Pass Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Exam in First Attempt Guaranteed!

Check mirror sources and filters, target health, capture timeline, packet identifiers, access logging and retention approvals. This choice relates to Traffic Mirroring forensic capture access governance, not the complementary response and evidence pair for the case. Prefer: Combine CloudTrail API activity with VPC Flow Logs metadata to investigate who changed network resources and how traffic behaved afterward. Confirm with: Correlate API eventName/principal/time/resource, Flow Log ENI/action/ports, affected route table and change records. Scenario: An organization sees a sudden security group exposure but reviews only Flow Logs and cannot determine which IAM principal opened the inbound rule.

Use AWS Firewall Manager with supported organization integration to apply and audit consistent WAF or network firewall policy across in-scope accounts and resources. This choice relates to AWS Firewall Manager organization-wide audit, not the complementary response and evidence pair for the case. Prefer: Combine CloudTrail API activity with VPC Flow Logs metadata to investigate who changed network resources and how traffic behaved afterward. Confirm with: Correlate API eventName/principal/time/resource, Flow Log ENI/action/ports, affected route table and change records. Scenario: An organization sees a sudden security group exposure but reviews only Flow Logs and cannot determine which IAM principal opened the inbound rule.

Clients use approved HTTPS paths and cloud edge-to-origin transport follows required encryption policy without exposing origin publicly. This choice relates to CloudFront HTTPS policies and origin security, not the complementary response and evidence pair for the case. Prefer: Combine CloudTrail API activity with VPC Flow Logs metadata to investigate who changed network resources and how traffic behaved afterward. Confirm with: Correlate API eventName/principal/time/resource, Flow Log ENI/action/ports, affected route table and change records. Scenario: An organization sees a sudden security group exposure but reviews only Flow Logs and cannot determine which IAM principal opened the inbound rule.

Correlate CloudFront request IDs, ALB access log fields, DNS query logs, origin response times and encrypted log retention. These checks are primarily associated with ELB CloudFront and Route 53 log correlation; they are less discriminating for this case. The relevant checks are: Review registered core and transit gateways, sites and links, topology state, telemetry sources and recent route changes. Scenario: An operator sees all sites displayed in Network Manager and concludes a private API must be reachable despite a denied security group rule.

Inspect listeners, priority ordered rules, target groups, forwarded headers, ALB access logs and web ACL association. These checks are primarily associated with Application Load Balancer HTTP routing and WAF; they are less discriminating for this case. The relevant checks are: Review registered core and transit gateways, sites and links, topology state, telemetry sources and recent route changes. Scenario: An operator sees all sites displayed in Network Manager and concludes a private API must be reachable despite a denied security group rule.

Review mirror source target and filter, ENI support, target capture health, packet encapsulation and data classification. These checks are primarily associated with VPC Traffic Mirroring packet-level design; they are less discriminating for this case. The relevant checks are: Review registered core and transit gateways, sites and links, topology state, telemetry sources and recent route changes. Scenario: An operator sees all sites displayed in Network Manager and concludes a private API must be reachable despite a denied security group rule.

Configure DNSSEC on supported public Route 53 hosted zones and maintain correct registrar DS delegation, distinguishing signing from transport encryption. That approach addresses Route 53 DNSSEC signing and resolver trust instead of the principal requirement here. DNSSEC supplies DNS data origin authentication/integrity, not confidentiality; Route 53 private hosted zones are not public DNSSEC-signing zones. The better fit for this scenario is: Use supported VPC endpoint policies, identity policies and SG restrictions to govern access to AWS services without unrestricted internet traversal. Scenario: A private application uses an S3 gateway endpoint but a project assumes that the endpoint route automatically grants permission to delete all company buckets.

Use AWS WAF on supported CloudFront/ALB/API entry points for HTTP(S) rules and AWS Shield for appropriate network DDoS resilience. That approach addresses AWS WAF Shield and application threat boundaries instead of the principal requirement here. WAF is an HTTP(S)-level filter rather than arbitrary TCP IDS; DDoS mitigation capabilities and integrations differ between WAF and Shield. The better fit for this scenario is: Use supported VPC endpoint policies, identity policies and SG restrictions to govern access to AWS services without unrestricted internet traversal. Scenario: A private application uses an S3 gateway endpoint but a project assumes that the endpoint route automatically grants permission to delete all company buckets.

