cert
cert-1
cert-2

Pass Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AWS Certified Advanced Networking - Specialty ANS-C01 Exam - Verified By Experts
AWS Certified Advanced Networking - Specialty ANS-C01 Premium Bundle
$29.98

AWS Certified Advanced Networking - Specialty ANS-C01 Premium Bundle

$79.99
$109.97
  • Premium File 306 Questions & Answers. Last update: Nov 04, 2026
  • Training Course 223 Video Lectures
  • Study Guide 411 Pages
 
$109.97
$79.99
accept 38 downloads in last 7 days
block-screenshots
Purchase Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Exam Training Products Individually
Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Premium File
Premium File 306 Q&A
$76.99$69.99
Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Video Training Course
Training Course 223 Lectures
$21.99 $19.99
Amazon AWS Certified Advanced Networking - Specialty ANS-C01 PDF Study Guide
Study Guide 411 Pages
$21.99 $19.99
Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 35

Question 340

An internal application migrates into a new AWS account and cannot resolve corp.example.internal because the corporate forwarding rule is not associated with its VPC. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Approved environments deploy repeatable unique networks with changes reviewed before impact and conflicts detected early.
  2. Create Route 53 Resolver outbound endpoint forwarding rules for intended internal domain suffixes and associate rules with every consuming VPC.
  3. Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names.
  4. Inspect private zone ID, creating account, association authorization, resource share, VPC ownership, DNS query path and restrictions.
  5. Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs.

Explanation

Correct Answers

B:

Create Route 53 Resolver outbound endpoint forwarding rules for intended internal domain suffixes and associate rules with every consuming VPC. This addresses the networking mechanism required in the scenario. Outbound Resolver endpoints initiate DNS forwarding from AWS VPCs; an inbound endpoint alone does not redirect AWS-origin queries to corporate DNS. Verify it with: Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs. This is the implementation portion of the required response-evidence pair. Scenario: An internal application migrates into a new AWS account and cannot resolve corp.example.internal because the corporate forwarding rule is not associated with its VPC.

E:

Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs. This distinguishes configuration and transport facts for the described failure. Outbound Resolver endpoints initiate DNS forwarding from AWS VPCs; an inbound endpoint alone does not redirect AWS-origin queries to corporate DNS. The corresponding action is: Create Route 53 Resolver outbound endpoint forwarding rules for intended internal domain suffixes and associate rules with every consuming VPC. This is the verification portion of the required response-evidence pair. Scenario: An internal application migrates into a new AWS account and cannot resolve corp.example.internal because the corporate forwarding rule is not associated with its VPC.

Incorrect Answers

A:

Approved environments deploy repeatable unique networks with changes reviewed before impact and conflicts detected early. This choice relates to CloudFormation parameterized network templates, not the complementary response and evidence pair for the case. Prefer: Create Route 53 Resolver outbound endpoint forwarding rules for intended internal domain suffixes and associate rules with every consuming VPC. Confirm with: Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs. Scenario: An internal application migrates into a new AWS account and cannot resolve corp.example.internal because the corporate forwarding rule is not associated with its VPC.

C:

Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names. This choice relates to Resolver inbound endpoint for AWS private zone access, not the complementary response and evidence pair for the case. Prefer: Create Route 53 Resolver outbound endpoint forwarding rules for intended internal domain suffixes and associate rules with every consuming VPC. Confirm with: Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs. Scenario: An internal application migrates into a new AWS account and cannot resolve corp.example.internal because the corporate forwarding rule is not associated with its VPC.

D:

Inspect private zone ID, creating account, association authorization, resource share, VPC ownership, DNS query path and restrictions. This choice relates to Cross-account private DNS hosted zone associations, not the complementary response and evidence pair for the case. Prefer: Create Route 53 Resolver outbound endpoint forwarding rules for intended internal domain suffixes and associate rules with every consuming VPC. Confirm with: Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs. Scenario: An internal application migrates into a new AWS account and cannot resolve corp.example.internal because the corporate forwarding rule is not associated with its VPC.

Question 341

A provider rotates the load balancer behind an endpoint service and consumers report that private DNS still resolves but TCP resets occur. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect route table associations, propagation flags, attachment states, longest-prefix matches, blackhole entries and VPC routes.
  2. Operators identify where security policy rejects traffic or transport paths differ without claiming captured application payload content.
  3. Maintain interface endpoints and provider endpoint services, monitoring acceptance, DNS, endpoint ENI and health as accounts and subnet memberships change.
  4. Maintain two Site-to-Site VPN tunnels and customer-gateway routing logic, testing failover and asymmetric path behavior under authorized maintenance.
  5. Review endpoint state, service accepted principals, endpoint policies, private DNS, SG reachability and target NLB status.

