CLOUDPUZ
AWS Certified
Advanced Networking -
Specialty
ANS-C01
150 Practice Questions
Answers & Detailed Explanations
2 practice tests • 75 questions per test • English
Independent study material for certification preparation. This publication is not affiliated with or endorsed by Amazon Web
Services. AWS and related names are trademarks of their respective owners.
Practice questions for learning and revision; no claim is made that these are live certification exam questions.
CLOUDPUZ | ANS-C01 | Practice questions & answers 1
, How to use this question bank
Complete each practice test before consulting its answer key. Select one answer unless the
question specifies multiple answers. Review the explanations for every option, then revisit the
topics you missed.
Each test has three sections: Questions, Quick answer key, and Answers with explanations.
Question numbering restarts at 1 for Test 2.
The questions and explanations retain the content of the Cloudpuz source question banks. Official reference links supplied
in those banks are preserved for further study. Service capabilities and exam objectives may evolve.
CLOUDPUZ | ANS-C01 | Practice questions & answers 2
, Practice Test 1
Questions 1-75
Question 1 | Network Implementation
A deployment creates a public subnet route to an internet gateway, but an EC2 instance with only
a private IPv4 address cannot initiate direct internet traffic. What is missing for direct IPv4
internet gateway access?
A. An S3 bucket policy
B. An appropriate public IPv4 address and applicable security permissions
C. A second route with the same destination
D. A larger DNS TTL
Select 1 answer.
Question 2 | Network Implementation
A network deployment should react when an approved configuration event occurs and invoke
remediation code. Which combination is suitable?
A. An NS record and a PTR record
B. An ALB listener with no application target
C. EventBridge with a supported event source and a Lambda target
D. A Transit Gateway route table alone
Select 1 answer.
Question 3 | Network Security, Compliance, and Governance
A firewall endpoint is deployed in a VPC, but traffic bypasses it. What is required to enforce
inspection?
A. Only change the firewall's name
B. Route the intended traffic through the firewall endpoint and preserve valid return paths
C. Only attach an IAM read-only policy to the instance
D. Only enable firewall logging
Select 1 answer.
CLOUDPUZ | ANS-C01 | Practice questions & answers 3
, Question 4 | Network Security, Compliance, and Governance
A security team wants alerts when a route is changed to expose a previously isolated subnet.
Which approach supports detection?
A. Monitor relevant API events and evaluate resulting configuration against approved policy
B. Disable CloudTrail to reduce log volume
C. Rely only on monthly cost reports
D. Inspect only the subnet's name
Select 1 answer.
Question 5 | Network Design
A platform account should own subnets while participant accounts launch supported application
resources into them. Which capability fits?
A. Copying the subnet CIDR into each account
B. A public DNS zone transfer
C. An S3 bucket policy
D. VPC subnet sharing through AWS RAM
Select 1 answer.
Question 6 | Network Design
A private workload accesses large volumes of S3 data in its Region through a NAT gateway.
Which design should be evaluated to reduce NAT processing for that traffic?
A. A larger DNS TTL alone
B. A CloudFront invalidation schedule
C. An S3 gateway endpoint with appropriate route tables and policy
D. An additional NAT gateway on the same route
Select 1 answer.
Question 7 | Network Design
An application needs host-based and path-based HTTP routing to separate microservices. Which
load balancer is the closest fit?
A. Gateway Load Balancer
B. Network Load Balancer
C. Application Load Balancer
D. A transit gateway attachment
Select 1 answer.
CLOUDPUZ | ANS-C01 | Practice questions & answers 4
AWS Certified
Advanced Networking -
Specialty
ANS-C01
150 Practice Questions
Answers & Detailed Explanations
2 practice tests • 75 questions per test • English
Independent study material for certification preparation. This publication is not affiliated with or endorsed by Amazon Web
Services. AWS and related names are trademarks of their respective owners.
Practice questions for learning and revision; no claim is made that these are live certification exam questions.
CLOUDPUZ | ANS-C01 | Practice questions & answers 1
, How to use this question bank
Complete each practice test before consulting its answer key. Select one answer unless the
question specifies multiple answers. Review the explanations for every option, then revisit the
topics you missed.
Each test has three sections: Questions, Quick answer key, and Answers with explanations.
Question numbering restarts at 1 for Test 2.
The questions and explanations retain the content of the Cloudpuz source question banks. Official reference links supplied
in those banks are preserved for further study. Service capabilities and exam objectives may evolve.
CLOUDPUZ | ANS-C01 | Practice questions & answers 2
, Practice Test 1
Questions 1-75
Question 1 | Network Implementation
A deployment creates a public subnet route to an internet gateway, but an EC2 instance with only
a private IPv4 address cannot initiate direct internet traffic. What is missing for direct IPv4
internet gateway access?
A. An S3 bucket policy
B. An appropriate public IPv4 address and applicable security permissions
C. A second route with the same destination
D. A larger DNS TTL
Select 1 answer.
Question 2 | Network Implementation
A network deployment should react when an approved configuration event occurs and invoke
remediation code. Which combination is suitable?
A. An NS record and a PTR record
B. An ALB listener with no application target
C. EventBridge with a supported event source and a Lambda target
D. A Transit Gateway route table alone
Select 1 answer.
Question 3 | Network Security, Compliance, and Governance
A firewall endpoint is deployed in a VPC, but traffic bypasses it. What is required to enforce
inspection?
A. Only change the firewall's name
B. Route the intended traffic through the firewall endpoint and preserve valid return paths
C. Only attach an IAM read-only policy to the instance
D. Only enable firewall logging
Select 1 answer.
CLOUDPUZ | ANS-C01 | Practice questions & answers 3
, Question 4 | Network Security, Compliance, and Governance
A security team wants alerts when a route is changed to expose a previously isolated subnet.
Which approach supports detection?
A. Monitor relevant API events and evaluate resulting configuration against approved policy
B. Disable CloudTrail to reduce log volume
C. Rely only on monthly cost reports
D. Inspect only the subnet's name
Select 1 answer.
Question 5 | Network Design
A platform account should own subnets while participant accounts launch supported application
resources into them. Which capability fits?
A. Copying the subnet CIDR into each account
B. A public DNS zone transfer
C. An S3 bucket policy
D. VPC subnet sharing through AWS RAM
Select 1 answer.
Question 6 | Network Design
A private workload accesses large volumes of S3 data in its Region through a NAT gateway.
Which design should be evaluated to reduce NAT processing for that traffic?
A. A larger DNS TTL alone
B. A CloudFront invalidation schedule
C. An S3 gateway endpoint with appropriate route tables and policy
D. An additional NAT gateway on the same route
Select 1 answer.
Question 7 | Network Design
An application needs host-based and path-based HTTP routing to separate microservices. Which
load balancer is the closest fit?
A. Gateway Load Balancer
B. Network Load Balancer
C. Application Load Balancer
D. A transit gateway attachment
Select 1 answer.
CLOUDPUZ | ANS-C01 | Practice questions & answers 4