Apply least-privilege security groups to ENIs and deliberate subnet network ACL rules while accounting for stateful return behavior and stateless ephemeral ports. That approach addresses Stateful security groups and stateless network ACLs instead of the principal requirement here. Security groups are stateful and NACLs stateless; a NACL must explicitly allow required traffic directions and ephemeral return ports. The better fit for this scenario is: Use supported VPC endpoint policies, identity policies and SG restrictions to govern access to AWS services without unrestricted internet traversal. Scenario: A private application uses an S3 gateway endpoint but a project assumes that the endpoint route automatically grants permission to delete all company buckets.

Inspect log scope, ENI IDs, source and destination addresses, ports, action, tcp-flags, log-status and delivery latency. These checks are primarily associated with VPC Flow Logs custom fields and accepted or rejected flows; they are less discriminating for this case. The relevant checks are: Inspect DF-bit probes, ICMP fragmentation feedback, tunnel encapsulation, ENI MTU, jumbo frame support and packet traces. Scenario: A new jumbo frame setting on one VPC instance worsens intermittent packet loss through a smaller-MTU transit device.

Inspect route table associations, propagation flags, attachment states, longest-prefix matches, blackhole entries and VPC routes. These checks are primarily associated with Transit Gateway route changes and blackhole prevention; they are less discriminating for this case. The relevant checks are: Inspect DF-bit probes, ICMP fragmentation feedback, tunnel encapsulation, ENI MTU, jumbo frame support and packet traces. Scenario: A new jumbo frame setting on one VPC instance worsens intermittent packet loss through a smaller-MTU transit device.

Inspect mirror session filters, target status, capture timestamps, TCP retransmits, sequence numbers, MTU and traffic sampling. These checks are primarily associated with Traffic Mirroring packet captures for retransmission analysis; they are less discriminating for this case. The relevant checks are: Inspect DF-bit probes, ICMP fragmentation feedback, tunnel encapsulation, ENI MTU, jumbo frame support and packet traces. Scenario: A new jumbo frame setting on one VPC instance worsens intermittent packet loss through a smaller-MTU transit device.

Inspect subnet available address counts, network interface consumption, load balancer scale events, CNI IP allocation and VPC CIDR associations. This choice relates to VPC subnet IP address exhaustion and growth, not the complementary response and evidence pair for the case. Prefer: Choose supported Elastic Network Adapter or Elastic Fabric Adapter options according to latency, high-performance computing placement and workload requirements. Confirm with: Review instance type support, enhanced networking drivers, ENA metrics, EFA topology and expected packet throughput. Scenario: A regular stateless web service experiences moderate latency and its engineers propose EFA rather than checking overutilized instances and network paths.

Select CloudFront to cache eligible content and Global Accelerator to optimize supported TCP/UDP ingress and health-based regional endpoint paths. This choice relates to CloudFront caching versus Global Accelerator network optimization, not the complementary response and evidence pair for the case. Prefer: Choose supported Elastic Network Adapter or Elastic Fabric Adapter options according to latency, high-performance computing placement and workload requirements. Confirm with: Review instance type support, enhanced networking drivers, ENA metrics, EFA topology and expected packet throughput. Scenario: A regular stateless web service experiences moderate latency and its engineers propose EFA rather than checking overutilized instances and network paths.

The network configuration contains an allowed logical path where intended, and live tests confirm service responsiveness independently. This choice relates to Reachability Analyzer static configuration diagnosis, not the complementary response and evidence pair for the case. Prefer: Choose supported Elastic Network Adapter or Elastic Fabric Adapter options according to latency, high-performance computing placement and workload requirements. Confirm with: Review instance type support, enhanced networking drivers, ENA metrics, EFA topology and expected packet throughput. Scenario: A regular stateless web service experiences moderate latency and its engineers propose EFA rather than checking overutilized instances and network paths.

The expected prefixes follow the intended primary and standby paths without accidental route leaks or asymmetric blackholes. That result supports BGP route advertisements and traffic engineering but does not establish the requested networking outcome here. Instead verify: Only eligible application targets receive traffic and unhealthy instances are removed according to the configured check. Scenario: A service scales EC2 instances but an ALB sends 503 errors because the new targets do not answer the configured /health path.

Clients authenticate the intended public endpoint and regulated traffic remains encrypted on the backend segment where required. That result supports TLS termination and backend encryption with load balancers but does not establish the requested networking outcome here. Instead verify: Only eligible application targets receive traffic and unhealthy instances are removed according to the configured check. Scenario: A service scales EC2 instances but an ALB sends 503 errors because the new targets do not answer the configured /health path.

