How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 13 Refer to the Exhibit Practice Questions scenario questions for the ANS-C01 exam, each with detailed explanations and wrong-answer analysis.

How should I approach ANS-C01 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Advanced Networking Specialty ANS-C01 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise AWS Certified Advanced Networking Specialty ANS-C01 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

ANS-C01

exam code

Amazon Web Services

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Read the full VPN explanation →

A global e-commerce company uses a hub-and-spoke network topology with a transit VPC in us-east-1. Each spoke VPC has an AWS Site-to-Site VPN connection to its respective on-premises office. Users report intermittent connectivity issues when accessing a web application hosted in a spoke VPC in eu-west-1 from an on-premises office in ap-southeast-1. The network engineer checks the VPN connection and finds it is up. Which design change would MOST likely resolve the issue?

A
Change the VPN connection from static to dynamic routing.
Why wrong: Routing type does not affect latency.
B
Enable jumbo frames on the transit VPC's EC2-based virtual appliances.
Jumbo frames reduce overhead and improve throughput for large packets.
C
Enable BGP route propagation on the transit VPC's route tables.
Why wrong: Route propagation is likely already enabled.
D
Deploy a new transit VPC in eu-west-1.
Why wrong: Adding another transit VPC increases complexity.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

A global e-commerce company is migrating to AWS and plans to use a hub-and-spoke topology with AWS Transit Gateway. The network team wants to ensure high availability for the connection between the hub VPC and the on-premises data center using AWS Direct Connect with multiple virtual interfaces (VIFs). They need to be able to fail over quickly with minimal packet loss. Which design should meet these requirements?

A
Provision one Direct Connect connection with a single private VIF, and enable BFD on the VIF to detect failures quickly.
Why wrong: A single VIF is a single point of failure; BFD only helps detect failures but does not provide redundancy.
B
Provision one Direct Connect connection with two private VIFs, and use a second Direct Connect connection as backup with a single VIF. Configure route tables to prefer the primary.
Why wrong: This design still has a single point of failure at the primary Direct Connect location and does not provide active-active load balancing.
C
Provision two Direct Connect connections, each with multiple private VIFs, and attach them to the same transit gateway. Use BFD to detect failures and rely on ECMP routing across the VIFs.
This provides active-active connectivity with fast failover via BFD, and ECMP allows load balancing across VIFs.
D
Provision two Direct Connect connections, each with a single private VIF, and use AWS Site-to-Site VPN as a backup for each.
Why wrong: While having two connections is good, using a single VIF per connection does not leverage ECMP, and VPN backup may have slower failover.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

A network engineer is troubleshooting an issue where an AWS Lambda function cannot create an Elastic Network Interface (ENI) in a VPC. The function has the IAM policy shown in the exhibit. Which statement explains why the function is failing?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:CreateNetworkInterface",
        "ec2:AttachNetworkInterface"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:CreateVpc",
      "Resource": "*"
    }
  ]
}
```

A
The policy denies the ec2:CreateVpc action which is required to create an ENI
Why wrong: Creating an ENI does not require the ec2:CreateVpc action, as the VPC already exists.
B
The policy allows ec2:DescribeInstances which conflicts with ENI creation
Why wrong: DescribeInstances is unrelated and does not cause conflicts.
C
The policy denies the ec2:CreateNetworkInterface action
Why wrong: The policy allows ec2:CreateNetworkInterface, so it is not denied.
D
The policy is missing the ec2:CreateNetworkInterfacePermission action
Lambda requires ec2:CreateNetworkInterfacePermission to create ENIs on behalf of the function; without it, the call fails.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:CreateNetworkInterface",
        "ec2:DescribeNetworkInterfaces",
        "ec2:AttachNetworkInterface"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpcEndpoint",
        "ec2:DescribeVpcEndpoints",
        "ec2:ModifyVpcEndpoint"
      ],
      "Resource": "*"
    }
  ]
}
```

A
Attach the ENI to the EC2 instance
Why wrong: Incorrect; the policy allows ec2:AttachNetworkInterface.
B
Create the VPC endpoint
Why wrong: Incorrect; the policy allows ec2:CreateVpcEndpoint.
C
Describe VPC endpoints
Why wrong: Incorrect; the policy allows ec2:DescribeVpcEndpoints.
D
Modify the VPC endpoint
Why wrong: Incorrect; the policy allows ec2:ModifyVpcEndpoint.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

Exhibit

Refer to the exhibit.

IAM policy JSON:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpcPeeringConnection",
        "ec2:AcceptVpcPeeringConnection",
        "ec2:DeleteVpcPeeringConnection"
      ],
      "Resource": "*"
    }
  ]
}

A
The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.
Why wrong: The action is allowed with Resource "*".
B
The policy must include a condition that the accepter VPC owner is the target account.
Without a condition, the peering request may be denied if the accepter account is not specified.
C
The user needs ec2:ModifyVpcPeeringConnectionOptions permission.
Why wrong: Not required for creation.
D
The user needs ec2:CreateVpcEndpoint permission.
Why wrong: VPC endpoints are not related to peering.