Explanation

Correct Answers

C:

Maintain interface endpoints and provider endpoint services, monitoring acceptance, DNS, endpoint ENI and health as accounts and subnet memberships change. This addresses the networking mechanism required in the scenario. Deleting or replacing a provider endpoint service changes service connectivity; an interface endpoint is not a generic peering connection. Verify it with: Review endpoint state, service accepted principals, endpoint policies, private DNS, SG reachability and target NLB status. This is the implementation portion of the required response-evidence pair. Scenario: A provider rotates the load balancer behind an endpoint service and consumers report that private DNS still resolves but TCP resets occur.

E:

Review endpoint state, service accepted principals, endpoint policies, private DNS, SG reachability and target NLB status. This distinguishes configuration and transport facts for the described failure. Deleting or replacing a provider endpoint service changes service connectivity; an interface endpoint is not a generic peering connection. The corresponding action is: Maintain interface endpoints and provider endpoint services, monitoring acceptance, DNS, endpoint ENI and health as accounts and subnet memberships change. This is the verification portion of the required response-evidence pair. Scenario: A provider rotates the load balancer behind an endpoint service and consumers report that private DNS still resolves but TCP resets occur.

Incorrect Answers

A:

Inspect route table associations, propagation flags, attachment states, longest-prefix matches, blackhole entries and VPC routes. This choice relates to Transit Gateway route changes and blackhole prevention, not the complementary response and evidence pair for the case. Prefer: Maintain interface endpoints and provider endpoint services, monitoring acceptance, DNS, endpoint ENI and health as accounts and subnet memberships change. Confirm with: Review endpoint state, service accepted principals, endpoint policies, private DNS, SG reachability and target NLB status. Scenario: A provider rotates the load balancer behind an endpoint service and consumers report that private DNS still resolves but TCP resets occur.

B:

Operators identify where security policy rejects traffic or transport paths differ without claiming captured application payload content. This choice relates to VPC Flow Logs custom fields and accepted or rejected flows, not the complementary response and evidence pair for the case. Prefer: Maintain interface endpoints and provider endpoint services, monitoring acceptance, DNS, endpoint ENI and health as accounts and subnet memberships change. Confirm with: Review endpoint state, service accepted principals, endpoint policies, private DNS, SG reachability and target NLB status. Scenario: A provider rotates the load balancer behind an endpoint service and consumers report that private DNS still resolves but TCP resets occur.

D:

Maintain two Site-to-Site VPN tunnels and customer-gateway routing logic, testing failover and asymmetric path behavior under authorized maintenance. This choice relates to Site-to-Site VPN tunnel recovery and path policy, not the complementary response and evidence pair for the case. Prefer: Maintain interface endpoints and provider endpoint services, monitoring acceptance, DNS, endpoint ENI and health as accounts and subnet memberships change. Confirm with: Review endpoint state, service accepted principals, endpoint policies, private DNS, SG reachability and target NLB status. Scenario: A provider rotates the load balancer behind an endpoint service and consumers report that private DNS still resolves but TCP resets occur.

Question 342

A design places all inspection traffic through one AZ despite service requirements to continue during that AZ's failure. Which evidence should the engineer examine FIRST to isolate the issue or confirm the assumption?

  1. Inspect GWLBe subnet routes, GWLB target health, GENEVE tunnel behavior, appliance state and AZ-specific return paths.
  2. Review firewall endpoint availability, routing symmetry, stateful rule order, flow/alert logs, drop reasons and policy associations.
  3. Review viewer protocol policy, origin protocol policy, CloudFront access logs, certificate associations and origin permission settings.
  4. Inspect endpoint type, policy principal/action/resource, identity policies, endpoint DNS, SG/NACL path and service access logs.

Explanation

Correct Answer

A:

Inspect GWLBe subnet routes, GWLB target health, GENEVE tunnel behavior, appliance state and AZ-specific return paths. This distinguishes configuration and transport facts for the described failure. An appliance having a healthy target status does not ensure return-path symmetry; routes and AZ-local endpoint placement are part of the inspection design. The corresponding action is: Implement Gateway Load Balancer endpoint traffic steering into compatible third-party inspection appliances with high availability and flow symmetry. Scenario: A design places all inspection traffic through one AZ despite service requirements to continue during that AZ's failure.

Incorrect Answers

B:

Review firewall endpoint availability, routing symmetry, stateful rule order, flow/alert logs, drop reasons and policy associations. These checks are primarily associated with AWS Network Firewall stateful egress filtering; they are less discriminating for this case. The relevant checks are: Inspect GWLBe subnet routes, GWLB target health, GENEVE tunnel behavior, appliance state and AZ-specific return paths. Scenario: A design places all inspection traffic through one AZ despite service requirements to continue during that AZ's failure.

