This is the free Amazon ANS-C01 practice question bank —
140 of 269 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company is establishing hybrid cloud connectivity from an on-premises environment to AWS in the us-east-1 Region. The company is using a 10 Gbps AWS Direct Connect dedicated connection. The company has two accounts in AWS. Account A has transit gateways in four AWS Regions. Account В has transit gateways in three Regions. The company does not plan to expand.
To meet security requirements the company's accounts must have separate cloud infrastructure.
Which solution will meet these requirements MOST cost-effectively?
A. Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account Associate the four transit gateways in Account A to the Direct Connect gateway. Create a transit VIF for Account B. Associate the three transit gateways in Account В to the Direct Connect gateway.
B. Create one Direct Connect gateway in us-east-1 for Account A. Create a second Direct Connect gateway in us-east-1 for Account Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway in Account A. Create a transit VIF for Account Associate the three transit gateways in Account В to the Direct Connect gateway in Account В.
C. Create one Direct Connect gateway in us-east-1. Use AWS Resource Access Manager (AWS RAM) to share the Direct Connect gateway with each account. Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway. Order a new 10 Gbps Direct Connect dedicated connection for Account B. Create a transit VIF on the new Direct Connect connection for Account B. Associate the three transit gateways in Account В to the Direct Connect gateway.
D. Create one Direct Connect gateway in us-east-1 for Account A. Create a second Direct Connect gateway in us-east-1 for Account B. Create a transit VIF for Account A. Associate the four transit gateways in Account A to the Direct Connect gateway in Account A. Order a new 10 Gbps Direct Connect dedicated connection for Account В. Create a transit VIF on the new Direct Connect connection for Account В. Associate the three transit gateways in Account В to the Direct Connect gateway in Account В.
Show Answer
Correct Answer: B
Explanation: A single Direct Connect gateway can be associated with a maximum of 6 transit gateways. The company needs to connect 7 transit gateways total (4 in Account A and 3 in Account B), which exceeds this limit. Therefore, two separate Direct Connect gateways are required—one per account—while still using the same 10 Gbps Direct Connect dedicated connection. This meets the security requirement for separate cloud infrastructure and avoids the cost of ordering an additional Direct Connect connection, making option B the most cost-effective solution.
Question 1
A company operates in the us-east-1 Region and the us-west-1 Region. The company is designing a solution to connect an on-premises data center to the company's AWS environment in us-east-1. The solution uses two AWS Direct Connect connections.
Traffic from us-west-1 to the data center needs to traverse the Direct Connect connections. A network engineer needs to set up active-passive functionality across the two Direct Connect connections by using a Direct Connect gateway to influence inbound traffic from VPCs that are in us-west-1 to the data center.
Which solution will meet these requirements?
A. At the data center, set the local preference for the primary connection to be higher than the local preference for the secondary connection.
B. Use AS path prepending to set the AS path on the primary connection to be longer than the AS path on the secondary connection.
C. Use local preference BGP community tags to apply the 7224:7300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:7100 local preference BGP community tag to the prefixes for the secondary connection.
D. Use local preference BGP community tags to apply the 7224:9300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:9100 local preference BGP community tag to the prefixes for secondary connection.
Show Answer
Correct Answer: C
Explanation: To influence inbound traffic from AWS VPCs toward the on-premises data center over multiple Direct Connect connections, AWS requires the use of AWS-specific local preference BGP community tags on routes advertised from the data center. These communities control how AWS selects the preferred Direct Connect path before considering other BGP attributes.
Community values:
- 7224:7300 = High preference
- 7224:7200 = Medium preference
- 7224:7100 = Low preference
For an active-passive design, the primary Direct Connect connection must have a higher local preference than the secondary connection. Option C correctly applies 7224:7300 (high) to the primary connection and 7224:7100 (low) to the secondary connection. Options A and B do not influence AWS inbound path selection from VPCs, and option D uses invalid community values for Direct Connect local preference.