Full breakdown with real-world context →

Question 6hardmultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

Exhibit

Refer to the exhibit.

AWS CLI output:
{
    "Vpc": {
        "VpcId": "vpc-0123456789abcdef0",
        "CidrBlock": "10.0.0.0/16",
        "Ipv6CidrBlock": "2001:db8:1234:1a00::/56",
        "EnableDnsHostnames": true,
        "EnableDnsSupport": true
    },
    "Subnets": [
        {
            "SubnetId": "subnet-1a",
            "CidrBlock": "10.0.1.0/24",
            "AvailabilityZone": "us-east-1a",
            "MapPublicIpOnLaunch": false
        },
        {
            "SubnetId": "subnet-2a",
            "CidrBlock": "10.0.2.0/24",
            "AvailabilityZone": "us-east-1a",
            "MapPublicIpOnLaunch": true
        }
    ],
    "RouteTables": [
        {
            "RouteTableId": "rtb-main",
            "Associations": [{"SubnetId": "subnet-1a"}],
            "Routes": [
                {"DestinationCidrBlock": "10.0.0.0/16", "Target": "local"},
                {"DestinationCidrBlock": "0.0.0.0/0", "Target": "igw-12345"}
            ]
        },
        {
            "RouteTableId": "rtb-custom",
            "Associations": [{"SubnetId": "subnet-2a"}],
            "Routes": [
                {"DestinationCidrBlock": "10.0.0.0/16", "Target": "local"},
                {"DestinationCidrBlock": "0.0.0.0/0", "Target": "igw-12345"}
            ]
        }
    ]
}

A
The route table rtb-main does not have a default route to the internet gateway.
Why wrong: It does have a route to igw-12345.
B
The VPC does not have DNS hostnames enabled.
Why wrong: EnableDnsHostnames is true.
C
Subnet-1a does not assign public IP addresses automatically.
MapPublicIpOnLaunch is false, so instances lack public IPs.
D
Subnet-1a is not associated with any route table.
Why wrong: It is associated with rtb-main.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

Exhibit

Refer to the exhibit.

CloudFormation snippet:
Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: false
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MyVPC
      InternetGatewayId: !Ref InternetGateway
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref MyVPC
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref MyVPC
  PrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway
  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet
      RouteTableId: !Ref PrivateRouteTable
  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt ElasticIP.AllocationId
      SubnetId: !Ref PublicSubnet
  ElasticIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

A
The private subnet is not associated with any route table.
Why wrong: It is associated with PrivateRouteTable.
B
The NAT gateway does not support IPv6 traffic.
Why wrong: Patches are likely IPv4.
C
The private subnet does not have MapPublicIpOnLaunch set to true.
Why wrong: Private instances should not have public IPs.
D
The PrivateRoute resource references the NAT gateway before it is created.
Missing DependsOn causes a dependency issue.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

Based on the output, which of the following is true?

Exhibit

Refer to the exhibit. The following is an AWS CLI command output:

{
    "DirectConnectGateway": {
        "directConnectGatewayId": "dxgw-1234567890abcdef0",
        "directConnectGatewayName": "My-DXGW",
        "amazonSideAsn": 64512,
        "ownerAccount": "123456789012",
        "state": "available"
    }
}

A
The Direct Connect Gateway uses ASN 64512
The amazonSideAsn is set to 64512.
B
The Direct Connect Gateway is in a 'deleted' state
Why wrong: The state is 'available'.
C
The Direct Connect Gateway is a virtual private gateway
Why wrong: The ID format dxgw indicates a Direct Connect Gateway, not a virtual private gateway (vgw).
D
The Direct Connect Gateway is owned by a different account
Why wrong: The ownerAccount is the same as the account making the call.

Full breakdown with real-world context →

Question 9easymultiple choice

Review the full routing breakdown →

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

Network Topology

A
No instances in the VPC can resolve DNS records from the private hosted zone.
DNS support disabled means no DNS resolution via VPC.
B
Only instances in public subnets can resolve private hosted zone records.
Why wrong: DNS support disabled affects all instances.
C
The DHCP option set must be updated to provide DNS resolution.
Why wrong: DHCP option set is separate from enableDnsSupport.
D
The private hosted zone is automatically deleted.
Why wrong: Private hosted zone remains associated but not resolvable.

Full breakdown with real-world context →

Question 10mediummulti select

Full question →

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

A
Create a VPN connection between each VPC and a central VPN appliance.
Why wrong: Complex and not scalable.
B
Establish VPC peering connections in a full mesh and manage routes centrally.
Possible but less scalable than Transit Gateway.
C
Use Direct Connect to connect VPCs.
Why wrong: Direct Connect is for on-premises.
D
Use an AWS Transit Gateway with a central VPC as the hub.
Native hub-and-spoke architecture.
E
Use VPC Gateway Endpoints to connect VPCs.
Why wrong: Endpoints are for AWS services.

Full breakdown with real-world context →

Question 11hardmultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Exhibit

Refer to the exhibit.

