This is the free Amazon ANS-C01 practice question bank —
150 of 288 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-05.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company hosts multiple workloads in a single VPC that has public subnets and private subnets. The company establishes an AWS Direct Connect connection to provide connectivity between the company’s on-premises network and the VPC.
The company purchases a domain in its AWS account. The domain needs to resolve to a private Application Load Balancer (ALB) for requests that originate from the company's network. The domain needs to resolve to a public ALB for requests that originate from the internet.
Which solution will meet these requirements?
A. Create an Amazon CloudFront distribution for the domain. Create an AWS Lambda@Edge function that inspects each request and routes requests from the internet to the public ALB. Configure the Lambda@Edge function to route requests from the company’s network to the private ALB. Create an Amazon Route 53 public hosted zone for the domain. Include an A record that is configured as an alias that points to the CloudFront distribution.
B. Create an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALCreate a Route 53 private hosted zone for the domain. Include an alias record that points to the private ALConfigure a Route 53 inbound resolver endpoint on the VPC. Configure the company's network DNS to forward queries for the domain to the endpoint.
C. Create an Amazon Route 53 public hosted zone for the domain. Include an alias record that points to the public ALB. Create an additional alias record for the domain that routes to the private ALB. Associate a geolocation routing policy with the CIDR range of the company’s network.
D. Deploy new Amazon EC2 instances that host DNS servers in each of the private subnets. Configure the DNS servers to return the IP address of the public ALB for requests from the internet. Configure the DNS servers to return the IP address of the private ALB for requests from the company’s network. Configure a public Amazon Route 53 inbound resolver to forward all requests for the domain to the EC2 instances. Enable client IP preservation.
Show Answer
Correct Answer: B
Explanation: Use split-horizon DNS with Route 53. A public hosted zone for the domain returns the public ALB to internet clients. A private hosted zone with the same domain returns the private ALB to VPC-associated clients. For on-premises clients over Direct Connect, configure a Route 53 Resolver inbound endpoint and forward DNS queries for the domain from the on-premises DNS servers to that endpoint so they receive answers from the private hosted zone.
Question 2
A company uses AWS Cloud WAN as a primary connectivity solution to establish communication between VPCs in a multi-account and multi-Region environment. The company has created an attachment policy statement in the AWS Cloud WAN core network policy. The attachment policy requires acceptance for new VPC attachments, regardless of the segment that the new VPC attachment needs to be associated with.
The company wants to automate acceptance for new VPC attachments based on specific conditions. The company creates an AWS Lambda function to check for the specific conditions. A network engineer must integrate the Lambda function with the company’s existing architecture.
Which solution will meet these requirements in the MOST cost-effective way?
A. Update the AWS Cloud WAN core network policy to create a network function group. Select the require acceptance option. Create a service insertion segment action that targets the Lambda function.
B. Create an Amazon EventBridge rule to match AWS Network Manager events for the VPC attachments. Configure the EventBridge rule to invoke the Lambda function when the rule matches.
C. Use Amazon CloudWatch logs to stream AWS CloudTrail logs to an Amazon Kinesis data stream. Configure an event source mapping to target the Lambda function to process the event stream.
D. Configure AWS Network Manager as a source for a pipe in Amazon EventBridge Pipes. Create a filter in the pipe for new VPC attachments. Set the Lambda function as the target of the pipe.
Show Answer
Correct Answer: B
Explanation: AWS Network Manager emits events that can be matched by Amazon EventBridge. An EventBridge rule can filter for new Cloud WAN VPC attachment events and invoke a Lambda function, which can evaluate conditions and call the appropriate API to accept the attachment. This is event-driven, simple, and cost-effective. Service insertion is unrelated to Lambda-based acceptance automation, CloudTrail/Kinesis adds unnecessary cost and complexity, and EventBridge Pipes require a supported event source rather than directly consuming Network Manager events.
Question 3
A company has an AWS Direct Connect connection between an on-premises data center and a single private VIF in the company's VPC. The VPC contains resources that the company has secured by using security groups and network ACLs.
