Amazon ANS-C01 Practice Exam Questions & Answers
7 Free Questions
· Last reviewed: October 11, 2026
· Prepared & Reviewed by the ValidExamDumps Editorial Team
Exam Facts
Amazon ANS-C01 Exam Details
Key details for this exam, checked against the published exam outline
291
Practice Questions (Our Bank)
170 minutes
Exam Duration
720 / 1000
Passing Score
USD 300
Official Exam Fee
- Exam Code
- ANS-C01
- Full Name
- AWS Certified Advanced Networking - Specialty
- Issuing Body
- Amazon
- Question Format (Our Bank)
- Multiple Choice
- Delivery
- Online proctored or at Pearson VUE or PSI test centre
- Eligibility
- 5 or more years of networking experience with 2 or more years of cloud and hybrid networking experience
- Validity
- 3 years
Practice Questions
Free ANS-C01 Practice Questions
Each question shows the correct answer and an explanation of why it is right
VA
ValidExamDumps Editorial Team
Every question and its answer is checked by our ANS-C01 exam
preparation team, who also write the explanation shown with each one.
How we research and review these pages
A company plans to run a computationally intensive data processing application on AWS. The data is highly sensitive. The VPC must have no direct internet access, and the company has applied strict network security to control access.
Data scientists will transfer data from the company's on-premises data center to the instances by using an AWS Site-to-Site VPN connection. The on-premises data center uses the network range 172.31.0.0/20 and will use the network range 172.31.16.0/20 in the application VPC.
The data scientists report that they can start new instances of the application but that they cannot transfer any data from the on-premises data center. A network engineer enables VPC flow logs and sends a ping to one of the instances to test reachability. The flow logs show the following:
The network engineer must recommend a solution that will give the data scientists the ability to transfer data from the on-premises data center.
Which solution will meet these requirements?
Correct Answer:
C
Explanation
This question tests network security troubleshooting. The data scientists cannot transfer data despite having instances running, which suggests a network access control issue rather than an instance or application problem. Network ACLs operate at the subnet level and control both inbound and outbound traffic. The outbound rule must explicitly allow traffic from the VPC subnet to the on-premises network range. Without this rule, even though the security group might permit the traffic, the ACL blocks it at the subnet boundary. The other options would not resolve an ACL-level blocking issue.
A company hosts infrastructure services in multiple VPCs across multiple accounts in the us-west-2 Region. The VPC CIDR blocks do not overlap. The company wants to connect the VPCs to its data centers by using AWS Site-to-Site VPN tunnels.
The connections must be encrypted in transit. Additionally, the connection from each data center must route to the closest AWS edge location. The connections must be highly available and must accommodate automatic failover.
Which solution will meet these requirements?
Correct Answer:
A
Explanation
This question requires understanding multi-account, multi-region connectivity. A Transit Gateway is the correct service for connecting multiple VPCs across accounts and regions while maintaining encryption and high availability. Using AWS RAM to share the transit gateway avoids creating separate gateways in each account. VPC attachments connect service accounts to the transit gateway, and route table entries direct on-premises traffic through the attachment. This approach enables automatic failover and ensures each connection routes to the nearest edge location through the transit gateway's intelligent routing.
A company operates in the us-east-1 Region and the us-west-1 Region. The company is designing a solution to connect an on-premises data center to the company's AWS environment in us-east-1. The solution uses two AWS Direct Connect connections.
Traffic from us-west-1 to the data center needs to traverse the Direct Connect connections. A network engineer needs to set up active-passive functionality across the two Direct Connect connections by using a Direct Connect gateway to influence inbound traffic from VPCs that are in us-west-1 to the data center.
Which solution will meet these requirements?
Correct Answer:
D
Explanation
To control inbound traffic from AWS to the on-premises data center, local preference BGP community tags are used with a Direct Connect gateway.
AWS uses the following tags:
Applying 7224:9300 to the primary connection and 7224:9100 to the secondary connection ensures active-passive routing behavior for inbound traffic from AWS VPCs.
A company wants to analyze TCP traffic to the internet. The traffic originates from Amazon EC2 instances in the company's VPC. The EC2 instances initiate connections through a NAT gateway. The required information includes source and destination IP addresses, ports, and the first 8 bytes of payload of TCP segments. The company needs to collect, store, and analyze all the required data points.
Which solution will meet these requirements?
Correct Answer:
A
Explanation
VPC Traffic Mirror lets you capture and analyze network traffic from EC2 instances. Setting instances as traffic mirror sources captures their outgoing traffic, including that through the NAT gateway. Traffic mirror targets can forward captured packets to an analysis tool. The solution captures source and destination IPs, ports, and payload data as required. Sending this data to CloudWatch Logs allows storage and analysis using CloudWatch Logs Insights. Other monitoring options like VPC Flow Logs do not capture payload data, which is explicitly required here.
A company has VPCs in the us-east-1 Region that are connected to each other through a transit gateway. A network engineer needs to establish an AWS Direct Connect connection between the company's on-premises data center and the transit gateway for the migration of a workload.
The Direct Connect connection is UP according to the ConnectionState metric in Amazon CloudWatch. However, the VIF is DOWN. The network engineer has verified the transit VIF and BGP configurations on the on-premises router and has found no issues. However, the network engineer is unable to ping the Amazon peer IP address.
