ANS-C01 Exam Guide
This ANS-C01 exam focuses on practical knowledge and real-world application scenarios related to the subject area. It evaluates your ability to understand core concepts, apply best practices, and make informed decisions in realistic situations rather than relying solely on memorization.
This page provides a structured exam guide, including exam focus areas, skills measured, preparation recommendations, and practice questions with explanations to support effective learning.
Exam Overview
The ANS-C01 exam typically emphasizes how concepts are used in professional environments, testing both theoretical understanding and practical problem-solving skills.
Skills Measured
- Understanding of core concepts and terminology
- Ability to apply knowledge to practical scenarios
- Analysis and evaluation of solution options
- Identification of best practices and common use cases
Preparation Tips
Successful candidates combine conceptual understanding with hands-on practice. Reviewing measured skills and working through scenario-based questions is strongly recommended.
Practice Questions for ANS-C01 Exam
The following practice questions are designed to reinforce key ANS-C01 exam concepts and reflect common scenario-based decision points tested in the certification.
Question#1
A company has deployed Amazon EC2 instances in private subnets in a VPC. The EC2 instances must initiate any requests that leave the VPC, including requests to the company's on-premises data center over an AWS Direct Connect connection. No resources outside the VPC can be allowed to open communications directly to the EC2 instances.
The on-premises data center's customer gateway is configured with a stateful firewall device that filters for incoming and outgoing requests to and from multiple VPCs. In addition, the company wants to use a single IP match rule to allow all the communications from the EC2 instances to its data center from a single IP address.
Which solution will meet these requirements with the LEAST amount of operational overhead?
A. Create a VPN connection over the Direct Connect connection by using the on-premises firewall. Use the firewall to block all traffic from on premises to AW
B. Allow a stateful connection from the EC2 instances to initiate the requests.
C. Configure the on-premises firewall to filter all requests from the on-premises network to the EC2 instances. Allow a stateful connection if the EC2 instances in the VPC initiate the traffic.
D. Deploy a NAT gateway into a private subnet in the VPC where the EC2 instances are deployed. Specify the NAT gateway type as private. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT gateway.
E. Deploy a NAT instance into a private subnet in the VPC where the EC2 instances are deployed. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT instance.
Question#2
An international company provides early warning about tsunamis. The company plans to use IoT devices to monitor sea waves around the world. The data that is collected by the IoT devices must reach the company’s infrastructure on AWS as quickly as possible. The company is using three operation centers around the world. Each operation center is connected to AWS through Its own AWS Direct Connect connection. Each operation center is connected to the internet through at least two upstream internet service providers.
The company has its own provider-independent (PI) address space. The IoT devices use TCP protocols for reliable transmission of the data they collect. The IoT devices have both landline and mobile internet connectivity. The infrastructure and the solution will be deployed in multiple AWS Regions. The company will use Amazon Route 53 for DNS services.
A network engineer needs to design connectivity between the IoT devices and the services that run in the AWS Cloud.
Which solution will meet these requirements with the HIGHEST availability?
A. Set up an Amazon CloudFront distribution with origin failover. Create an origin group for each Region where the solution is deployed.
B. Set up Route 53 latency-based routing. Add latency alias records. For the latency alias records, set the value of Evaluate Target Health to Yes.
C. Set up an accelerator in AWS Global Accelerator. Configure Regional endpoint groups and health checks.
D. Set up Bring Your Own IP (BYOIP) addresses. Use the same PI addresses for each Region where the solution is deployed.
Explanation:
https://aws.amazon.com/blogs/iot/automate-global-device-provisioning-with-aws-iot-core-and-amazon-route-53/
Question#3
A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment.
Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)
A. Create a public certificate in AWS Certificate Manager (ACM).
B. Create a private certificate in AWS Certificate Manager (ACM).
C. Configure the Site-to-Site VPN tunnels to use the pre-shared key (PSK).
D. Create a customer gateway. Specify the current dynamic IP address of the customer gateway device's external interface.
E. Create a customer gateway. Do not specify the IP address of the customer gateway device.
Explanation:
Create a private certificate in AWS Certificate Manager (ACM): This involves setting up a private Certificate Authority (CA) within AWS ACM, which will be used to issue certificates for authenticating your customer gateway device.
Create a customer gateway. Specify the current dynamic IP address of the customer gateway device's external interface: Even though on-premises environment doesn't have a static IP, you can still configure the customer gateway in AWS by specifying its current dynamic IP address. This setup allows AWS to recognize and authenticate your customer gateway device during the VPN connection establishment.
Question#4
A company wants to improve visibility into its AWS environment. The AWS environment consists of multiple VPCs that are connected to a transit gateway. The transit gateway connects to an on-premises data center through an AWS Direct Connect gateway and a pair of redundant Direct Connect connections that use transit VIFs. The company must receive notification each time a new route is advertised to AWS from on premises over Direct Connect.
What should a network engineer do to meet these requirements?
A. Enable Amazon CloudWatch metrics on Direct Connect to track the received routes. Configure a CloudWatch alarm to send notifications when routes change.
B. Onboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insights. Use Amazon EventBridge (Amazon CloudWatch Events) to send notifications when routes change.
C. Configure an AWS Lambda function to periodically check the routes on the Direct Connect gateway and to send notifications when routes change.
D. Enable Amazon CloudWatch Logs on the transit VIFs to track the received routes. Create a metric filter Set an alarm on the filter to send notifications when routes change.
Explanation:
https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-cloudwatch-events.html
To receive notification each time a new route is advertised to AWS from on premises over Direct Connect, a network engineer should onboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insights and use Amazon EventBridge (Amazon CloudWatch Events) to send notifications when routes change (Option B). This solution allows for real-time monitoring of route changes and automatic notification when new routes are advertised.
Question#5
A global film production company uses the AWS Cloud to encode and store its video content before distribution. The company's three global offices are connected to the us-east-1 Region through AWS Site-to-Site VPN links that terminate on a transit gateway with BGP routing activated.
The company recently started to produce content at a higher resolution to support 8K streaming. The size of the content files has increased to three times the size of the content files from the previous format. Uploads of files to Amazon EC2 instances are taking 10 times longer than they did with the previous format.
Which actions should a network engineer recommend to reduce the upload times? (Choose two.)
A. Create a second VPN tunnel from each office location to the transit gateway. Activate equal-cost multi-path (ECMP) routing.
B. Modify the transit gateway to activate Jumbo MTU on the VPN tunnels to each office location.
C. Replace the existing VPN tunnels with new tunnels that have acceleration activated.
D. Upgrade each EC2 instance to a modern instance type. Activate Jumbo MTU in the operating system.
E. Replace the existing VPN tunnels with new tunnels that have IGMP activated.
Disclaimer
This page is for educational and exam preparation reference only. It is not affiliated with Amazon, AWS Certified Specialty, or the official exam provider. Candidates should refer to official documentation and training for authoritative information.
