support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Amazon
  4. ANS-C01

Free ANS-C01 Exam Braindumps
AWS Certified Advanced Networking - Specialty ANS-C01 Questions 89–96 (page: 13)

Updated On: 29-May-2026
Page 13 of 38
PDF with 306 Questions

A company uses a 1 Gbps AWS Direct Connect connection to connect its AWS environment to its on-premises data center. The connection provides employees with access to an application VPC that is hosted on AWS. Many remote employees use a company-provided VPN to connect to the data center. These employees are reporting slowness when they access the application during business hours. On-premises users have started to report similar slowness while they are in the office.

The company plans to build an additional application on AWS. On-site and remote employees will use the additional application. After the deployment of this additional application, the company will need 20% more bandwidth than the company currently uses. With the increased usage, the company wants to add resiliency to the AWS connectivity. A network engineer must review the current implementation and must make improvements within a limited budget.

What should the network engineer do to meet these requirements MOST cost-effectively?

  1. Set up a new 1 Gbps Direct Connect dedicated connection to accommodate the additional traffic load from remote employees and the additional application. Create a link aggregation group (LAG).
  2. Deploy an AWS Site-to-Site VPN connection to the application VPC. Configure the on-premises routing for the remote employees to connect to the Site-to-Site VPN connection.
  3. Deploy Amazon Workspaces into the application VP Instruct the remote employees to connect to Workspaces.
  4. Replace the existing 1 Gbps Direct Connect connection with two new 2 Gbps Direct Connect hosted connections. Create an AWS Client VPN endpoint in the application VPC. Instruct the remote employees to connect to the Client VPN endpoint.

Answer(s): B



A company has a global network and is using transit gateways to connect AWS Regions together. The company finds that two Amazon EC2 instances in different Regions are unable to communicate with each other. A network engineer needs to troubleshoot this connectivity issue.

What should the network engineer do to meet this requirement?

  1. Use AWS Network Manager Route Analyzer to analyze routes in the transit gateway route tables and in the VPC route tables. Use VPC flow logs to analyze the IP traffic that security group rules and network ACL
    rules accept or reject in the VPC.
  2. Use AWS Network Manager Route Analyzer to analyze routes in the transit gateway route tables. Verify that the VPC route tables are correct. Use AWS Firewall Manager to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.
  3. Use AWS Network Manager Route Analyzer to analyze routes in the transit gateway route tables. Verify that the VPC route tables are correct. Use VPC flow logs to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VP
  4. Use VPC Reachability Analyzer to analyze routes in the transit gateway route tables. Verify that the VPC route tables are correct. Use VPC flow logs to analyze the IP traffic that security group rules and network ACL rules accept or reject in the VPC.

Answer(s): C



A company needs to transfer data between its VPC and its on-premises data center. The data must travel through a connection that has dedicated bandwidth. The data also must be encrypted in transit. The company has been working with an AWS Partner Network (APN) Partner to establish the connection.

Which combination of steps will meet these requirements? (Choose three.)

  1. Request a hosted connection from the APN Partner.
  2. Request a hosted public VIF from the APN Partner.
  3. Create an AWS Site-to-Site VPN connection.
  4. Create an AWS Client VPN connection.
  5. Create a private VIF.
  6. Create a public VI

Answer(s): A,C,F



A company's security guidelines state that all outbound traffic from a VPC to the company's on-premises data center must pass through a security appliance. The security appliance runs on an Amazon EC2 instance. A network engineer needs to improve the network performance between the on-premises data center and the security appliance.

Which actions should the network engineer take to meet these requirements? (Choose two.)

  1. Use an EC2 instance that supports enhanced networking.
  2. Send outbound traffic through a transit gateway.
  3. Increase the EC2 instance size.
  4. Place the EC2 instance in a placement group within the VPC.
  5. Attach multiple elastic network interfaces to the EC2 instance.

Answer(s): A,C



A company's application team is unable to launch new resources into its VPC. A network engineer discovers

that the VPC has run out of usable IP addresses. The VPC CIDR block is 172.16.0.0/16.

Which additional CIDR block can the network engineer attach to the VPC?