C:

Review viewer protocol policy, origin protocol policy, CloudFront access logs, certificate associations and origin permission settings. These checks are primarily associated with CloudFront HTTPS policies and origin security; they are less discriminating for this case. The relevant checks are: Inspect GWLBe subnet routes, GWLB target health, GENEVE tunnel behavior, appliance state and AZ-specific return paths. Scenario: A design places all inspection traffic through one AZ despite service requirements to continue during that AZ's failure.

D:

Inspect endpoint type, policy principal/action/resource, identity policies, endpoint DNS, SG/NACL path and service access logs. These checks are primarily associated with Endpoint policies and least-privilege private egress; they are less discriminating for this case. The relevant checks are: Inspect GWLBe subnet routes, GWLB target health, GENEVE tunnel behavior, appliance state and AZ-specific return paths. Scenario: A design places all inspection traffic through one AZ despite service requirements to continue during that AZ's failure.

Question 343

Analysts cannot distinguish original packets from a transformed flow because their custom format omits packet source and destination fields. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Mirror supported ENI packet traffic to a controlled collector for approved incident analysis with scope filters, encryption and retention controls.
  2. Clients use approved HTTPS paths and cloud edge-to-origin transport follows required encryption policy without exposing origin publicly.
  3. Verify record format, start/end aggregation periods, flow direction, tcp-flags, action, log-status and delivery permissions.
  4. Build appropriately scoped custom VPC Flow Log records including relevant packet and interface fields to correlate network policy enforcement.
  5. Review organizational scope, policy type, resource inclusion, remediation state, compliance findings and delegated administrator status.

Explanation

Correct Answers

C:

Verify record format, start/end aggregation periods, flow direction, tcp-flags, action, log-status and delivery permissions. This distinguishes configuration and transport facts for the described failure. Flow Logs are aggregated records with selected fields, not payload capture or guaranteed one entry per individual packet. The corresponding action is: Build appropriately scoped custom VPC Flow Log records including relevant packet and interface fields to correlate network policy enforcement. This is the verification portion of the required response-evidence pair. Scenario: Analysts cannot distinguish original packets from a transformed flow because their custom format omits packet source and destination fields.

D:

Build appropriately scoped custom VPC Flow Log records including relevant packet and interface fields to correlate network policy enforcement. This addresses the networking mechanism required in the scenario. Flow Logs are aggregated records with selected fields, not payload capture or guaranteed one entry per individual packet. Verify it with: Verify record format, start/end aggregation periods, flow direction, tcp-flags, action, log-status and delivery permissions. This is the implementation portion of the required response-evidence pair. Scenario: Analysts cannot distinguish original packets from a transformed flow because their custom format omits packet source and destination fields.

Incorrect Answers

A:

Mirror supported ENI packet traffic to a controlled collector for approved incident analysis with scope filters, encryption and retention controls. This choice relates to Traffic Mirroring forensic capture access governance, not the complementary response and evidence pair for the case. Prefer: Build appropriately scoped custom VPC Flow Log records including relevant packet and interface fields to correlate network policy enforcement. Confirm with: Verify record format, start/end aggregation periods, flow direction, tcp-flags, action, log-status and delivery permissions. Scenario: Analysts cannot distinguish original packets from a transformed flow because their custom format omits packet source and destination fields.

B:

Clients use approved HTTPS paths and cloud edge-to-origin transport follows required encryption policy without exposing origin publicly. This choice relates to CloudFront HTTPS policies and origin security, not the complementary response and evidence pair for the case. Prefer: Build appropriately scoped custom VPC Flow Log records including relevant packet and interface fields to correlate network policy enforcement. Confirm with: Verify record format, start/end aggregation periods, flow direction, tcp-flags, action, log-status and delivery permissions. Scenario: Analysts cannot distinguish original packets from a transformed flow because their custom format omits packet source and destination fields.

E:

Review organizational scope, policy type, resource inclusion, remediation state, compliance findings and delegated administrator status. This choice relates to AWS Firewall Manager organization-wide audit, not the complementary response and evidence pair for the case. Prefer: Build appropriately scoped custom VPC Flow Log records including relevant packet and interface fields to correlate network policy enforcement. Confirm with: Verify record format, start/end aggregation periods, flow direction, tcp-flags, action, log-status and delivery permissions. Scenario: Analysts cannot distinguish original packets from a transformed flow because their custom format omits packet source and destination fields.