Question 2
A company has two AWS Direct Connect connections between Direct Connect locations and the company's on-premises environment in the US. The company uses the connections to communicate with AWS workloads that run in the us-east-1 Region. The company has a transit gateway that connects several VPCs. The Direct Connect connections terminate at a Direct Connect gateway and the transit VIFs to the transit gateway.
The company recently acquired a smaller company that is based in Europe. The newly acquired company has only on-premises workloads. The newly acquired company does not expect to run workloads on AWS for the next 3 years. However, the newly acquired company requires connectivity to the parent company's AWS resources in us-east-1 and to the parent company's on-premises environment in the US. The parent company wants to use two new Direct Connect connections in Europe to provide the required connectivity.
Which solution will meet these requirements with the LEAST operational overhead for the newly acquired company?
A. Associate new transit VIFs to the existing Direct Connect gateway. Configure the new transit VIFs to use Direct Connect SiteLink.
B. Associate new transit VIFs to a new Direct Connect gateway and to a new transit gateway in the eu-west-1 Region. Use transit gateway peering to connect the transit gateways.
C. Associate new private VIFs to the existing Direct Connect gateway. Configure the existing transit VIFs and the new private VIFs to use Direct Connect SiteLink.
D. Associate new private VIFs to a new Direct Connect gateway and to a new VPC in us-east-1. Configure the existing transit VIFs and the new private VIFs to use Direct Connect SiteLink and AWS PrivateLink endpoints in the new VPC.
Show Answer
Correct Answer: A
Explanation: Using new transit VIFs in Europe associated with the existing Direct Connect gateway and enabling Direct Connect SiteLink allows private, any-to-any connectivity between on-premises locations and AWS without deploying additional transit gateways, VPCs, or peering. This meets the requirement for connectivity to us-east-1 AWS resources and the US on-premises network with the least operational overhead. Other options add unnecessary gateways, regions, VPCs, or PrivateLink complexity.
Question 4
A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment.
Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)
A. Create a public certificate in AWS Certificate Manager (ACM).
B. Create a private certificate in AWS Certificate Manager (ACM).
C. Configure the Site-to-Site VPN tunnels to use the pre-shared key (PSK).
D. Create a customer gateway. Specify the current dynamic IP address of the customer gateway device's external interface.
E. Create a customer gateway. Do not specify the IP address of the customer gateway device.
Show Answer
Correct Answer: B, E
Explanation: Certificate-based AWS Site-to-Site VPN requires certificates issued from a private CA in AWS Certificate Manager, not public ACM certificates or PSKs. When the on-premises endpoint has a dynamic public IP address, the customer gateway must be created without specifying an IP address so the VPN can be established using certificate-based authentication without relying on a fixed peer IP.
Question 5
A company has two teams: Team A and Team B. Team A has VPCs that run in Account A. The team uses a transit gateway (TGW-A) to route traffic between workloads that run in the different VPCs. Similarly, Team В has VPCs that run in Account B. Team В uses a different transit gateway (TGW-B) to route traffic between workloads that run in the different VPCs.
The company's network team manages the routing for Team A and Team В. The network team wants to retire TGW-B and use a single transit gateway to manage routing for the VPCs of both teams.
Which solution will meet this requirement with the LEAST operational overhead?
A. Create a resource share for TGW-A Share TGW-A with Account B. Create VPC attachments for the VPCs in Account В. Configure routing for the VPCs in TGW-A route tables. Update the route tables of the VPCs in Account В to forward traffic to TGW-Delete TGW-B attachments and TGW-B.
B. Create a resource share for TGW-A. Share TGW-A with Account В. Replicate the TGW-B configuration to TGW-A to automatically start routing changes for the VPCs in Account В. Delete TGW-B when routing changes are complete.
C. Create a new transit gateway (TGW-C) in Account A. Create a resource share for TGW-Share TGW-C with Account B. Create VPC attachments for the VPCs in Account A and Account В. Configure routing for all the VPCs in TGW-C route tables. Update the route tables for the VPCs in Account A and Account В to forward traffic to TGW-Delete TGW-A attachments and TGW-B attachments. Delete TGW-A and TGW-B.
