AWS Certified Advanced Networking – Specialty (ANS-C01) Mock Test

You cannot modify the bandwidth of an existing Direct Connect connection. The correct procedure is to order a new connection with the desired higher bandwidth (e.g., 10 Gbps) and then migrate your traffic to the new connection before decommissioning the old one. Alternatively, if multiple connections are available, you can use a LAG to aggregate them.

VPC Reachability Analyzer is a static analysis tool that analyzes the network path between a source and a destination in a VPC. It can identify configuration issues that would cause packet loss, such as missing route table entries, restrictive security groups, or network ACLs. It does this without sending any packets, making it ideal for troubleshooting without altering the state of the instances.

AWS Network Manager provides a single, unified view of your private networks. It allows you to create a global network that includes your AWS Transit Gateways and on-premises resources. It provides a topology visualization, performance monitoring (latency, packet loss), and can notify you of changes in your network.

Route 53 Resolver endpoints, specifically an inbound endpoint, allow you to resolve Route 53 private hosted zones from outside the VPC (like from an on-premises network or, in this case, IoT devices over the internet, assuming proper security). The devices would be configured to use the IP addresses of the inbound endpoint for DNS queries, allowing them to resolve the private domain name.

AWS Transit Gateway is the ideal service for a shared services model. The shared services VPC and all spoke VPCs attach to the Transit Gateway. The Transit Gateway route tables are then configured to allow traffic to flow from the spokes to the shared services VPC, providing centralized access and simplified network management.

Network ACLs are evaluated before Security Groups. Because the NACL rule is a `Deny`, it will be applied first, and the traffic will be blocked before it ever reaches the security group for evaluation. Therefore, the instance will not receive the traffic.

In a Transit Gateway setup, routing is controlled by route tables associated with each VPC attachment and propagations from those attachments. A common issue is a misconfiguration where the route table associated with the source VPC's attachment does not have a route for the destination VPC's CIDR, or the destination VPC's attachment route table doesn't have a return route.

Because NACLs are stateless, return traffic must be explicitly allowed by an outbound rule. SSH traffic originates from a high-numbered ephemeral port on the client and goes to port 22 on the server. The return traffic will come from port 22 on the server and go back to the high-numbered ephemeral port on the client. Therefore, an outbound rule must allow TCP traffic to the ephemeral port range (1024-65535).

AWS Systems Manager Session Manager provides secure and auditable instance management without the need to open inbound ports, manage bastion hosts, or maintain SSH keys. It allows you to manage your instances through a browser-based shell or through the AWS CLI, with all actions logged in CloudTrail.

AWS VPN publishes the `TunnelState` metric to CloudWatch for each of its tunnels. A value of `1` indicates the tunnel is UP, and a value of `0` indicates the tunnel is DOWN. Creating an alarm that triggers when the metric is `0` for a sustained period is the standard way to monitor VPN tunnel health.

This is a classic event-driven automation pattern. Amazon EventBridge (or CloudWatch Events) can capture the 'EC2 Instance State-change Notification' event for instances entering the 'running' state. A rule can be created to filter these events based on the specific tag. The rule's target would be an AWS Lambda function, which receives the event payload (containing the instance ID and other details), retrieves the instance's private IP, and uses the AWS SDK to create the necessary `A` record in the specified Route 53 private hosted zone.

RPO is about data loss tolerance: it's the maximum acceptable amount of time since the last data recovery point. RTO is about downtime tolerance: it's the maximum acceptable delay between the interruption of service and restoration of service.

Using AWS Direct Connect Gateway with Transit Gateways in each region is the most resilient and scalable solution. A DXGW is a global resource that can connect to multiple Direct Connect locations and multiple Transit Gateways across regions. This allows for a fully routed, manageable global network where on-premises sites and all VPCs can communicate without complex peering meshes.

VPC IPAM is a managed service that makes it easier for you to plan, track, and monitor IP addresses for your AWS workloads. It automates IP address assignment to your VPCs, preventing conflicts and simplifying CIDR block management, especially in large and complex network environments.

Stateful firewalls, like Security Groups, automatically track the state of connections. If you allow an inbound request, the corresponding outbound response is automatically allowed. Stateless firewalls, like Network ACLs, do not track connection state; you must explicitly create separate inbound and outbound rules for both the request and the response traffic.

AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. Using Direct Connect, you can establish private connectivity between AWS and your datacenter, which can reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience than Internet-based connections.