A network engineer adds a subnet in the company's data center during a maintenance period. The network engineer notices that the BGP status for the private VIF is down after the maintenance activity. The Direct Connect connection was fully operational before the maintenance period. The network team verifies that layer 2 connectivity is working between the company’s router and the Direct Connect router.
The networking engineer must resolve this issue.
Which solution will meet this requirement?
A. Use route filters or aggregation on the company's router to limit the routes that are advertised from the company’s router.
B. Add a route policy to the company's router to ensure that all routes that are advertised from the company's router are tagged with a correct BGP community string that begins in "7224".
C. Revalidate the physical and logical path between the company's router and the Direct Connect router, including any Direct Connect Partner.
D. Ensure that security groups and network ACLs allow TCP communications to port 179.
Show Answer
Correct Answer: A
Explanation: The most likely cause is that adding a new on-premises subnet increased the number of prefixes advertised over the private VIF beyond AWS Direct Connect route limits. When too many routes are advertised, AWS can drop the BGP session. Limiting or aggregating the advertised routes with route filters or summarization restores the BGP session. BGP communities beginning with 7224 are optional for routing policy and do not establish the session. Layer 2 has already been verified, making physical path issues unlikely. Security groups and network ACLs do not filter the Direct Connect BGP peering itself.
Question 4
A company has two on-premises data center locations named Data Center 1 and Data Center 2. Each data center has a company-managed customer router. Both data centers have a dedicated AWS Direct Connect connection to the same Direct Connect gateway that uses a private VIF. The company enabled Direct Connect SiteLink when the company created each private VIF. The company uses SiteLink to send data from one Direct Connect location to the other, bypassing AWS Regions.
Data Center 2 hosts an application that a partner company needs to access. The partner wants to access the application from the partner's own data center by using the Direct Connect network. The company's network engineer needs to create a separate isolated network for the partner to establish connectivity between Data Center 2 and the partner's data center.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a new Direct Connect gateway for the partner in an AWS account. Share the account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the new Direct Connect gateway.
B. Provision a separate transit VIF for the partner on the Direct Connect connection at Data Center 2. Connect the transit VIF to the partner-specific Direct Connect gateway.
C. Share the company's AWS account number with the partner to allow the partner to create a hosted VIF to the account. Accept and associate the partner's hosted VIF with the existing Direct Connect gateway.
D. Provision a separate private VIF for the partner on the Direct Connect connection at Data Center 2. Connect the private VIF to the partner-specific Direct Connect gateway. Enable SiteLink.
E. Provision a separate public VIF for the partner on the Direct Connect connection at Data Center 2. Connect the public VIF to the partner-specific Direct Connect gateway. Enable SiteLink.
Show Answer
Correct Answer: A, D
Explanation: A separate Direct Connect gateway provides an isolated routing domain for the partner instead of sharing the company's existing gateway. To carry SiteLink traffic between Data Center 2 and the partner over the Direct Connect network, provision a separate private VIF on the Data Center 2 connection, associate it with the partner-specific Direct Connect gateway, and enable SiteLink. Transit VIFs are for Transit Gateway connectivity, and public VIFs do not support this use case.
Question 5
A company operates in the us-east-1 Region and the us-west-1 Region. The company is designing a solution to connect an on-premises data center to the company's AWS environment in us-east-1. The solution uses two AWS Direct Connect connections.
Traffic from us-west-1 to the data center needs to traverse the Direct Connect connections. A network engineer needs to set up active-passive functionality across the two Direct Connect connections by using a Direct Connect gateway to influence inbound traffic from VPCs that are in us-west-1 to the data center.
Which solution will meet these requirements?
A. At the data center, set the local preference for the primary connection to be higher than the local preference for the secondary connection.
B. Use AS path prepending to set the AS path on the primary connection to be longer than the AS path on the secondary connection.
C. Use local preference BGP community tags to apply the 7224:7300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:7100 local preference BGP community tag to the prefixes for the secondary connection.