D. Create a new transit gateway (TGW-C) in a new account (Account C). Create a resource share for TGW-C. Share TGW-C with Account A and Account B. Create VPC attachments for the VPCs in Account A and Account В. Configure routing for all the VPCs in TGW-C route tables. Update the route tables for the VPCs in Account A and Account В to forward traffic to TGW-C. Delete TGW-A attachments and TGW-B attachments. Delete TGW-A and TGW-B.
Show Answer
Correct Answer: A
Explanation: The goal is to consolidate routing onto a single transit gateway with the least operational overhead. Reusing the existing TGW-A and sharing it with Account B through AWS Resource Access Manager avoids creating and migrating to a new transit gateway. Account B’s VPCs can be attached directly to TGW-A, routing can be configured in existing TGW-A route tables, and TGW-B can then be retired. The other options require building and migrating to a brand-new transit gateway, which adds unnecessary complexity and overhead.
Question 6
A company operates in multiple AWS Regions. The company has deployed transit gateways in each Region. The company uses AWS Organizations to operate multiple AWS accounts in one organization.
The company needs to capture all VPC flow log data when a new VPC is created. The company needs to send flow logs to a specific Amazon S3 bucket.
Which solution will meet these requirements with the LEAST administrative effort?
A. Update IAM permissions for each user to include a condition that ensures users can create VPCs only when VPC Flow Logs is enabled and configured correctly.
B. Create a custom AWS Config rule with automatic remediation that verifies VPC Flow Logs is enabled and configured correctly. Apply the AWS Config rule to the organization.
C. Enable VPC Flow Logs on each transit gateway. Configure VPC Flow Logs to send flow logs to the specified S3 bucket.
D. Deploy a serverless application that uses AWS CloudTrail to monitor for VPC creation events in each account. Configure the application to apply the correct VPC Flow Logs configuration.
Show Answer
Correct Answer: B
Explanation: An AWS Config custom rule with automatic remediation can be applied organization-wide through AWS Organizations, ensuring that every newly created VPC has Flow Logs enabled and configured to deliver to the specified S3 bucket. This provides centralized governance and automatic enforcement with minimal ongoing administrative effort, unlike per-user IAM controls, transit gateway logs, or custom CloudTrail-based automation.
Question 7
A media company is planning to host an event that the company will live stream to users. The company wants to use Amazon CloudFront.
A network engineer creates a primary origin and a secondary origin for CloudFront. The engineer needs to ensure that the primary origin can fail over to the secondary origin within 15 seconds if a disruption occurs.
Which solution will meet this requirement with the LEAST operational overhead?
A. Configure a Lambda@Edge function to check the health status of both origins every 10 seconds. Reroute incoming requests when the origin health status is unhealthy.
B. Create a Network Load Balancer (NLB) in front of both origins Configure the NLB as the origin in CloudFront.
C. Set the CloudFront origin connection timeout value to 5 seconds Set the origin connection attempts value to 2.
D. Configure a Lambda@Edge function to monitor incoming requests for an origin response. Reroute incoming requests if no response is received from the primary origin within 10 seconds.
Show Answer
Correct Answer: C
Explanation: Amazon CloudFront natively supports origin failover between a primary and secondary origin with minimal configuration. Failover timing is controlled by the origin connection timeout and origin connection attempts. Setting the timeout to 5 seconds and the attempts to 2 means CloudFront will try the primary origin twice (up to 10 seconds total). If both attempts fail, CloudFront automatically fails over to the secondary origin, well within the 15‑second requirement and with the least operational overhead compared to custom Lambda@Edge logic or additional load balancers.
Question 9
A company runs an application across multiple AWS Regions and multiple Availability Zones. The company needs to expand to a new AWS Region. Low latency is critical to the functionality of the application.
A network engineer needs to gather metrics for the latency between the existing. Regions and the new Region. The network engineer must gather metrics for at least the previous 30 days.
Which solution will meet these requirements?