Question 344

A security platform needs to scale third-party packet inspection appliances but uses an ALB that terminates HTTP and loses the original network flow model. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Use Gateway Load Balancer with compatible GENEVE appliances and Gateway Load Balancer endpoints to scale transparent inline inspection.
  2. Review target health reason codes, protocol and port, health-check paths, target registration and AZ enablement.
  3. Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths.
  4. Required regional VPC networks communicate through intended peering paths without routing overlap or unexpected global transit.
  5. Choose a Network Load Balancer for supported TCP, TLS, UDP or TCP_UDP traffic and zonal static-address requirements.

Explanation

Correct Answers

A:

Use Gateway Load Balancer with compatible GENEVE appliances and Gateway Load Balancer endpoints to scale transparent inline inspection. This addresses the networking mechanism required in the scenario. Gateway Load Balancer uses GENEVE encapsulation for appliances; it is not a drop-in ALB replacement or ordinary public HTTP target. Verify it with: Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths. This is the implementation portion of the required response-evidence pair. Scenario: A security platform needs to scale third-party packet inspection appliances but uses an ALB that terminates HTTP and loses the original network flow model.

C:

Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths. This distinguishes configuration and transport facts for the described failure. Gateway Load Balancer uses GENEVE encapsulation for appliances; it is not a drop-in ALB replacement or ordinary public HTTP target. The corresponding action is: Use Gateway Load Balancer with compatible GENEVE appliances and Gateway Load Balancer endpoints to scale transparent inline inspection. This is the verification portion of the required response-evidence pair. Scenario: A security platform needs to scale third-party packet inspection appliances but uses an ALB that terminates HTTP and loses the original network flow model.

Incorrect Answers

B:

Review target health reason codes, protocol and port, health-check paths, target registration and AZ enablement. This choice relates to Load balancer target groups and health gating, not the complementary response and evidence pair for the case. Prefer: Use Gateway Load Balancer with compatible GENEVE appliances and Gateway Load Balancer endpoints to scale transparent inline inspection. Confirm with: Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths. Scenario: A security platform needs to scale third-party packet inspection appliances but uses an ALB that terminates HTTP and loses the original network flow model.

D:

Required regional VPC networks communicate through intended peering paths without routing overlap or unexpected global transit. This choice relates to Inter-Region Transit Gateway peering routes, not the complementary response and evidence pair for the case. Prefer: Use Gateway Load Balancer with compatible GENEVE appliances and Gateway Load Balancer endpoints to scale transparent inline inspection. Confirm with: Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths. Scenario: A security platform needs to scale third-party packet inspection appliances but uses an ALB that terminates HTTP and loses the original network flow model.

E:

Choose a Network Load Balancer for supported TCP, TLS, UDP or TCP_UDP traffic and zonal static-address requirements. This choice relates to Network Load Balancer TCP UDP and static addresses, not the complementary response and evidence pair for the case. Prefer: Use Gateway Load Balancer with compatible GENEVE appliances and Gateway Load Balancer endpoints to scale transparent inline inspection. Confirm with: Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths. Scenario: A security platform needs to scale third-party packet inspection appliances but uses an ALB that terminates HTTP and loses the original network flow model.

Question 345

Corporate resolvers forward the cloud namespace to the wrong VPC IP addresses and the new inbound endpoint sees no queries. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Configure supported Route 53 routing policies and records with stable identifiers, expected health checks, weights or latency policies and appropriate TTLs.
  2. Authorized branch overlay prefixes are learned through supported Connect peer paths with inspected routing and tunnel health.
  3. Validate inbound endpoint addresses, network routing, on-prem conditional DNS forwarder configuration, zone association and resolver query logs.
  4. Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs.
  5. Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names.

Explanation

Correct Answers

C:

Validate inbound endpoint addresses, network routing, on-prem conditional DNS forwarder configuration, zone association and resolver query logs. This distinguishes configuration and transport facts for the described failure. An inbound endpoint receives conditional queries into VPC name resolution; it does not replace authoritative corporate servers or public hosted zones. The corresponding action is: Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names. This is the verification portion of the required response-evidence pair. Scenario: Corporate resolvers forward the cloud namespace to the wrong VPC IP addresses and the new inbound endpoint sees no queries.

E:

Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names. This addresses the networking mechanism required in the scenario. An inbound endpoint receives conditional queries into VPC name resolution; it does not replace authoritative corporate servers or public hosted zones. Verify it with: Validate inbound endpoint addresses, network routing, on-prem conditional DNS forwarder configuration, zone association and resolver query logs. This is the implementation portion of the required response-evidence pair. Scenario: Corporate resolvers forward the cloud namespace to the wrong VPC IP addresses and the new inbound endpoint sees no queries.