Which combination of steps should the network engineer take to troubleshoot this issue? (Choose three.)
Correct Answer:
A, C, E
Explanation
The IP address and subnet mask configuration on the router's subinterface must match the configuration provided by AWS for the virtual interface (VIF). A mismatch will prevent successful communication between the on-premises router and AWS.
A MAC address entry in the ARP table is essential for Layer 2 connectivity. If the AWS endpoint's MAC address is not visible in the ARP table, it could indicate a connectivity or VLAN tagging issue.
The correct VLAN tag must be configured for the subinterface because AWS Direct Connect requires VLAN tagging to separate traffic between different virtual interfaces.
A company's network engineer builds and tests network designs for VPCs in a development account. The company needs to monitor the changes that are made to network resources and must ensure strict compliance with network security policies. The company also needs access to the historical configurations of network resources.
Which solution will meet these requirements?
Correct Answer:
C
A company is growing rapidly. Data transfers between the company's on-premises systems and Amazon EC2 instances that run in VPCs are limited by the throughput of a single AWS Site-to-Site VPN connection between the company's on-premises data center firewall and an AWS Transit Gateway.
A network engineer must resolve the throttling by designing a solution that is highly available and secure. The solution also must scale the VPN throughput from on premises to the VPC resources to support the increase in traffic.
Which solution will meet these requirements?
Correct Answer:
A
Explanation
A single VPN connection has throughput limitations that become a bottleneck. Configuring multiple BGP-based Site-to-Site VPN connections to the transit gateway increases total available throughput by distributing traffic across connections. Equal-cost multi-path routing at the BGP level ensures traffic balances across these connections automatically. This approach is highly available because if one connection fails, traffic shifts to remaining connections. It scales horizontally as the company can add more VPN connections if needed. Other options like upgrading a single connection or using accelerated VPN would not provide the same scaling and high availability benefits.
Full Access
Get the complete ANS-C01 question set
- 291 questions covering all exam domains
- Correct answers with explanations, like the free questions above
- PDF and online practice test
- 90 days of free updates
Domain 1: Network Design
30%
Design patterns for content delivery networks like CloudFront and global traffic management with AWS Global Accelerator. Candidates learn to architect network solutions based on business and technical requirements.
Domain 2: Network Implementation
26%
Network routing methods including static and dynamic protocols, and virtual private networks (VPNs) with security-focused and accelerated options. Focus on deploying network resources using best practices.
Sample question from this domain above:
Q7
Domain 3: Network Management and Operation
20%
Routing protocols in AWS hybrid networks such as BGP over Direct Connect, connectivity techniques like Direct Connect gateway and Transit Gateway, and the impact of limits and quotas on AWS networking services.
Sample questions from this domain above:
Q2Q3Q5
Domain 4: Network Security, Compliance, and Governance
24%
Threat frameworks related to application architecture, common security threats, strategies to safeguard application flows, and AWS network architecture compliance requirements.
Sample questions from this domain above:
Q1Q4Q6
FAQ
ANS-C01 Exam FAQ
Common questions about the exam itself
Is ANS-C01 still available to take?
No. AWS retired the ANS-C01 exam on August 25, 2026. If you want to pursue advanced networking credentials, AWS has not announced a direct replacement but recommends CloudOps Engineer (SOA-C03) or Solutions Architect Professional (SAP-C02) as alternatives that cover networking heavily.
What background do I need for ANS-C01?
AWS recommends 5 or more years of networking experience with 2 or more years specifically in cloud and hybrid networking. You should understand AWS networking nuances, security best practices, and compute and storage options.
How long does preparation for ANS-C01 typically take?
Most candidates spend 2 to 4 months preparing, depending on their existing networking background. Those with strong on-premises networking skills may prepare faster, while those transitioning from purely cloud backgrounds may need longer.
Which domain is hardest on ANS-C01?
Network Design (30%) is often the most challenging because it requires applying architectural thinking to real-world scenarios rather than just knowing AWS services. Practice designing multi-region, multi-account networks with proper connectivity patterns.
What question types appear on ANS-C01?
The exam includes multiple choice questions with one correct answer and multiple response questions requiring you to select all correct answers. Some matching questions also appear where you must correctly pair all items to receive credit.
How much does ANS-C01 cost?
The exam costs USD 300. If you have already passed an AWS exam, you can apply a 50% voucher to reduce the cost to USD 150 for your next attempt.
How long is the ANS-C01 exam?
You have 170 minutes (2 hours 50 minutes) to complete all questions. The exam includes 65 questions total, with 50 that count toward your score and 15 unscored questions used for validation.
How long does the ANS-C01 certification stay valid?
The certification is valid for 3 years from the date you earn it. After 3 years, you must retake the exam to maintain the credential, though AWS has retired this exam so no renewal path exists.
What job role does ANS-C01 prepare you for?
ANS-C01 is designed for AWS networking specialists who design, implement, manage, and secure AWS and hybrid network architectures at scale. It suits network engineers transitioning to cloud roles and architects focusing on connectivity.
How does ANS-C01 relate to other AWS exams?
ANS-C01 is more specialized than the Solutions Architect Professional (SAP-C02) and targets deep networking expertise rather than broad architectural skills. It assumes you already understand AWS fundamentals and complements security or operations certifications well.