Required transport sessions reach healthy targets through stable regional load-balancer entry addresses. That result supports Network Load Balancer TCP UDP and static addresses but does not establish the requested networking outcome here. Instead verify: Only eligible application targets receive traffic and unhealthy instances are removed according to the configured check. Scenario: A service scales EC2 instances but an ALB sends 503 errors because the new targets do not answer the configured /health path.

Approved overlapping-address consumers reach only the advertised service without full routing between their networks. This choice relates to AWS PrivateLink overlapping CIDR access, not the complementary response and evidence pair for the case. Prefer: Associate a Route 53 private hosted zone with each intended VPC, including controlled cross-account association, and avoid assuming public resolvers see it. Confirm with: Review VPC association authorization, account ownership, private zone names and test resolution from allowed VPC resolver contexts. Scenario: An application resolves database.internal from one VPC but returns NXDOMAIN in another account because the latter VPC was never associated.

Select Route 53 failover, weighted, latency or geolocation routing based on explicit objective, and pair failover records with supported health evaluation. This choice relates to Route 53 health check and routing policy design, not the complementary response and evidence pair for the case. Prefer: Associate a Route 53 private hosted zone with each intended VPC, including controlled cross-account association, and avoid assuming public resolvers see it. Confirm with: Review VPC association authorization, account ownership, private zone names and test resolution from allowed VPC resolver contexts. Scenario: An application resolves database.internal from one VPC but returns NXDOMAIN in another account because the latter VPC was never associated.

Verify inbound endpoint IPs and security groups, on-prem conditional forwarders, network reachability and DNS query logs. This choice relates to Route 53 Resolver inbound endpoint for on-premises queries, not the complementary response and evidence pair for the case. Prefer: Associate a Route 53 private hosted zone with each intended VPC, including controlled cross-account association, and avoid assuming public resolvers see it. Confirm with: Review VPC association authorization, account ownership, private zone names and test resolution from allowed VPC resolver contexts. Scenario: An application resolves database.internal from one VPC but returns NXDOMAIN in another account because the latter VPC was never associated.

Check mirror sources and filters, target health, capture timeline, packet identifiers, access logging and retention approvals. This choice relates to Traffic Mirroring forensic capture access governance, not the complementary response and evidence pair for the case. Prefer: Use AWS Firewall Manager with supported organization integration to apply and audit consistent WAF or network firewall policy across in-scope accounts and resources. Confirm with: Review organizational scope, policy type, resource inclusion, remediation state, compliance findings and delegated administrator status. Scenario: A compliance dashboard reports firewall rule findings and developers assume that the dashboard itself blocks all unauthorized traffic.

Combine CloudTrail API activity with VPC Flow Logs metadata to investigate who changed network resources and how traffic behaved afterward. This choice relates to CloudTrail control-plane events versus Flow Logs traffic evidence, not the complementary response and evidence pair for the case. Prefer: Use AWS Firewall Manager with supported organization integration to apply and audit consistent WAF or network firewall policy across in-scope accounts and resources. Confirm with: Review organizational scope, policy type, resource inclusion, remediation state, compliance findings and delegated administrator status. Scenario: A compliance dashboard reports firewall rule findings and developers assume that the dashboard itself blocks all unauthorized traffic.

Application abuse is reduced at the chosen supported entry point while normal requests continue under measured policy. This choice relates to AWS WAF Shield and application threat boundaries, not the complementary response and evidence pair for the case. Prefer: Use AWS Firewall Manager with supported organization integration to apply and audit consistent WAF or network firewall policy across in-scope accounts and resources. Confirm with: Review organizational scope, policy type, resource inclusion, remediation state, compliance findings and delegated administrator status. Scenario: A compliance dashboard reports firewall rule findings and developers assume that the dashboard itself blocks all unauthorized traffic.

Choose a Network Load Balancer for supported TCP, TLS, UDP or TCP_UDP traffic and zonal static-address requirements. That approach addresses Network Load Balancer TCP UDP and static addresses instead of the principal requirement here. An NLB handles layer-four transport and can expose zonal static IPs; it does not support ALB host/path routing semantics. The better fit for this scenario is: Use Route 53 alias records for supported AWS endpoints, including hosted-zone apex names, rather than relying on a prohibited apex CNAME. Scenario: A team replaces a public ALB and leaves a Route 53 alias pointing to the previous load balancer despite the application deployment being healthy.