D. Use local preference BGP community tags to apply the 7224:9300 local preference BGP community tag to the prefixes for the primary connection. Apply the 7224:9100 local preference BGP community tag to the prefixes for secondary connection.
Show Answer
Correct Answer: C
Explanation: For private/transit virtual interfaces with a Direct Connect gateway, AWS recommends using Direct Connect local preference BGP community tags to influence AWS's preferred inbound path from VPCs to on-premises. Community 7224:7300 sets high local preference and 7224:7100 sets low local preference, creating an active-passive design. Local preference configured on the customer router affects outbound traffic from the data center, not AWS inbound path selection, and AS path prepending is not the preferred mechanism when AWS local preference communities are available. The 9x00 communities are for public virtual interfaces, not this Direct Connect gateway/private routing scenario.
Question 6
A company hosts a corporate website on Amazon EC2 instances behind a Network Load Balancer (NLB). The NLB has one TLS listener.
The company wants to use AWS WAF to enhance security for the website.
Which solution will meet this requirement?
A. Attach an Elastic IP address to the NLB. Associate an AWS WAF web ACL with the Elastic IP address.
B. Replace the NLB with an Application Load Balancer (ALB). Associate an AWS WAF web ACL with the AL
C. Associate an AWS WAF web ACL with the NLB.
D. Associate an AWS WAF web ACL with the EC2 instances that are behind the NLB.
Show Answer
Correct Answer: B
Explanation: AWS WAF can be associated with Application Load Balancers, Amazon CloudFront distributions, Amazon API Gateway REST APIs, AWS AppSync GraphQL APIs, Amazon Cognito user pools, AWS Verified Access instances, and AWS Amplify apps, but not with Network Load Balancers. To use AWS WAF in front of the website, replace the NLB with an ALB and associate the web ACL with the ALB.
Question 7
A network engineer deploys an Application Load Balancer (ALB) in two Availability Zones. There is one target group. There are four Amazon EC2 instance targets in the first Availability Zone and six EC2 instance targets in the second Availability Zone.
During testing, the network engineer notices that the targets in the first Availability Zone receive 40% of the traffic. The targets in the second Availability Zone receive 60% of the traffic. The network engineer needs to update the configuration to prevent traffic from crossing Availability Zones. The network engineer wants to achieve a 50% traffic split across the Availability Zones.
Which solution will meet these requirements?
A. Disable cross-zone load balancing for the target group.
B. Disable cross-zone load balancing for the AL
C. Disable cross-zone load balancing for all the targets in the first Availability Zone.
D. Disable cross-zone load balancing for all the targets in the second Availability Zone.
Show Answer
Correct Answer: A
Explanation: Application Load Balancers always operate with cross-zone load balancing enabled at the load balancer level. To prevent traffic from crossing Availability Zones, you disable cross-zone load balancing on the target group. With cross-zone disabled at the target group, each ALB node sends traffic only to targets in its own Availability Zone, resulting in an even 50/50 split across the two Availability Zones while distributing traffic only among the local targets (4 instances share 50% in one AZ, 6 instances share 50% in the other).
Question 8
A company uses an organization in AWS Organizations to manage many AWS accounts that host many VPCs and workloads. The company has an AWS Direct Connect connection between a data center and AWS. The company uses a transit gateway in a central network account to connect the workload VPCs to the data center.
The company wants to tag each transit gateway attachment automatically with information from tags that are attached to each requester account VPC. The company provisions an IAM role in every account. The company assigns the IAM role permissions to retrieve the required tag data from the VPCs and a trust policy that allows principals in the central network account to invoke the IAM role.
Which solution will meet these requirements?
A. Configure AWS Identity and Access Management Access Analyzer to monitor the transit gateway for new attachments. Configure IAM Access Analyzer to invoke an AWS Systems Manager runbook that assumes the IAM role in the requester account and tags the attachment with the required information.