AWS CLI output:
{
    "RouteTables": [
        {
            "Associations": [
                {
                    "Main": true,
                    "RouteTableId": "rtb-12345",
                    "SubnetId": null
                }
            ],
            "Routes": [
                {
                    "DestinationCidrBlock": "10.0.0.0/16",
                    "GatewayId": "local",
                    "Origin": "CreateRouteTable",
                    "State": "active"
                },
                {
                    "DestinationCidrBlock": "0.0.0.0/0",
                    "NatGatewayId": "nat-67890",
                    "Origin": "CreateRoute",
                    "State": "active"
                }
            ],
            "RouteTableId": "rtb-12345",
            "VpcId": "vpc-abcde"
        }
    ]
}

A
Traffic is dropped because no explicit association is set.
Why wrong: The subnet uses the main route table by default.
B
Traffic goes through the Internet Gateway.
Why wrong: No Internet Gateway is associated.
C
Traffic goes through the NAT Gateway nat-67890.
The main route table has a route to the NAT Gateway.
D
Traffic is dropped because no Internet Gateway is present.
Why wrong: The main route table has a NAT Gateway route.

Full breakdown with real-world context →

Question 12mediummultiple choice

Review the full routing breakdown →

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Exhibit

Refer to the exhibit.

CloudFormation snippet:
Resources:
  MyTransitGateway:
    Type: AWS::EC2::TransitGateway
    Properties:
      AmazonSideAsn: 64512
      AutoAcceptSharedAttachments: disable
      DefaultRouteTableAssociation: enable
      DefaultRouteTablePropagation: enable
      DnsSupport: enable
      VpnEcmpSupport: enable
  MyVpcAttachment:
    Type: AWS::EC2::TransitGatewayAttachment
    Properties:
      SubnetIds:
        - subnet-abc
        - subnet-def
      TransitGatewayId: !Ref MyTransitGateway
      VpcId: vpc-12345

A
The VPC attachment is not in the 'available' state.
Why wrong: The attachment would fail if not available.
B
The transit gateway route table propagation is not configured.
DefaultRouteTablePropagation enables automatic propagation, but the attachment does not explicitly propagate.
C
VPN ECMP support is enabled, preventing propagation.
Why wrong: ECMP support does not block propagation.
D
DNS support is disabled on the transit gateway.
Why wrong: DNS support does not affect route propagation.

Full breakdown with real-world context →

Question 13mediummultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?

Network Topology

A
The route table rtb-11111111 does not have a route to the S3 prefix list with the target as the VPC endpoint.
Without this route, traffic to S3 does not go through the endpoint.
B
The endpoint policy denies access to S3 from the instance's IAM role.
Why wrong: The policy allows all principals and actions.
C
The security group on the EC2 instance does not allow outbound traffic to the S3 prefix list.
Why wrong: Security groups do not control traffic to a Gateway endpoint; they control traffic to IP addresses.
D
The VPC does not have DNS resolution enabled for the endpoint.
Why wrong: DNS resolution is not required for Gateway endpoints; they use prefix lists.

Full breakdown with real-world context →

These ANS-C01 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style ANS-C01 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related ANS-C01 topic practice pages

Network Management and Operations practice questions

Network Security, Compliance and Governance practice questions

Network Design practice questions

Network Implementation practice questions

ANS-C01 fundamentals practice questions

ANS-C01 scenario practice questions

ANS-C01 troubleshooting practice questions

Practice scenarios

A network engineer is troubleshooting an issue where an AWS Lambda function cannot create an Elastic Network Interface (ENI) in a VPC. The function has the IAM policy shown in the exhibit. Which statement explains why the function is failing?

Exhibit

An administrator needs to create an interface VPC endpoint for Amazon S3 in a VPC and attach an elastic network interface (ENI) to an EC2 instance. The administrator applies the IAM policy shown in the exhibit. Which action will be DENIED by this policy?

Exhibit

Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?

Exhibit

Refer to the exhibit. An EC2 instance launched in subnet-1a is unable to access the internet. Which is the most likely cause?

Exhibit

Refer to the exhibit. An EC2 instance in the PrivateSubnet is unable to download patches from the internet. What is the most likely cause?

Exhibit

Based on the output, which of the following is true?

Exhibit

A network engineer runs the AWS CLI command shown in the exhibit. The VPC has an Amazon Route 53 private hosted zone associated. What is the impact of this setting?

Which TWO of the following are valid methods to connect multiple VPCs together in a hub-and-spoke topology while maintaining centralized control? (Choose two.)

Refer to the exhibit. A subnet is created in VPC vpc-abcde but no explicit route table association is set. What is the default route for internet-bound traffic from this subnet?

Exhibit

Refer to the exhibit. After deploying this CloudFormation stack, the VPC is attached to the transit gateway. However, routes are not being propagated to the transit gateway route table. What is the most likely cause?

Exhibit

Refer to the exhibit. A VPC endpoint for S3 is created as a Gateway endpoint. The route tables rtb-11111111 and rtb-22222222 are associated with the endpoint. An EC2 instance in a subnet associated with rtb-11111111 cannot access S3 via the endpoint. What is the most likely cause?