ANS-C01 AWS Certified Advanced Networking – Specialty Free Practice Questions and Answers (6-10)

A company advertises the same VPC prefixes over two Direct Connect links. It wants inbound traffic from its network to prefer one link while keeping the second available. Which approach can influence this preference?

• A. Advertise the preferred path with a more specific prefix where appropriate, and use supported BGP attributes for path preference
• B. Change the VPC CIDR to a public address range
• C. Disable BGP on the backup connection
• D. Use a security group to select the Direct Connect circuit

A security team must inspect traffic between multiple VPCs attached to a Transit Gateway using a centralized network appliance. Which design supports this requirement?

• A. Route the relevant Transit Gateway traffic through an inspection VPC and appliance using appropriate route tables
• B. Attach an internet gateway to each workload subnet
• C. Use VPC peering and assume it transits through a central VPC
• D. Place the appliance in an isolated subnet with no routes

Instances in private subnets need outbound IPv6 connectivity to the internet while remaining unreachable from unsolicited inbound internet connections. What should the team use?

• A. An egress-only internet gateway and suitable subnet routes
• B. A NAT gateway for IPv6 translation
• C. A gateway endpoint for all IPv6 destinations
• D. A public load balancer with no security group

On-premises DNS servers need to forward queries for a private AWS domain into a VPC. Which Resolver endpoint direction should receive those queries?

• A. Inbound endpoint in the VPC
• B. Outbound endpoint in the VPC
• C. CloudFront origin endpoint
• D. Gateway Load Balancer endpoint

An application sends large packets across a hybrid network path and experiences intermittent connectivity when packet sizes increase. What should the engineer check first?

• A. End-to-end MTU support and path MTU discovery behavior across every segment
• B. Whether the VPC has a public IPv4 address on every instance
• C. The number of Route 53 hosted zones
• D. Whether the security group allows DNS over TCP only