  1. 172.17.0.0/29
  2. 10.0.0.0/16
  3. 172.17.0.0/16
  4. 192.168.0.0/16

Answer(s): C



A financial trading company is using Amazon EC2 instances to run its trading platform. Part of the company's trading platform includes a third-party pricing service that the EC2 instances communicate with over UDP on port 50000.

Recently, the company has had problems with the pricing service. Some of the responses from the pricing service appear to be incorrectly formatted and are not being processed successfully. The third-party vendor requests access to the data that the pricing service is returning. The third-party vendor wants to capture request and response data for debugging by logging in to an EC2 instance that accesses the pricing service. The company prohibits direct access to production systems and requires all log analysis to be performed in a dedicated monitoring account.

Which set of steps should a network engineer take to capture the data and meet these requirements?

  1. 1. Configure VPC flow logs to capture the data that flows in the VPC.
    2. Send the data to an Amazon S3 bucket.
    3. In the monitoring account, extract the data that flows to the EC2 instance's IP address and filter the traffic for the UDP data.
    4. Provide the data to the third-party vendor.
  2. 1. Configure a traffic mirror filter to capture the UDP data.
    2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface.
    3. Configure a packet inspection package on a new EC2 instance in the production environment. Use the elastic network interface of the new EC2 instance as the target for the traffic mirror.
    4. Extract the data by using the packet inspection package.
    5. Provide the data to the third-party vendor.
  3. 1. Configure a traffic mirror filter to capture the UDP data.
    2. Configure Traffic Mirroring to capture the traffic for the EC2 instance's elastic network interface.
    3. Configure a packet inspection package on a new EC2 instance in the monitoring account. Use the elastic network interface of the new EC2 instance as the target for the traffic mirror.
    4. Extract the data by using the packet inspection package.
    5. Provide the data to the third-party vendor.
  4. 1. Create a new Amazon Elastic Block Store (Amazon EBS) volume. Attach the EBS volume to the EC2 instance.
    2. Log in to the EC2 instance in the production environment. Run the tcpdump command to capture the UDP data on the EBS volume.
    3. Export the data from the EBS volume to Amazon S3.
    4. Provide the data to the third-party vendor.

Answer(s): C



A company's network engineer is configuring an AWS Site-to-Site VPN connection between a transit gateway and the company's on-premises network. The Site-to-Site VPN connection is configured to use BGP over two tunnels in active/active mode with equal-cost multi-path (ECMP) routing activated on the transit gateway.

When the network engineer attempts to send traffic from the on-premises network to an Amazon EC2 instance, traffic is sent over the first tunnel. However, return traffic is received over the second tunnel and is dropped at the customer gateway. The network engineer must resolve this issue without reducing the overall VPN bandwidth.

Which solution will meet these requirements?

  1. Configure the customer gateway to use AS PATH prepending and local preference to prefer one tunnel over the other.
  2. Configure the Site-to-Site VPN options to set the first tunnel as the primary tunnel to eliminate asymmetric routing.
  3. Configure the virtual tunnel interfaces on the customer gateway to allow asymmetric routing.
  4. Configure the Site-to-Site VPN to use static routing in active/active mode to ensure that traffic flows over a preferred path.

Answer(s): D



A company runs an application on Amazon EC2 instances. A network engineer implements a NAT gateway in the application's VPC to replace self-managed NAT instances. After the network engineer shifts traffic from the self-managed NAT instances to the NAT gateway, users begin to report issues.

During troubleshooting, the network engineer discovers that the connection to the application is closing after approximately 6 minutes of inactivity.

What should the network engineer do to resolve this issue?

  1. Check for increases in the IdleTimeoutCount Amazon CloudWatch metric for the NAT gateway. Configure TCP keepalive on the application EC2 instances.
  2. Check for increases in the ErrorPortAllocation Amazon CloudWatch metric for the NAT gateway. Configure an HTTP timeout value on the application EC2 instances.
  3. Check for increases in the PacketsDropCount Amazon CloudWatch metric for the NAT gateway. Configure an HTTPS timeout value on the application EC2 instances.
  4. Check for decreases in the ActiveConnectionCount Amazon CloudWatch metric for the NAT gateway.
    Configure UDP keepalive on the application EC2 instances.

Answer(s): A



  PDF
Viewing page 13 of 38
Viewing questions 97 - 104 out of 306 questions


Post your Comments and Discuss Amazon ANS-C01 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!