AWS Advanced Networking Specialty - ANS-C01

1. 1.A company advertises the same prefix to AWS over two Direct Connect connections at different locations and wants one path used as primary and the other only on failure. Which BGP technique should be used on the on-premises routers?

   • APrepend the AS_PATH on the standby connection's advertisementCorrect answer
   • BSet a higher MED value on the primary connection
   • CAdvertise a longer prefix over the standby connection
   • DSet local preference on the AWS side using a route map

   Why

   Prepend the AS_PATH on the advertisement over the standby connection so AWS prefers the shorter AS_PATH on the primary. AWS evaluates longest prefix match first, then local preference communities, then AS_PATH length, so AS_PATH prepending is the standard customer-controlled lever for active and passive. MED is generally not honored the way it is between peers here, and advertising different prefix lengths changes reachability rather than expressing preference for the same prefix.

2. 2.An on-premises network receives routes from AWS over two Direct Connect connections and must prefer one for return traffic from AWS to on premises. Which mechanism does AWS provide for the customer to influence this?

   • ATag prefixes with the AWS local preference BGP communitiesCorrect answer
   • BSet the MED attribute on the advertised prefixes
   • CConfigure weight on the AWS virtual private gateway
   • DUse a route map on the AWS side of the BGP session

   Why

   Tag the advertised prefixes with the AWS local preference BGP communities, 7224:7100, 7224:7200, and 7224:7300, which set low, medium, and high local preference on the AWS side and control which path AWS uses outbound. AS_PATH prepending influences how AWS ranks paths only after local preference, a longer prefix changes routing scope rather than preference, and MED is not the documented lever for this.

3. 3.A global company must serve dynamic API traffic over TCP from three Regions with a static anycast entry point and sub-minute failover, and clients cache DNS aggressively. What should be designed?

   • AAWS Global Accelerator with endpoint groups per RegionCorrect answer
   • BRoute 53 failover routing with a 60-second TTL
   • CAmazon CloudFront with three custom origins
   • DA Network Load Balancer with cross-zone load balancing

   Why

   Use AWS Global Accelerator, which provides two static anycast IP addresses, enters the AWS backbone at the nearest edge, and shifts traffic between Regional endpoints on health check failure without depending on DNS TTLs. Route 53 failover depends on resolver and client caching, CloudFront is optimized for HTTP content delivery, and a Network Load Balancer serves a single Region.

4. 4.An application must resolve the same internal hostname to different addresses depending on which VPC the query originates from, across 30 VPCs in several accounts. What should be designed?

   • AMultiple private hosted zones with the same name, each associated with a VPC subsetCorrect answer
   • BOne private hosted zone associated with all 30 VPCs
   • CA public hosted zone with weighted records
   • DRoute 53 Resolver forwarding rules per VPC

   Why

   Create separate Route 53 private hosted zones with the same domain name, each associated with the VPCs that should receive that answer, since a private hosted zone answers only for its associated VPCs. A single private hosted zone returns one answer set to all associated VPCs, a public hosted zone publishes to the internet, and Resolver rules forward queries rather than serving different local answers.

5. 5.A design must let on-premises resolvers resolve names in Route 53 private hosted zones, and let VPC workloads resolve on-premises Active Directory names. Which components are required?

   • ABoth inbound and outbound Resolver endpoints with forwarding rulesCorrect answer
   • BInbound Resolver endpoints only
   • CA public hosted zone containing the internal records
   • DCustom DNS servers on EC2 in each VPC

   Why

   Deploy Route 53 Resolver inbound endpoints so on-premises resolvers can query the VPC, and outbound endpoints with forwarding rules so VPC queries for the on-premises domain are forwarded to the corporate resolvers. Inbound endpoints alone cover only one direction, a public hosted zone exposes internal names, and DNS servers on EC2 reintroduce infrastructure the managed resolver replaces.

Practice all 65 questions

Frequently asked questions