620140761 1620140821 ACCEPT OK
Question 3hardmultiple choice
Review the full subnetting walkthrough →

A network engineer has created a gateway VPC endpoint for S3 as shown in the exhibit. The endpoint is associated with route table rtb-12345678. An EC2 instance in a subnet that uses route table rtb-12345678 tries to download an object from my-bucket. The request fails with an access denied error. Which change should the engineer make to resolve the issue?

Network Topology
$ aws ec2 describe-vpc-endpointsvpc-endpoint-ids vpce-12345678Refer to the exhibit.Exhibit (AWS CLI output):"VpcEndpoints": ["VpcEndpointId": "vpce-12345678","VpcEndpointType": "Gateway","ServiceName": "com.amazonaws.us-east-1.s3","VpcId": "vpc-0a1b2c3d4e5f6g7h8","RouteTableIds": ["rtb-12345678"],"PolicyDocument": {"Version": "2012-10-17","Statement": ["Effect": "Allow","Principal": "*","Action": ["s3:GetObject"],"Resource": ["arn:aws:s3:::my-bucket/*"],"Condition": {"StringEquals": {"aws:SourceVpc": "vpc-0a1b2c3d4e5f6g7h8"},"CreationTimestamp": "2023-01-01T00:00:00Z"
Question 4hardmultiple choice
Read the full VPN explanation →

A network engineer is troubleshooting a VPN connection between an on-premises network (172.16.0.0/16) and an AWS VPC (10.0.0.0/16). The VPN status is 'available' but traffic is not passing. The engineer runs the command shown in the exhibit. What is the most likely cause of the issue?

Network Topology
$ aws ec2 describe-vpn-connectionsvpn-connection-ids vpn-12345678Refer to the exhibit.```"VpnConnections": ["VpnConnectionId": "vpn-12345678","State": "available","CustomerGatewayConfiguration": "...","Type": "ipsec.1","CustomerGatewayId": "cgw-12345678","VpnGatewayId": "vgw-12345678","Options": {"TunnelOptions": ["OutsideIpAddress": "203.0.113.1","TunnelInsideCidr": "169.254.10.0/30"},"OutsideIpAddress": "203.0.113.2","TunnelInsideCidr": "169.254.10.4/30""Routes": ["DestinationCidrBlock": "172.16.0.0/16","Source": "static","State": "available"
Question 5hardmultiple choice
Read the full DNS explanation →

A company has created a VPC Interface Endpoint for Amazon ECR (Docker registry API) as shown in the exhibit. However, an EC2 instance in the same VPC is unable to authenticate with the ECR registry using the private DNS name. What is the most likely cause?

Network Topology
$ aws ec2 describe-vpc-endpointsvpc-endpoint-ids vpce-12345678Refer to the exhibit.```"VpcEndpoints": ["VpcEndpointId": "vpce-12345678","VpcEndpointType": "Interface","ServiceName": "com.amazonaws.us-east-1.ecr.dkr","State": "available","SubnetIds": ["subnet-aaa", "subnet-bbb"],"NetworkInterfaceIds": ["eni-1111", "eni-2222"],"PrivateDnsEnabled": false
Question 6easymultiple choice
Full question →

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. What is the effect of the policy?

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}
```
Question 7mediummultiple choice
Full question →

Refer to the exhibit. A security engineer applies this SCP to an AWS account. What is the effect of this policy?

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
Question 8hardmultiple choice
Read the full NAT/PAT explanation →

Refer to the exhibit. A network engineer created a NAT gateway in a public subnet, but its state shows 'failed'. What is the most likely cause?

Network Topology
$ aws ec2 describe-nat-gatewaysregion us-east-1Refer to the exhibit.```"NatGateways": ["NatGatewayId": "nat-0a1b2c3d4e5f6g7h8","State": "failed","SubnetId": "subnet-12345678","VpcId": "vpc-12345678","CreateTime": "2023-01-01T00:00:00.000Z","DeleteTime": null,"NatGatewayAddresses": ["AllocationId": "eipalloc-12345678","NetworkInterfaceId": "eni-12345678","PrivateIp": "10.0.1.10","PublicIp": "203.0.113.10"
Question 9mediummulti select
Full question →

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Question 10hardmultiple choice
Full question →

Refer to the exhibit. An AWS administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile is associated with an IAM role that has the above trust policy. The S3 bucket policy allows s3:GetObject only for the role's ARN. What is the most likely cause of the access failure?

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
Question 11hardmultiple choice
Full question →

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

Exhibit

Refer to the exhibit.

IAM policy JSON:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpcPeeringConnection",
        "ec2:AcceptVpcPeeringConnection",
        "ec2:DeleteVpcPeeringConnection"
      ],
      "Resource": "*"
    }
  ]
}
Question 12hardmultiple choice
Full question →

Refer to the exhibit. A Lambda function is attached to a VPC using the network interface eni-1234567890abcdef0. The Lambda function needs to send traffic to an on-premises server via a Direct Connect connection. The traffic is failing. Which setting on the network interface is most likely causing the issue?

Network Topology
$ aws ec2 describe-network-interfacesnetwork-interface-ids eni-1234567890abcdef0Refer to the exhibit.```"NetworkInterfaces": ["NetworkInterfaceId": "eni-1234567890abcdef0","Description": "AWS Lambda VPC attachment","PrivateIpAddresses": [{"PrivateIpAddress": "10.0.1.10", "Primary": true},{"PrivateIpAddress": "10.0.1.11", "Primary": false}],"Groups": [{"GroupId": "sg-12345678", "GroupName": "lambda-sg"}"SubnetId": "subnet-12345678","VpcId": "vpc-12345678","SourceDestCheck": true
Question 13easymultiple choice
Full question →

Based on the output, which of the following is true?

Exhibit

Refer to the exhibit. The following is an AWS CLI command output:

{
    "DirectConnectGateway": {
        "directConnectGatewayId": "dxgw-1234567890abcdef0",
        "directConnectGatewayName": "My-DXGW",
        "amazonSideAsn": 64512,
        "ownerAccount": "123456789012",
        "state": "available"
    }
}
Question 14hardmultiple choice
Read the full VPN explanation →

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

Question 15mediummultiple choice
Full question →

Refer to the exhibit. A network engineer is creating an IAM policy to allow a user to manage VPC Peering connections. The user reports that they cannot delete a VPC Peering connection. What should the engineer add to the policy?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpcPeeringConnection",
        "ec2:AcceptVpcPeeringConnection"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:DescribeVpcPeeringConnections",
      "Resource": "*"
    }
  ]
}
```

These ANS-C01 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style ANS-C01 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.