Configure Route 53 Resolver outbound endpoints with conditional forwarding rules for on-premises domains from associated VPCs. That approach addresses Route 53 Resolver outbound endpoint for corporate domains instead of the principal requirement here. An outbound endpoint initiates AWS-side forwarding to target DNS servers; inbound endpoints serve the reverse hybrid query direction. The better fit for this scenario is: Use Route 53 alias records for supported AWS endpoints, including hosted-zone apex names, rather than relying on a prohibited apex CNAME. Scenario: A team replaces a public ALB and leaves a Route 53 alias pointing to the previous load balancer despite the application deployment being healthy.

Deploy accessible Route 53 Resolver inbound endpoints and conditional on-premises forwarding when corporate DNS must query names in AWS private zones. That approach addresses Route 53 Resolver inbound endpoint for on-premises queries instead of the principal requirement here. Resolver inbound endpoints accept forwarded queries into VPC DNS; they do not themselves forward arbitrary VPC queries to an on-premises name server. The better fit for this scenario is: Use Route 53 alias records for supported AWS endpoints, including hosted-zone apex names, rather than relying on a prohibited apex CNAME. Scenario: A team replaces a public ALB and leaves a Route 53 alias pointing to the previous load balancer despite the application deployment being healthy.

Review tunnel metrics and IKE/IPsec logs, BGP route changes, customer gateway policies, packet loss and failover timestamps. This choice relates to Site-to-Site VPN tunnel recovery and path policy, not the complementary response and evidence pair for the case. Prefer: Maintain Transit Gateway attachment associations and propagated/static routes while preventing blackholes and cross-environment route leakage. Confirm with: Inspect route table associations, propagation flags, attachment states, longest-prefix matches, blackhole entries and VPC routes. Scenario: A route fails after a peering attachment is removed, but an old static TGW entry continues sending packets to an unavailable target.

Track Transit Gateway, VPC, route-table, endpoint and Direct Connect quotas before introducing additional CIDRs, attachments or network interfaces. This choice relates to AWS network service quota and route-scale management, not the complementary response and evidence pair for the case. Prefer: Maintain Transit Gateway attachment associations and propagated/static routes while preventing blackholes and cross-environment route leakage. Confirm with: Inspect route table associations, propagation flags, attachment states, longest-prefix matches, blackhole entries and VPC routes. Scenario: A route fails after a peering attachment is removed, but an old static TGW entry continues sending packets to an unavailable target.

Large application payloads traverse intended hybrid paths without fragmentation blackholes while small-packet reachability remains stable. This choice relates to Packet MTU MSS and Path MTU Discovery, not the complementary response and evidence pair for the case. Prefer: Maintain Transit Gateway attachment associations and propagated/static routes while preventing blackholes and cross-environment route leakage. Confirm with: Inspect route table associations, propagation flags, attachment states, longest-prefix matches, blackhole entries and VPC routes. Scenario: A route fails after a peering attachment is removed, but an old static TGW entry continues sending packets to an unavailable target.

Review origin group priority, response status, origin health, failover criteria, request method and edge access logs. These checks are primarily associated with CloudFront origin groups and failover behavior; they are less discriminating for this case. The relevant checks are: Inspect metric dimensions, statistic, evaluation windows, missing-data treatment, alarm actions and correlated service health. Scenario: A VPN metric periodically stops publishing and an alarm configured to ignore all missing periods never warns operators of a loss of visibility.

Examine Connect peer IPs, GRE tunnels, BGP neighbors, Transit Gateway associations and propagated routes. These checks are primarily associated with Transit Gateway Connect integration for SD-WAN; they are less discriminating for this case. The relevant checks are: Inspect metric dimensions, statistic, evaluation windows, missing-data treatment, alarm actions and correlated service health. Scenario: A VPN metric periodically stops publishing and an alarm configured to ignore all missing periods never warns operators of a loss of visibility.

Correlate CloudFront request IDs, ALB access log fields, DNS query logs, origin response times and encrypted log retention. These checks are primarily associated with ELB CloudFront and Route 53 log correlation; they are less discriminating for this case. The relevant checks are: Inspect metric dimensions, statistic, evaluation windows, missing-data treatment, alarm actions and correlated service health. Scenario: A VPN metric periodically stops publishing and an alarm configured to ignore all missing periods never warns operators of a loss of visibility.