Incorrect Answers

A:

Configure supported Route 53 routing policies and records with stable identifiers, expected health checks, weights or latency policies and appropriate TTLs. This choice relates to Weighted latency and failover Route 53 records, not the complementary response and evidence pair for the case. Prefer: Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names. Confirm with: Validate inbound endpoint addresses, network routing, on-prem conditional DNS forwarder configuration, zone association and resolver query logs. Scenario: Corporate resolvers forward the cloud namespace to the wrong VPC IP addresses and the new inbound endpoint sees no queries.

B:

Authorized branch overlay prefixes are learned through supported Connect peer paths with inspected routing and tunnel health. This choice relates to Transit Gateway Connect peer implementation, not the complementary response and evidence pair for the case. Prefer: Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names. Confirm with: Validate inbound endpoint addresses, network routing, on-prem conditional DNS forwarder configuration, zone association and resolver query logs. Scenario: Corporate resolvers forward the cloud namespace to the wrong VPC IP addresses and the new inbound endpoint sees no queries.

D:

Inspect outbound endpoint status, corporate DNS targets, rule priority and domain suffix, VPC rule associations, UDP/TCP 53 security groups and query logs. This choice relates to Resolver outbound rule with conditional corporate forwarding, not the complementary response and evidence pair for the case. Prefer: Build Route 53 Resolver inbound endpoints reachable over the approved network path so corporate DNS can query private AWS hosted zone names. Confirm with: Validate inbound endpoint addresses, network routing, on-prem conditional DNS forwarder configuration, zone association and resolver query logs. Scenario: Corporate resolvers forward the cloud namespace to the wrong VPC IP addresses and the new inbound endpoint sees no queries.

Question 346

The customer gateway changes its ASN during replacement without updating the BGP peer settings and the VPN starts passing no dynamic routes. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Authorized spokes reach shared services while protected environments lack unintended transitive reachability.
  2. Provision a Direct Connect connection through the authorized location, complete cross-connect paperwork, and configure VIF VLAN tagging and compatible BGP peering.
  3. Configure both AWS Site-to-Site VPN tunnels with appropriate BGP or supported static prefixes and validate routing failover on each customer gateway.
  4. Inspect tunnel outside IPs, IKE/IPsec phases, tunnel status, BGP peers, advertised CIDRs and gateway route preference.
  5. Review DX VIF reachability to VPN endpoint public IPs, IKE proposals, tunnel BGP routes, MTU/MSS and encryption evidence.

Explanation

Correct Answers

C:

Configure both AWS Site-to-Site VPN tunnels with appropriate BGP or supported static prefixes and validate routing failover on each customer gateway. This addresses the networking mechanism required in the scenario. A Site-to-Site VPN normally exposes two tunnels for availability; a configured backup tunnel is useless if routes never shift when the active tunnel fails. Verify it with: Inspect tunnel outside IPs, IKE/IPsec phases, tunnel status, BGP peers, advertised CIDRs and gateway route preference. This is the implementation portion of the required response-evidence pair. Scenario: The customer gateway changes its ASN during replacement without updating the BGP peer settings and the VPN starts passing no dynamic routes.

D:

Inspect tunnel outside IPs, IKE/IPsec phases, tunnel status, BGP peers, advertised CIDRs and gateway route preference. This distinguishes configuration and transport facts for the described failure. A Site-to-Site VPN normally exposes two tunnels for availability; a configured backup tunnel is useless if routes never shift when the active tunnel fails. The corresponding action is: Configure both AWS Site-to-Site VPN tunnels with appropriate BGP or supported static prefixes and validate routing failover on each customer gateway. This is the verification portion of the required response-evidence pair. Scenario: The customer gateway changes its ASN during replacement without updating the BGP peer settings and the VPN starts passing no dynamic routes.

Incorrect Answers

A:

Authorized spokes reach shared services while protected environments lack unintended transitive reachability. This choice relates to Transit Gateway attachment routing associations and propagation, not the complementary response and evidence pair for the case. Prefer: Configure both AWS Site-to-Site VPN tunnels with appropriate BGP or supported static prefixes and validate routing failover on each customer gateway. Confirm with: Inspect tunnel outside IPs, IKE/IPsec phases, tunnel status, BGP peers, advertised CIDRs and gateway route preference. Scenario: The customer gateway changes its ASN during replacement without updating the BGP peer settings and the VPN starts passing no dynamic routes.

B:

Provision a Direct Connect connection through the authorized location, complete cross-connect paperwork, and configure VIF VLAN tagging and compatible BGP peering. This choice relates to Direct Connect LOA VLAN and BGP bring-up, not the complementary response and evidence pair for the case. Prefer: Configure both AWS Site-to-Site VPN tunnels with appropriate BGP or supported static prefixes and validate routing failover on each customer gateway. Confirm with: Inspect tunnel outside IPs, IKE/IPsec phases, tunnel status, BGP peers, advertised CIDRs and gateway route preference. Scenario: The customer gateway changes its ASN during replacement without updating the BGP peer settings and the VPN starts passing no dynamic routes.