B. Configure an SCP to monitor the transit gateway for new attachments. Configure the SCP to invoke an AWS CloudFormation stack template in the account that requests an attachment to tag the attachment.
C. Configure Amazon VPC IP Address Manager (IPAM) and register the transit gateway. Configure IPAM to run an AWS CDK function when a new IP address is requested from the transit gateway for a new attachment. Configure the CDK function to assume the IAM role in the requester account and to tag the attachment with the required information.
D. Configure AWS Network Manager and register the transit gateway. Create an Amazon EventBridge rule to receive attachment notifications from Network with the required information. Manager and to invoke an AWS Lambda function that assumes the IAM role in the requester account. Configure the Lambda function to tag the attachment.
Show Answer
Correct Answer: D
Explanation: AWS Network Manager can monitor transit gateway events and integrates with Amazon EventBridge for attachment notifications. An EventBridge rule can invoke an AWS Lambda function in the central account. The Lambda function can assume the pre-provisioned cross-account IAM role in the requester account to read VPC tags and then apply those tags (or derived information) to the transit gateway attachment. The other options misuse services: IAM Access Analyzer does not monitor transit gateway attachments or invoke runbooks, SCPs cannot monitor resources or invoke CloudFormation, and IPAM/CDK is unrelated to transit gateway attachment tagging.
Question 9
A company needs to build an integration with its internal ticketing system. The integration will require an AWS Lambda function.
The Lambda function needs to query a REST API that is part of the internal ticketing system. The ticketing system's REST API is accessible only through an Application Load Balancer (ALB) that is in a private subnet in the company's VPC.
The company deploys the Lambda function with the following infrastructure as code (IaC):
The IaC deployment succeeds, but the deployed Lambda function times out when it tries to access the ticketing system.
How can the company give the Lambda function the ability to access the ticketing system?
A. Create an AWS PrivateLink endpoint service. Expose the service to the Lambda function.
B. Attach the Lambda function to the ALB's target group by creating a new aws_lb_target_group_attachment resource. Configure the resource to reference both the ALB's ARN and the Lambda function's ARN.
C. Update the Lambda function's security group to include appropriate inbound rules that permit traffic from the VP
D. Add a vpc_config section to the Lambda function resource. Configure the vpc_config section to include one or more security group IDs and one or more private subnet IDs that permit access to the ALB.
Show Answer
Correct Answer: D
Explanation: AWS Lambda functions run outside a VPC by default and cannot directly reach private resources such as an internal ALB in private subnets. Configure the Lambda function with a VPC configuration that specifies private subnet IDs and appropriate security group IDs so it creates ENIs in the VPC and can access the ALB. The security groups and routing must allow the traffic.
Question 10
A security company has a domain that stores DNS records in an Amazon Route 53 public hosted zone. The company has configured DNS Security Extensions (DNSSEC) signing for the domain. The domain has no subdomains.
A network engineer must disable DNSSEC signing for the domain. The network engineer must not cause any DNS outage.
Which solution will meet these requirements?
A. Disable DNSSEC signing. Delete the resource record signature (RRSIG) records. Wait for the TTL of the RSIG records to elapse. Deactivate the key-signing keys (KSKs).
B. Deactivate the key-signing keys (KSKs). Wait for the TTL of the KSK records to elapse. Disable DNSSEC signing.
C. Delete the designated signer (DS) record in the parent domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing. Deactivate the key-signing keys (KSKs).
D. Deactivate the key-signing keys (KSKs). Delete the designated signer (DS) record of the domain. Wait for the TTL of the DS record to elapse. Disable DNSSEC signing.
Show Answer
Correct Answer: C
Explanation: To avoid a DNS outage, first remove the chain of trust by deleting the DS record from the parent zone and wait for its TTL to expire so validators stop expecting signed responses. After the DS record is no longer cached, disable DNSSEC signing in the hosted zone and then deactivate the key-signing keys. Disabling signing or deactivating keys before the parent DS record has aged out can cause DNS validation failures.
$19
Get all 288 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.