A. Configure an AWS Network Access Analyzer Network Access Scope, and use the analysis to review the latency.
B. Set up AWS Network Manager Infrastructure Performance. Publish network performance metrics to Amazon CloudWatch.
C. Use an Amazon VPC Reachability Analyzer path to review the latency.
D. Set up VPC Flow Logs. Publish log metrics to Amazon CloudWatch.
Show Answer
Correct Answer: B
Explanation: AWS Network Manager Infrastructure Performance is specifically designed to measure and monitor network performance, including latency, between AWS Regions and Availability Zones. It publishes these metrics to Amazon CloudWatch, where they can be retained and analyzed for at least the previous 30 days. The other options focus on connectivity analysis or traffic logging and do not provide historical inter-Region latency metrics.
Question 10
A company has 10 Amazon EC2 instances that run web server software in a production VPC. The company also has 10 web servers that run in an on-premises data center. The company has a 10 Gbps AWS Direct Connect connection between the on-premises data center and the production VPC. The data center uses the 10.100.0.0/20 CIDR block.
The company needs to implement a load balancing solution that receives HTTPS traffic from thousands of external users. The solution must distribute the traffic across the web servers on AWS and the web servers in the data center. Regardless of the location of the web servers, HTTPS requests must go to the same web server for the duration of the session.
Which solution will meet these requirements?
A. Deploy a Network Load Balancer (NLB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify IP as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable connection draining on the NLB.
B. Deploy an Application Load Balancer (ALB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify IP as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable application-based sticky sessions on the AL
C. Deploy a Network Load Balancer (NLB) in the production VPCreate one target group for the EC2 Instances and a second target group for the on-premises servers. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable sticky sessions on the NLB.
D. Deploy an Application Load Balancer (ALB) in the production VPC. Create one target group for the EC2 Instances and a second target group for the on-premises servers. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target groups. Enable application-based sticky sessions on the ALB.
Show Answer
Correct Answer: B
Explanation: An Application Load Balancer supports HTTPS at Layer 7 and provides application-based sticky sessions to ensure session affinity. Using IP as the target type allows registering both EC2 instances and on-premises servers over Direct Connect. Network Load Balancers do not provide application-level sticky sessions for HTTPS, and instance target types cannot register on-premises servers.
Question 11
A company runs workloads in multiple VPCs in the us-east-1 Region. The VPCs are connected to a transit gateway. An AWS Direct Connect connection provides private connectivity between a data center that is in the US and the transit gateway. A Direct Connect gateway is associated with the transit gateway.
The company has recently opened a new office location in London. The company plans to launch cloud services in multiple VPCs in the eu-west-2 Region. Users in the new London office must have private access to the workloads that run in us-east-1. Users in the US data center must have access to any workloads that are created in eu-west-2. A network engineer must implement a flexible solution that provides users the required access. The solution must be able to accommodate future growth.
Which solution will meet these requirements with the LEAST operational effort?
A. Create an AWS Site-to-Site VPN connection from the London office to the Direct Connect gateway in us-east-1.
B. Establish a new Direct Connect connection for the London office. Attach the new Direct Connect connection to the existing Direct Connect gateway. Create a transit gateway in eu-west-2. Associate the new transit gateway with the existing Direct Connect gateway. Create a peering connection between the transit gateways in us-east-1 and eu-west-2.
C. Create an AWS Site-to-Site VPN connection from the London office to each of the VPCs that are in us-east-1.
D. Establish a new AWS Direct Connect connection for the London office Create a new Direct Connect gateway and a transit gateway in eu-west-2. Attach the new Direct Connect connection to the new Direct Connect gateway. Create a peering connection between the transit gateways in us-east-1 and eu-west-2.
Show Answer
Correct Answer: B
Explanation: Option B leverages AWS native global networking constructs with the least ongoing management. A Direct Connect gateway is a global resource, so a new Direct Connect connection from London can be attached to the existing Direct Connect gateway. By associating that gateway with transit gateways in both us-east-1 and eu-west-2, and peering the two transit gateways, private connectivity is established between the US data center, the London office, and all VPCs in both Regions. This design is scalable, supports future VPC growth, and avoids managing multiple VPNs or unnecessary additional Direct Connect gateways.
$19
Get all 269 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.