AWS Firewall Manager is a security management service that simplifies your WAF administration and maintenance tasks across multiple accounts and resources. You can centrally configure WAF rules, and Firewall Manager automatically applies those rules to the resources you select, such as ALBs or CloudFront distributions, across your accounts.

An inspection VPC with a Gateway Load Balancer and a Transit Gateway is the standard, scalable pattern for centralized traffic inspection. The Transit Gateway routes all traffic flows to the inspection VPC. The Gateway Load Balancer provides a transparent 'bump-in-the-wire' service, distributing traffic across a fleet of virtual security appliances that can be managed by an Auto Scaling group for high availability and scalability.

A common cause of NLB health check failures is a misconfigured security group on the target instance. The security group must have an inbound rule that explicitly allows traffic from the NLB nodes on the health check port. Since the source of NLB traffic is preserved, you can't just allow traffic from the NLB's security group; you must allow it from the client IPs or, for health checks, from the VPC CIDR.

To serve content from an ALB, you set the ALB's DNS name as the 'Origin Domain Name' when configuring the CloudFront origin. CloudFront then forwards requests to the ALB, which in turn distributes them to the backend EC2 instances.

Weighted routing distributes traffic based on the ratio of a record's weight to the sum of all weights for that record name and type. To achieve a 25/75 split, you can use any numbers that have that ratio. The simplest is to assign a weight of 25 to the new stack and 75 to the existing stack.

Origin Access Identity (OAI) is a special CloudFront user that you associate with your distribution. You then create a bucket policy that grants this OAI permission to read the objects in your bucket. This locks down the bucket so that only CloudFront can access the content, forcing users to go through the distribution.

This describes the classic centralized egress architecture. AWS Transit Gateway acts as a cloud router. All spoke VPCs are attached to it. The Transit Gateway route tables are configured to send default traffic (0.0.0.0/0) to the inspection VPC. Inside the inspection VPC, the firewall instances are in an Auto Scaling group behind a Gateway Load Balancer, which provides high availability and scalability for the firewall fleet.

Amazon VPC More-specific routing allows you to create more specific routes in a VPC route table that override the default local route. You can use this to redirect traffic between two subnets to a middlebox, such as a Gateway Load Balancer endpoint, which fronts the security appliances. This forces the traffic through the inspection fleet without needing to change security groups or install agents.

Direct Connect provides a private, dedicated path but is not encrypted by default. To encrypt traffic over this path, you establish an AWS Site-to-Site VPN connection that runs over the private Direct Connect link. This is achieved by configuring a private virtual interface (VIF) for the Direct Connect and then building the VPN tunnel between the VGW and the on-premises customer gateway over that private path.

MACsec (Media Access Control Security) is an IEEE standard that provides point-to-point security on Ethernet links. AWS Direct Connect supports MACsec for 10 Gbps and 100 Gbps dedicated connections at select locations, allowing you to encrypt your data at Layer 2 from your on-premises router to the AWS Direct Connect router.

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. AWS Shield Standard is automatically enabled for all AWS customers at no additional cost and protects against most common network and transport layer DDoS attacks. AWS Shield Advanced provides additional protections and features for a higher level of security.

With a weighted routing policy, the fastest way to roll back is to update the weights. By changing the weight of the new (green) environment's record to 0 and the old (blue) environment's record to any non-zero value (e.g., 100), you can immediately direct all traffic back to the stable environment. This is much faster than waiting for DNS propagation of a changed record value.

AWS Verified Access is a service that provides secure access to private applications without using a VPN. It acts as a broker, evaluating every access request against a set of user-defined security policies based on identity (from identity providers) and device posture. It provides a more granular, zero-trust approach to application access compared to a traditional VPN.

Network Load Balancers (NLBs) operate at the transport layer (Layer 4) and are capable of handling both TCP and UDP traffic. This makes them the ideal choice for load balancing applications that rely on UDP, such as DNS, streaming media, or real-time gaming.

AWS Global Accelerator uses the AWS global network to improve the performance and availability of your applications. It provides static IP addresses that act as a fixed entry point and routes traffic to the optimal endpoint based on health, client location, and policies you configure. It is ideal for non-HTTP traffic (gaming, IoT) or for HTTP applications that need static IPs or instant regional failover without relying on DNS propagation.

