AWS Certified Advanced Networking – Specialty (ANS-C01 Comprehensive Practice Exam – 150 Multiple-Choice Questions a well detailed one 2025 / 2026 written and graded A+ upgraded

1




AWS Certified Advanced
Networking – Specialty (ANS-C01
Comprehensive Practice Exam –
150 Multiple-Choice Questions a
well detailed one
written and graded A+
upgraded




Domain 1: Hybrid IT Network Architecture (Questions 1–35)

Question 1
A company is expanding its on-premises data center to AWS us-west-2 Region. The on-premises
network is in New York. The solution must be cost-effective and highly available. Which option
satisfies these requirements?

, 2



A. Establish a Direct Connect link using a provider connecting on-premises to us-west-2 with two
connections for high availability
B. Establish a VPN between AWS and on-premises using a Virtual Private Gateway (VGW) which
provides two tunnel endpoints
C. Establish two separate VPNs between AWS and on-premises in us-west-2 using two customer
gateways
D. Use AWS Transit Gateway with a single VPN connection and enable ECMP for redundancy

- detailed answer 100% correct :- B
Rationale: A VGW provides two tunnel endpoints for high availability by default. Direct Connect
(A) is not cost-effective compared to VPN. Option C is redundant as a single VGW already
provides two tunnels. Option D still relies on a single VPN connection.



Question 2
A company needs to connect its on-premises network to a VPC in us-east-1. The connection
must support an MTU of 9,000 bytes and be highly available. Which solution is MOST cost-
effective?

A. Use AWS Site-to-Site VPN with two connections to two virtual private gateways in the same
VPC
B. Use AWS Site-to-Site VPN with two connections to a single transit gateway with a VPC
attachment
C. Create a multi-site, nonredundant AWS Direct Connect deployment with two connections to
two separate Direct Connect locations
D. Create a multi-site, redundant AWS Direct Connect deployment with two connections to one
location and two to a second location

- detailed answer 100% correct :- C
Rationale: VPN connections are limited to 1,500 MTU due to IPsec encapsulation overhead.
Direct Connect supports jumbo frames (9,000 bytes MTU). Option C provides the most cost-
effective solution meeting both the MTU and high availability requirements.



Question 3
A company has a Direct Connect connection with a 1 Gbps port. They need to increase
bandwidth to 2 Gbps without replacing the physical port. What should they do?

A. Create a second Direct Connect connection and aggregate using Link Aggregation Group
(LAG)

, 3



B. Upgrade the port to 10 Gbps
C. Use AWS Global Accelerator to distribute traffic across multiple connections
D. Configure ECMP with two VPN tunnels over the existing Direct Connect

- detailed answer 100% correct :- A
Rationale: Direct Connect supports Link Aggregation Group (LAG) which allows aggregating
multiple connections into a single logical connection, increasing bandwidth without replacing
the physical port.



Question 4
A network engineer is designing a hybrid architecture with consistent low-latency connectivity
between an on-premises data center and AWS. Which solution provides the MOST predictable
performance?

A. AWS Site-to-Site VPN over the internet
B. AWS Direct Connect with a private virtual interface (VIF)
C. AWS Client VPN
D. AWS Transit Gateway VPN attachment

- detailed answer 100% correct :- B
Rationale: AWS Direct Connect provides a dedicated private connection that bypasses the
public internet, offering consistent and predictable low-latency performance.



Question 5
A company has deployed AWS Direct Connect with a private VIF to a VGW. They want to
connect to multiple VPCs in the same Region using a single Direct Connect connection. Which
approach should they use?

A. Create a separate private VIF for each VPC
B. Associate the Direct Connect gateway with a Transit Gateway
C. Use VPC peering between all VPCs and connect one to the Direct Connect gateway
D. Create a separate Direct Connect connection for every VPC

- detailed answer 100% correct :- B
Rationale: Associating a Direct Connect gateway with a Transit Gateway allows a single Direct
Connect connection to provide connectivity to multiple VPCs through the Transit Gateway's
transitive routing capability.

, 4



Question 6
A company needs to encrypt all network communications over AWS Direct Connect
connections. What should they implement?

A. Enable MACsec on the Direct Connect connections
B. Use IPsec VPN over the Direct Connect connection
C. Enable TLS on the virtual interface
D. Use AWS PrivateLink for all traffic

- detailed answer 100% correct :- A
Rationale: MACsec provides layer 2 encryption for Direct Connect connections, encrypting all
network communications in transit.



Question 7
A company has two on-premises data centers (primary and secondary) connected to AWS via
Direct Connect. Each data center has a transit VIF connected to a Direct Connect gateway
associated with a transit gateway. Traffic from AWS to on-premises should route primarily to the
primary data center, failing over only during outages. What solution meets this requirement?

A. Use BGP community tags with value 7224:9100 for the primary and 7224:9200 for the
secondary
B. Configure static routes with different metrics
C. Use equal-cost multipath (ECMP) routing
D. Configure the on-premises routers to advertise a lower MED value from the secondary site

- detailed answer 100% correct :- A
Rationale: AWS uses specific BGP community values to influence path selection for traffic
leaving AWS. BGP community tags allow controlling the preferred path.



Question 8
A company is setting up a Direct Connect connection with a hosted virtual interface from a
Direct Connect Partner. The requirement is for a 100 Mbps connection. Can this be achieved?

A. No, Direct Connect is only available at 1 Gbps or 10 Gbps
B. Yes, use a Direct Connect Partner and request a 100 Mbps hosted connection
C. Yes, but only if the parent AWS account already has an existing Direct Connect link
D. No, 100 Mbps is not supported for Direct Connect