E:

Review DX VIF reachability to VPN endpoint public IPs, IKE proposals, tunnel BGP routes, MTU/MSS and encryption evidence. This choice relates to VPN over Direct Connect for encrypted hybrid connectivity, not the complementary response and evidence pair for the case. Prefer: Configure both AWS Site-to-Site VPN tunnels with appropriate BGP or supported static prefixes and validate routing failover on each customer gateway. Confirm with: Inspect tunnel outside IPs, IKE/IPsec phases, tunnel status, BGP peers, advertised CIDRs and gateway route preference. Scenario: The customer gateway changes its ASN during replacement without updating the BGP peer settings and the VPN starts passing no dynamic routes.

Question 347

A TCP service exhibits high retransmission rates and engineers attempt to diagnose sequence gaps from five-minute VPC Flow Log aggregates alone. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect mirror session filters, target status, capture timestamps, TCP retransmits, sequence numbers, MTU and traffic sampling.
  2. Planned growth completes without quota errors or silent route advertisement truncation.
  3. Capture supported EC2 ENI traffic through VPC Traffic Mirroring into controlled analysis infrastructure when packet contents or flags are needed.
  4. Use VPC Flow Logs and optional custom fields to correlate source, destination, traffic direction, flow action and relevant network interface.
  5. Inspect DF-bit probes, ICMP fragmentation feedback, tunnel encapsulation, ENI MTU, jumbo frame support and packet traces.

Explanation

Correct Answers

A:

Inspect mirror session filters, target status, capture timestamps, TCP retransmits, sequence numbers, MTU and traffic sampling. This distinguishes configuration and transport facts for the described failure. Flow Logs summarize flows, whereas Traffic Mirroring enables packet-level inspection; not every AWS resource supports mirroring. The corresponding action is: Capture supported EC2 ENI traffic through VPC Traffic Mirroring into controlled analysis infrastructure when packet contents or flags are needed. This is the verification portion of the required response-evidence pair. Scenario: A TCP service exhibits high retransmission rates and engineers attempt to diagnose sequence gaps from five-minute VPC Flow Log aggregates alone.

C:

Capture supported EC2 ENI traffic through VPC Traffic Mirroring into controlled analysis infrastructure when packet contents or flags are needed. This addresses the networking mechanism required in the scenario. Flow Logs summarize flows, whereas Traffic Mirroring enables packet-level inspection; not every AWS resource supports mirroring. Verify it with: Inspect mirror session filters, target status, capture timestamps, TCP retransmits, sequence numbers, MTU and traffic sampling. This is the implementation portion of the required response-evidence pair. Scenario: A TCP service exhibits high retransmission rates and engineers attempt to diagnose sequence gaps from five-minute VPC Flow Log aggregates alone.

Incorrect Answers

B:

Planned growth completes without quota errors or silent route advertisement truncation. This choice relates to AWS network service quota and route-scale management, not the complementary response and evidence pair for the case. Prefer: Capture supported EC2 ENI traffic through VPC Traffic Mirroring into controlled analysis infrastructure when packet contents or flags are needed. Confirm with: Inspect mirror session filters, target status, capture timestamps, TCP retransmits, sequence numbers, MTU and traffic sampling. Scenario: A TCP service exhibits high retransmission rates and engineers attempt to diagnose sequence gaps from five-minute VPC Flow Log aggregates alone.

D:

Use VPC Flow Logs and optional custom fields to correlate source, destination, traffic direction, flow action and relevant network interface. This choice relates to VPC Flow Logs custom fields and accepted or rejected flows, not the complementary response and evidence pair for the case. Prefer: Capture supported EC2 ENI traffic through VPC Traffic Mirroring into controlled analysis infrastructure when packet contents or flags are needed. Confirm with: Inspect mirror session filters, target status, capture timestamps, TCP retransmits, sequence numbers, MTU and traffic sampling. Scenario: A TCP service exhibits high retransmission rates and engineers attempt to diagnose sequence gaps from five-minute VPC Flow Log aggregates alone.

E:

Inspect DF-bit probes, ICMP fragmentation feedback, tunnel encapsulation, ENI MTU, jumbo frame support and packet traces. This choice relates to Packet MTU MSS and Path MTU Discovery, not the complementary response and evidence pair for the case. Prefer: Capture supported EC2 ENI traffic through VPC Traffic Mirroring into controlled analysis infrastructure when packet contents or flags are needed. Confirm with: Inspect mirror session filters, target status, capture timestamps, TCP retransmits, sequence numbers, MTU and traffic sampling. Scenario: A TCP service exhibits high retransmission rates and engineers attempt to diagnose sequence gaps from five-minute VPC Flow Log aggregates alone.