Route 53 health checkers are located around the world and need a public endpoint to check. However, Route 53 allows you to create health checks that monitor a CloudWatch alarm. You can create a custom CloudWatch alarm within your VPC that monitors the private endpoint (e.g., using a Lambda function or other internal metric). Route 53 will then use the state of this CloudWatch alarm to determine the health of the endpoint.

AWS PrivateLink is designed for this exact use case. By creating an interface VPC endpoint for the provider's service in your VPC, you create a private, secure connection. The endpoint is an elastic network interface with a private IP in your subnet, and all traffic to the service travels over the AWS private network, never leaving it.

AWS Outposts is a fully managed service that offers the same AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on-premises facility for a truly consistent hybrid experience. This is the ideal solution when the lowest possible latency to on-premises systems is required, as the AWS infrastructure is physically located at the on-premises site.

Application Load Balancer listener rules allow for advanced, content-based routing. You can create rules based on conditions like the hostname, path, HTTP headers, or query strings. A host-based routing rule can inspect the `Host` header of the request and forward it to the appropriate target group.

NLBs operate at the transport layer (Layer 4) and are ideal for high-throughput, low-latency TCP/UDP traffic. ALBs operate at the application layer (Layer 7) and are aware of application-level constructs like HTTP headers, cookies, and query strings, allowing for advanced, content-based routing rules.

AWS WAF is a web application firewall that protects against common web exploits. It has managed rule groups, including one specifically for SQL database attacks, which contains rules to block requests that show signs of SQL injection.

Amazon Route 53 Resolver Query Logging is a feature that allows you to capture and log DNS queries that originate in your Amazon VPCs. You can log queries to CloudWatch Logs, S3, or Kinesis Data Firehose, providing a full audit trail of DNS activity for security analysis and troubleshooting.

AWS Transit Gateway acts as a cloud router and is designed to connect thousands of VPCs and on-premises networks together. It simplifies network architecture by removing the need for complex VPC peering meshes, which become unmanageable at scale.

VPC Flow Logs capture IP traffic information. By delivering these logs to S3 and querying them with Amazon Athena, you can perform detailed analysis. You can write a SQL query to group traffic by source IP address (the private IPs of your EC2 instances) where the destination IP is outside the VPC, and then order the results to find the 'top talkers' responsible for the most outbound traffic and associated NAT Gateway costs.

Network ACLs evaluate rules in order, starting with the lowest numbered rule. As soon as a rule matches the traffic, it is applied immediately, and no subsequent rules are evaluated. Therefore, the rule with number 100 will be evaluated before the rule with number 200.

A Network Load Balancer (NLB) provides a static IP address per Availability Zone. This makes it a reliable, fixed entry point for services. Even if the backend instances in the target group change, the NLB's IP address remains the same.

Availability Zones (AZs) are distinct locations within an AWS Region that are engineered to be isolated from failures in other AZs. They provide inexpensive, low-latency network connectivity to other AZs in the same Region. Deploying applications across multiple AZs is a fundamental best practice for high availability.

Latency-based routing directs users to the AWS region that provides the lowest latency. When combined with health checks, Route 53 can automatically failover to another healthy region if the primary region becomes unavailable. Geoproximity routing is similar but uses geographic distance, while latency routing uses actual network performance measurements, which is generally more accurate for performance-based routing.

To route VPC traffic to the on-premises network, the on-premises router must advertise a default route (0.0.0.0/0) to the VGW via BGP. This route will propagate to the VPC's route table. The VPC route table must then be updated to point 0.0.0.0/0 to the VGW. The on-premises firewall will then handle the traffic and route it to the internet.

A LAG is a feature that allows you to bundle multiple Direct Connect connections at a single AWS Direct Connect location and treat them as a single, logical connection. This provides increased bandwidth (by aggregating the capacity of the member connections) and higher resiliency (if one connection in the LAG fails, traffic is redirected over the remaining connections).

A VPC endpoint policy is a resource-based policy that you attach to a VPC endpoint. You can use it to control access to the service from the VPC. By creating a bucket policy that denies access unless the request comes through a specific VPC endpoint (using the `aws:sourceVpce` condition key), you can ensure the bucket is only accessible from within that VPC's private network.

To ensure high availability for a NAT service, you should deploy a NAT Gateway in each Availability Zone where you have private subnets that need internet access. You then create a route table for the subnets in each AZ that points the default route (0.0.0.0/0) to the NAT Gateway in the same AZ. This prevents a single AZ failure from disrupting internet access for other AZs.

