10 AWS Advanced Networking Specialty Questions Most Candidates Get Wrong
This set of questions targets the core domains of the AWS Advanced Networking Specialty (ANS-C01) exam, focusing on complex hybrid networking, routing, security, and automation. Each question is designed to test not just recall, but the application of networking concepts in multi-account, multi-VPC, and on-premises hybrid scenarios.
Question 1
A company has a Direct Connect connection with a private VIF to a VPC in us-east-1. They are now launching a new VPC in us-west-2 and want to use the same Direct Connect connection for private connectivity to both VPCs. What is the MOST operationally efficient solution? For more on this topic, see our guide on AWS Advanced Networking Specialty Passing Score.
A. Create a new private VIF in us-west-2 and associate it with the new VPC.
B. Create a transit VIF and attach it to a Direct Connect Gateway, then associate both VPCs to the gateway.
C. Create a hosted VIF from the existing connection and route it to the new VPC.
D. Use a VPN connection as a backup and route traffic over the internet for the new VPC.
Answer: B
Explanation: A Direct Connect Gateway allows a single private or transit VIF to be associated with multiple VPCs across different regions (within the same account or different accounts). A transit VIF is required to connect to a Direct Connect Gateway. Option A is incorrect because a physical connection in us-east-1 cannot be directly used for a VIF in us-west-2. Option C is incorrect as hosted VIFs are for third-party providers. Option D does not utilize the existing Direct Connect.
Question 2
A network engineer needs to inspect and filter traffic between two VPCs peered via a transit gateway. They want to use a centralized security appliance (e.g., firewall) for east-west traffic inspection. Which architecture will meet this requirement with the least operational overhead?
A. Create a VPC peering connection between the two VPCs and route traffic through the security appliance.
B. Attach both VPCs to a transit gateway and use a gateway route table to point traffic to a security VPC’s appliance.
C. Use a Network Load Balancer (NLB) in front of the security appliance in each VPC.
D. Enable VPC Traffic Mirroring on all instances and send copies to the security appliance.
Answer: B
Explanation: A transit gateway (TGW) supports route tables per attachment, allowing you to route traffic from VPC A to a security VPC (with the appliance) before it reaches VPC B. This is the standard "inspection VPC" pattern. Option A is incorrect because VPC peering does not support transitive routing or centralized inspection without complex routing. Option C is for load balancing, not inspection. Option D only copies traffic for analysis, not inline filtering.
Question 3
An application in a private subnet needs to access an S3 bucket in the same region. The security team mandates that traffic must NOT traverse the public internet and must not use a NAT gateway. Which solution meets these requirements?
A. Create a gateway VPC endpoint for S3 and update the route table for the private subnet.
B. Create an interface VPC endpoint for S3 and attach a security group.
C. Set up a NAT instance in the public subnet and route traffic through it.
D. Use a VPC peering connection with the S3 bucket’s VPC.
Answer: A
Explanation: A gateway VPC endpoint for S3 allows private subnet instances to access S3 without a NAT device or internet gateway, and traffic stays within the AWS network. Option B (interface endpoint) also works but is typically more expensive and used for on-premises access; gateway endpoints are the standard for S3/DynamoDB from VPCs. Option C violates the no-NAT requirement. Option D is impossible as S3 is a service, not a VPC.
Question 4
You have a Direct Connect private VIF to a VPC. You notice that BGP session is flapping every few minutes. Upon reviewing the logs, you see BGP Notification sent: Hold Timer Expired. What is the MOST likely cause and fix?
A. The virtual interface’s MTU is set to 1500; change it to 9001.
B. The BGP keepalive interval is set too high; reduce it to 10 seconds. Before moving on, consider reading AWS Advanced Networking Specialty Difficulty: The Hardest AWS Cert?.
C. The on-premises router is sending keepalives faster than the AWS side can process; increase the hold timer on AWS.
D. The on-premises router is not responding to keepalives due to a firewall rule; verify UDP port 179 is open.
Answer: D
Explanation: A hold timer expired indicates that the BGP peer (on-premises router) did not receive keepalive messages within the configured hold time. This is almost always a network connectivity issue (e.g., firewall blocking TCP port 179) or misconfiguration. Option A is incorrect—MTU affects data plane, not BGP liveness. Option B is incorrect—reducing keepalive interval may mask the issue but doesn't fix the root cause. Option C is incorrect—you cannot increase the hold timer on AWS side; it’s negotiated.
Question 5
A company wants to route traffic from multiple VPCs (in different accounts) to a central on-premises network via a single Direct Connect connection. They have a transit gateway in the central account. What is the MOST scalable way to share the transit gateway with other accounts?
A. Create a VPC peering connection between each VPC and the central VPC.
B. Use AWS Resource Access Manager (RAM) to share the transit gateway with other accounts.
C. Create a new transit VIF for each VPC.
D. Use a VPN CloudHub to connect all VPCs to the central network.
Answer: B
Explanation: Transit gateways can be shared across accounts using AWS RAM, allowing other accounts to attach their VPCs to the central TGW without needing to create new infrastructure. Option A is incorrect—peering is not transitive and doesn't scale for many VPCs. Option C is incorrect—a single transit VIF can connect to a Direct Connect Gateway, but you don't need per-VPC VIFs. Option D is for VPN connections, not Direct Connect.
Question 6
An application uses a Network Load Balancer (NLB) with a target group of EC2 instances in a private subnet. The NLB is in a public subnet. You need to preserve the client’s source IP address when traffic reaches the instances. What must be configured?
A. Enable Proxy Protocol v2 on the NLB’s target group.
B. Enable Elastic IP addresses on the NLB for each AZ.
C. Configure the target group to use instance ID targets instead of IP addresses.
D. Set the NLB’s listener to use TCP_UDP protocol.
Answer: A
Explanation: NLBs preserve source IPs by default when using IP targets, but when using instance targets, the source IP is the NLB’s IP. To see the original client IP, you must enable Proxy Protocol v2 on the target group. Option B is for static IP addresses, not source IP preservation. Option C is incorrect—instance targets still need proxy protocol. Option D is about protocol, not source IP.
Question 7
You are designing a hybrid network with a Direct Connect connection and a VPN as a backup. You want to fail over automatically if the Direct Connect link goes down. Which configuration achieves this?
A. Use a single BGP session over the Direct Connect and configure a static route for the VPN.
B. Advertise the same on-premises prefix over both the Direct Connect BGP session and the VPN BGP session, and use BGP AS path prepending on the Direct Connect route to make it preferred.
C. Use a transit gateway with a route table that prefers the VPN attachment over the Direct Connect attachment.
D. Enable Direct Connect failover mode in the AWS console.
Answer: B Related reading: AWS Advanced Networking Specialty Difficulty: What Actually Makes People Fail.
Explanation: For automatic failover, you advertise the same prefix over both connections. To prefer Direct Connect, you prepend AS paths on the VPN advertisement (making it less preferred), so BGP will select the Direct Connect route. If the Direct Connect fails, the VPN route becomes the only path. Option A is incorrect—static routes don't dynamically fail over. Option C is incorrect—TGW doesn't have a failover preference feature. Option D doesn't exist.
Question 8
A security team requires that all DNS queries from VPCs must be logged and inspected. They want to use Route 53 Resolver DNS Firewall. Which steps are required to implement this?
A. Create a DNS Firewall rule group, associate it with the VPCs, and enable VPC DNS logging.
B. Enable VPC Flow Logs and set the log format to include DNS queries.
C. Deploy a custom DNS server on an EC2 instance and configure DHCP options set.
D. Use AWS CloudTrail to log all DNS queries.
Answer: A
Explanation: Route 53 Resolver DNS Firewall allows you to create rule groups (allow/deny lists) and associate them with VPCs to filter DNS queries. To log, you must enable DNS query logging on the VPC (via Route 53 Resolver query logging). Option B is incorrect—Flow Logs capture network traffic, not DNS application-layer queries. Option C is a manual workaround, not a managed service. Option D is for API calls, not DNS queries.
Question 9
You have a VPC with a CIDR of 10.0.0.0/16. You need to peer this VPC with another VPC that has a CIDR of 10.0.0.0/24. What is the correct approach to establish connectivity?
A. Create the VPC peering connection; overlapping CIDRs are allowed but routes will conflict.
B. Change the second VPC’s CIDR to a non-overlapping range, then create a peering connection.
C. Use a transit gateway instead of peering to handle overlapping CIDRs.
D. Create two separate peering connections with different route table priorities.
Answer: B
Explanation: VPC peering requires non-overlapping CIDRs. If they overlap, you cannot route traffic between them because the destination is ambiguous. You must change the CIDR of one VPC (which requires recreating the VPC) or use a different connectivity method like a transit gateway with complex routing, but even TGW cannot route overlapping CIDRs without NAT. Option A is incorrect—overlapping CIDRs are not allowed for peering. Option C is incorrect—TGW also fails with overlapping CIDRs. Option D is nonsensical.
Question 10
An organization uses AWS Transit Gateway to connect 50 VPCs. They notice that inter-VPC traffic is taking a suboptimal path. They want to ensure that traffic between two specific VPCs goes directly, bypassing the TGW. What is the solution?
A. Create a TGW route table that has a static route pointing to the other VPC’s attachment.
B. Create a VPC peering connection between the two VPCs and update their route tables to use the peering connection for each other’s CIDR.
C. Enable "Multicast" on the TGW to optimize the path.
D. Use a Direct Connect Gateway to bypass the TGW.
Answer: B
Explanation: To bypass the TGW for specific VPC-to-VPC traffic, you can create a VPC peering connection and add specific routes in both VPC route tables that point to the peering connection for the other VPC’s CIDR. This will override the TGW route (more specific route wins). Option A is incorrect—TGW routes always go through the TGW. Option C is for multicast, not unicast optimization. Option D is for on-premises connectivity, not VPC-to-VPC.
This set covers the breadth of the ANS-C01 blueprint, from Direct Connect and BGP to VPC endpoints and DNS filtering. The key to passing is not just knowing the services, but understanding how routing and security interact across hybrid and multi-account environments. Practice these scenarios repeatedly, and you'll be well-prepared.
When you want a quick check of which topics still need work, use the free AWS Certified Advanced Networking - Specialty readiness check.
Measure your progress over time by retaking full-length AWS Certified Advanced Networking - Specialty mock tests after each study session.
If you want a schedule that fits the time you have before exam day, use the free AWS Certified Advanced Networking - Specialty study plan.