Question 348

Engineers replace a central Transit Gateway route table in one operation and lose all branch connectivity because no staged rollout or rollback was prepared. Which evidence should the engineer examine FIRST to isolate the issue or confirm the assumption?

  1. Inspect template parameter values, change sets, route dependencies, stack outputs, drift state and failure/rollback events.
  2. Inspect pipeline approvals, intended route diff, Reachability Analyzer outcomes, CloudWatch signals, revert plan and postdeployment packet tests.
  3. Inspect resource configuration timeline, CloudFormation stack state, Config evaluation, rule evidence and change approval records.
  4. Examine AWS RAM resource shares, acceptance state, organizational sharing, central route tables, participant permissions and audit events.

Explanation

Correct Answer

B:

Inspect pipeline approvals, intended route diff, Reachability Analyzer outcomes, CloudWatch signals, revert plan and postdeployment packet tests. This distinguishes configuration and transport facts for the described failure. A valid IaC template does not guarantee a live network route works; static reachability analysis should be complemented by runtime tests. The corresponding action is: Gate network IaC deployment on route reachability tests, reviewed changes, canary application checks and documented rollback with independent health metrics. Scenario: Engineers replace a central Transit Gateway route table in one operation and lose all branch connectivity because no staged rollout or rollback was prepared.

Incorrect Answers

A:

Inspect template parameter values, change sets, route dependencies, stack outputs, drift state and failure/rollback events. These checks are primarily associated with CloudFormation parameterized network templates; they are less discriminating for this case. The relevant checks are: Inspect pipeline approvals, intended route diff, Reachability Analyzer outcomes, CloudWatch signals, revert plan and postdeployment packet tests. Scenario: Engineers replace a central Transit Gateway route table in one operation and lose all branch connectivity because no staged rollout or rollback was prepared.

C:

Inspect resource configuration timeline, CloudFormation stack state, Config evaluation, rule evidence and change approval records. These checks are primarily associated with Network configuration drift and guardrail audits; they are less discriminating for this case. The relevant checks are: Inspect pipeline approvals, intended route diff, Reachability Analyzer outcomes, CloudWatch signals, revert plan and postdeployment packet tests. Scenario: Engineers replace a central Transit Gateway route table in one operation and lose all branch connectivity because no staged rollout or rollback was prepared.

D:

Examine AWS RAM resource shares, acceptance state, organizational sharing, central route tables, participant permissions and audit events. These checks are primarily associated with AWS RAM shared networking across accounts; they are less discriminating for this case. The relevant checks are: Inspect pipeline approvals, intended route diff, Reachability Analyzer outcomes, CloudWatch signals, revert plan and postdeployment packet tests. Scenario: Engineers replace a central Transit Gateway route table in one operation and lose all branch connectivity because no staged rollout or rollback was prepared.

Question 349

A compliance review discovers that the ALB terminates TLS but forwards plaintext HTTP to backends over a network segment required to be encrypted. Which TWO complementary choices provide both the appropriate response AND the key evidence for verifying it? Select TWO.

  1. On-premises and AWS private prefixes remain reachable after a planned circuit failure within the agreed recovery objective.
  2. Decide where TLS terminates and whether backend re-encryption is required, using appropriate ACM certificates and supported target protocols.
  3. Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths.
  4. Select an Application Load Balancer with HTTP host/path rules and AWS WAF integration for public layer-seven web applications.
  5. Inspect listener certificates and policies, backend protocol, negotiated versions, target TLS configuration and end-to-end packet paths.

Explanation

Correct Answers

B:

Decide where TLS terminates and whether backend re-encryption is required, using appropriate ACM certificates and supported target protocols. This addresses the networking mechanism required in the scenario. HTTPS from client to ALB does not imply traffic is automatically encrypted from ALB to every downstream target. Verify it with: Inspect listener certificates and policies, backend protocol, negotiated versions, target TLS configuration and end-to-end packet paths. This is the implementation portion of the required response-evidence pair. Scenario: A compliance review discovers that the ALB terminates TLS but forwards plaintext HTTP to backends over a network segment required to be encrypted.