BGP uses Autonomous System Numbers (ASNs) to uniquely identify networks on the internet and in private network connections. When you set up a Direct Connect connection, you must provide your network's public or private ASN, and AWS provides its own ASN. These are used to establish the BGP peering session for exchanging routing information.

For a standard Site-to-Site VPN, you can attach it to either a Virtual Private Gateway (VGW) or a Transit Gateway. Both support BGP sessions for dynamic routing with your on-premises customer gateway device.

When you create a gateway VPC endpoint for S3, you must associate it with a route table. AWS automatically adds a route to that table. The route's destination is a prefix list for S3 (e.g., `pl-12345`) and the target is the VPC endpoint ID (e.g., `vpce-54321`). This directs all traffic destined for S3 in that region through the private endpoint.

Route 53 Resolver DNS Firewall is designed to protect outbound DNS queries for a VPC. You can create domain lists (blocklists) and associate them with your VPCs via firewall rules. This provides a managed, scalable way to prevent your resources from communicating with known malicious or unwanted domains.

AWS WAF is a web application firewall that operates at Layer 7 (Application) and protects against web exploits like SQL injection and XSS. It is used with services like ALB, CloudFront, and API Gateway. AWS Network Firewall is a managed network firewall service that operates at Layers 3-7, providing stateful inspection for all traffic entering and leaving your VPC, not just web traffic.

Amazon CloudFront is a global CDN that caches content in edge locations around the world, providing low latency and high transfer speeds. It can serve both static content (from S3) and dynamic content (from origins like ALBs). It also integrates seamlessly with AWS WAF for application-layer protection.

To achieve high availability with two customer gateway devices, you should create a single AWS virtual private gateway (VGW) and establish two separate VPN connections to it, one from each of your customer gateway devices. AWS will provide two tunnels for each VPN connection, giving you a total of four redundant tunnels into the AWS region.

The `ping` utility uses the ICMP protocol. By default, security groups do not allow inbound ICMP traffic. Even if TCP port 80 (for HTTP) is open, allowing web browser access, ICMP traffic will be blocked unless an explicit inbound rule is added to the instance's security group to allow it.

When you enable IPv6 for a VPC, you cannot choose your own CIDR block range. AWS assigns a unique /56 IPv6 CIDR block to your VPC from its own pool of IPv6 addresses. You then assign /64 CIDR blocks from this /56 range to the subnets within your VPC.

An outbound endpoint allows DNS queries originating within your VPCs to be forwarded to an external DNS server, such as one in your on-premises data center. You create Resolver rules that specify which domain queries should be forwarded and to which IP addresses.

Even with only three VPCs, Transit Gateway simplifies the network. With VPC peering, you would need three separate peering connections to create a full mesh. With Transit Gateway, each VPC only needs one attachment to the gateway. The Transit Gateway acts as a hub, and all VPCs can communicate with each other through it (transitive routing), simplifying management and scaling.

According to AWS documentation, the largest CIDR block you can assign to a VPC is a /16 netmask, which provides 65,536 private IPv4 addresses. The smallest is a /28, which provides 16.

Service Control Policies (SCPs) are the most effective way to enforce permissions guardrails across an organization. By creating an SCP that explicitly denies the `config:StopConfigurationRecorder` and `config:DeleteConfigurationRecorder` actions and attaching it to the relevant OU or account, you can prevent even local administrators in that account from disabling AWS Config.

For maximum resiliency, you should provision two separate Direct Connect connections, terminating each one on a different router at the AWS Direct Connect location and a different device on your on-premises network. This protects against device failure on either side, as well as fiber cuts to a single device.

Classic Load Balancers (and Application Load Balancers) add the `X-Forwarded-For` HTTP header to requests, which contains the original client's IP address. The backend application servers must be configured to parse this header to get the true source IP.

Both the AWS Management Console for Direct Connect and the AWS CLI provide detailed information about the state of individual connections, including those that are part of a LAG. You can inspect the `connectionState` property of each member connection to identify which one is 'down' while others are 'available'.

AS_PATH prepending is a common technique to influence inbound routing from AWS. By adding your own ASN multiple times to the AS_PATH for a specific route advertisement, you make that path appear longer to AWS. BGP's path selection algorithm prefers shorter AS_PATHs, so AWS will prefer the route with fewer prepends.