E:

Inspect listener certificates and policies, backend protocol, negotiated versions, target TLS configuration and end-to-end packet paths. This distinguishes configuration and transport facts for the described failure. HTTPS from client to ALB does not imply traffic is automatically encrypted from ALB to every downstream target. The corresponding action is: Decide where TLS terminates and whether backend re-encryption is required, using appropriate ACM certificates and supported target protocols. This is the verification portion of the required response-evidence pair. Scenario: A compliance review discovers that the ALB terminates TLS but forwards plaintext HTTP to backends over a network segment required to be encrypted.

Incorrect Answers

A:

On-premises and AWS private prefixes remain reachable after a planned circuit failure within the agreed recovery objective. This choice relates to Direct Connect plus VPN hybrid resilience, not the complementary response and evidence pair for the case. Prefer: Decide where TLS terminates and whether backend re-encryption is required, using appropriate ACM certificates and supported target protocols. Confirm with: Inspect listener certificates and policies, backend protocol, negotiated versions, target TLS configuration and end-to-end packet paths. Scenario: A compliance review discovers that the ALB terminates TLS but forwards plaintext HTTP to backends over a network segment required to be encrypted.

C:

Verify GENEVE port and encapsulation, appliance target health, endpoint routes and traffic symmetry across inspection paths. This choice relates to Gateway Load Balancer appliances and GENEVE, not the complementary response and evidence pair for the case. Prefer: Decide where TLS terminates and whether backend re-encryption is required, using appropriate ACM certificates and supported target protocols. Confirm with: Inspect listener certificates and policies, backend protocol, negotiated versions, target TLS configuration and end-to-end packet paths. Scenario: A compliance review discovers that the ALB terminates TLS but forwards plaintext HTTP to backends over a network segment required to be encrypted.

D:

Select an Application Load Balancer with HTTP host/path rules and AWS WAF integration for public layer-seven web applications. This choice relates to Application Load Balancer HTTP routing and WAF, not the complementary response and evidence pair for the case. Prefer: Decide where TLS terminates and whether backend re-encryption is required, using appropriate ACM certificates and supported target protocols. Confirm with: Inspect listener certificates and policies, backend protocol, negotiated versions, target TLS configuration and end-to-end packet paths. Scenario: A compliance review discovers that the ALB terminates TLS but forwards plaintext HTTP to backends over a network segment required to be encrypted.

Question 350

A troubleshooting team needs to inspect retransmissions and TCP options but collects only VPC Flow Logs without any packet-capture mechanism. Which evidence should the engineer examine FIRST to isolate the issue or confirm the assumption?

  1. Review VPC association authorization, account ownership, private zone names and test resolution from allowed VPC resolver contexts.
  2. Review mirror source target and filter, ENI support, target capture health, packet encapsulation and data classification.
  3. Correlate CloudFront request IDs, ALB access log fields, DNS query logs, origin response times and encrypted log retention.
  4. Inspect logging attachment scope, aggregation interval, source and destination fields, action, log status and delivery destination.

Explanation

Correct Answer

B:

Review mirror source target and filter, ENI support, target capture health, packet encapsulation and data classification. This distinguishes configuration and transport facts for the described failure. Traffic Mirroring provides packet copies for supported resources; it is distinct from aggregated metadata records in VPC Flow Logs. The corresponding action is: Configure VPC Traffic Mirroring with a supported source ENI and destination for packet-oriented analysis when detailed headers are required. Scenario: A troubleshooting team needs to inspect retransmissions and TCP options but collects only VPC Flow Logs without any packet-capture mechanism.

Incorrect Answers

A:

Review VPC association authorization, account ownership, private zone names and test resolution from allowed VPC resolver contexts. These checks are primarily associated with Private hosted zones and VPC associations; they are less discriminating for this case. The relevant checks are: Review mirror source target and filter, ENI support, target capture health, packet encapsulation and data classification. Scenario: A troubleshooting team needs to inspect retransmissions and TCP options but collects only VPC Flow Logs without any packet-capture mechanism.

C:

Correlate CloudFront request IDs, ALB access log fields, DNS query logs, origin response times and encrypted log retention. These checks are primarily associated with ELB CloudFront and Route 53 log correlation; they are less discriminating for this case. The relevant checks are: Review mirror source target and filter, ENI support, target capture health, packet encapsulation and data classification. Scenario: A troubleshooting team needs to inspect retransmissions and TCP options but collects only VPC Flow Logs without any packet-capture mechanism.

D:

Inspect logging attachment scope, aggregation interval, source and destination fields, action, log status and delivery destination. These checks are primarily associated with VPC Flow Logs monitoring coverage and fields; they are less discriminating for this case. The relevant checks are: Review mirror source target and filter, ENI support, target capture health, packet encapsulation and data classification. Scenario: A troubleshooting team needs to inspect retransmissions and TCP options but collects only VPC Flow Logs without any packet-capture mechanism.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests