Free AWS Certified Advanced Networking - Specialty (ANS-C01) Sample Questions

Correct answer: A — A Route 53 Profile with the shared zones, rules, and rule groups, associated to each new VPC

• A. Route 53 Profiles bundle private hosted zones, Resolver rules, and DNS Firewall rule groups so they can be associated with many VPCs at once, and updates to the Profile propagate automatically to every associated VPC.
• B. A custom script re-associating each resource individually recreates the manual work Profiles are designed to remove, and it doesn't propagate later configuration updates automatically.
• C. AWS RAM doesn't share private hosted zones directly the way it shares Resolver rules or subnets; cross-account hosted zone access instead uses VPC association authorization or Profiles.
• D. Manually redeploying a CloudFormation stack per VPC doesn't scale to dozens of new VPCs a month and requires repeated manual action rather than automatic propagation.

Correct answers: A, B — Create a VPC association authorization on the zone, then associate it with VPCs in the other accounts; Create a Route 53 Profile with the shared zones and rules, then share it via AWS RAM

• A. VPC association authorization is the standard mechanism for letting a VPC in another account associate with a private hosted zone owned elsewhere.
• B. Route 53 Profiles can bundle hosted zones and Resolver rules and be shared across accounts through AWS RAM, then associated with VPCs in those accounts.
• C. Enabling Organizations service access alone doesn't share hosted zones; explicit VPC association or Profile sharing is still required.
• D. Hosted zones aren't exported and imported as JSON files this way, and duplicating zones across accounts creates configuration drift instead of a single shared source of truth.
• E. S3 bucket policies control object access and have no relationship to DNS resolution or hosted zone visibility.
• F. Pointing DHCP options at the authoritative name servers bypasses VPC Resolver entirely and doesn't grant access to private hosted zone records, which only VPC Resolver can answer.

Correct answer: A — Give each build's static assets unique versioned file names or paths so new deployments are automatically treated as new cacheable objects.

• A. Versioned file names or paths make each deployment's assets distinct objects that CloudFront has never cached before, so viewers fetch the new version immediately while unrelated cached content is left untouched. This avoids invalidation cost entirely going forward.
• B. Setting the TTL to zero forces origin revalidation on nearly every request across the whole distribution, which sharply increases origin load and reduces the caching benefit the team relies on. It solves the freshness problem too broadly.
• C. Recurring full invalidations after every deploy are the costly, slow-to-propagate pattern the team is already trying to move away from, so automating it does not remove the underlying expense. It keeps the same operational problem in place.
• D. Disabling caching for that path pattern removes CloudFront's performance benefit for those assets entirely, sending every viewer request to the origin regardless of whether the content actually changed. This sacrifices caching rather than fixing the freshness workflow.

Correct answer: A — Data transferred from the S3 origin to CloudFront is free, and billing applies only to data transferred out from CloudFront to viewers.

• A. Data transfer from AWS origins such as S3, Elastic Load Balancing, and API Gateway into CloudFront is free, and the customer is billed only for data leaving CloudFront's edge locations to reach viewers. This reflects CloudFront's published pricing model for AWS-based origins.
• B. Origin-to-CloudFront transfer for AWS origins is not billed at inter-Region rates; it is free regardless of Region, which is part of the incentive to use AWS services as origins. This overstates the actual cost.
• C. The free origin-to-CloudFront transfer for AWS origins is not conditioned on a request-volume threshold; it applies regardless of how many requests the distribution receives. This introduces a limitation that does not exist in the pricing model.
• D. Origin fetches from an AWS origin are not charged the same way as edge-to-viewer delivery; only the viewer-facing data transfer is billed. Describing them as equally billed misrepresents the cost structure.

Correct answer: A — A Network Load Balancer with one Elastic IP per subnet and target registration by instance ID

• A. A Network Load Balancer operates at layer 4, delivers millions of requests per second at very low latency, supports a static Elastic IP per subnet for firewall allow-listing, and preserves client source IP when targets are registered by instance.
• B. An Application Load Balancer does not support assigning a fixed Elastic IP directly to the load balancer node and adds HTTP-layer processing overhead that is unnecessary for raw TCP order flow.
• C. A Gateway Load Balancer is built for transparent appliance insertion using GENEVE encapsulation, not for exposing a fixed public IP to downstream trading partners.
• D. A Classic Load Balancer resolves to a DNS name backed by IP addresses that can change over time, which breaks static IP allow-listing at partner firewalls.

Correct answer: A — AWS Global Accelerator, configured with endpoint groups pointing at each Region's Application Load Balancer

• A. AWS Global Accelerator provides fixed anycast static IP addresses and continuously monitors endpoint health across Regions, automatically shifting traffic away from a degraded Region without partners needing to update allow-lists.
• B. CloudFront origin groups provide HTTP-level failover between origins but front the application with CloudFront's edge domain and caching behavior rather than exposing static anycast IPs at the network layer.
• C. Route 53 latency-based routing resolves to different regional DNS names or IP addresses depending on the resolver, so it does not give partners a single fixed static IP pair to allow-list.
• D. Direct Connect Gateway extends private connectivity to virtual private gateways across Regions and has no role in providing a public static IP failover for internet-facing load balancers.

Correct answer: A — Register the transit gateways, Direct Connect gateways, and SD-WAN sites in AWS Network Manager to build one global network topology and dashboard

• A. Correct. AWS Network Manager is purpose-built to register Transit Gateways, Direct Connect gateways, and on-premises SD-WAN sites into a single global network, providing a unified topology view and hybrid health metrics.
• B. Incorrect. Composite alarms combine alarm states into one alert but do not provide a topology visualization of how the Regions, gateways, and on-premises sites are connected.
• C. Incorrect. Flow log records describe IP traffic on VPC interfaces and give no visibility into Direct Connect, SD-WAN site status, or overall network topology.
• D. Incorrect. AWS Config aggregators track resource configuration compliance across accounts and Regions, not live network topology or hybrid connectivity health.

Correct answers: A, B, D — protocol (IANA protocol number); action (ACCEPT or REJECT); bytes (aggregate byte count for the flow)

• A. Correct. The IANA protocol number is one of the fields included in the default version 2 flow log record.
• B. Correct. The accept-or-reject action for the flow is a standard field in the default flow log record.
• C. Incorrect. HTTP status codes are recorded in load balancer or CloudFront access logs, not in VPC Flow Log records, which operate at the IP layer.
• D. Correct. The aggregate byte count for the flow during the capture window is part of the default flow log record.
• E. Incorrect. TLS cipher suite information is captured in load balancer access logs for HTTPS listeners, not in VPC Flow Log records.
• F. Incorrect. Flow logs record IP-layer connection metadata and do not parse or include application-layer details such as a DNS query name.

Correct answer: B — A lower local preference value on the routes advertised over connection B

• A. MED influences a neighboring AS's choice between multiple entry points into the same AS, but Direct Connect BGP peers are typically within AWS's own routing domain and local preference is the standard control for outbound path selection here, not MED.
• B. Local preference is evaluated before AS_PATH length in the BGP best-path algorithm and directly controls which egress path an AS prefers for outbound traffic, so setting a lower value on connection B's routes makes AWS prefer connection A whenever it is reachable.
• C. Prepending AS_PATH on connection A would make it less preferred, which is the opposite outcome the company wants, since a longer AS_PATH is deprioritized during best-path selection.
• D. A community tag has no effect on route selection unless a route map or policy on the receiving router actually matches the tag and takes an action, so an unused tag changes nothing about path preference.

Correct answer: A — Advertise the on-premises prefixes over the VPN tunnels with a longer AS_PATH than the one advertised over Direct Connect

• A. Prepending additional AS numbers onto the routes advertised over the VPN tunnels makes their AS_PATH longer than the Direct Connect path, which BGP will deprioritize, causing AWS to prefer Direct Connect while the VPN path remains available as backup.
• B. MTU affects fragmentation and payload efficiency, not BGP path selection, so a lower MTU on the VPN tunnels would not influence which path AWS prefers for outbound traffic.
• C. Disabling BGP and using only static routes removes dynamic failover entirely, meaning the backup path would not automatically activate if Direct Connect failed, defeating the purpose of a redundant model.
• D. Setting identical local preference values on both paths gives them equal weight in path selection, which does not create the desired preference for Direct Connect and could instead result in both being used simultaneously.

Correct answer: A — Use AWS Resource Access Manager to share the owning VPC's subnets with the five application accounts so each team launches resources directly into the shared subnets.

• A. VPC sharing through AWS Resource Access Manager lets participant accounts in the same organization launch resources directly into subnets owned by another account, so route tables, NACLs, and NAT gateways stay centrally managed in the owner account while application teams keep separate billing and IAM boundaries.
• B. This still requires five separate VPCs and transit gateway attachments, plus duplicated or synchronized route tables and NAT gateways in each VPC, which is exactly the operational overhead the platform team wants to avoid.
• C. Peering five separate VPCs and manually replicating route tables, NACLs, and NAT gateway configuration in each one creates ongoing configuration drift and does not give the application teams a truly shared subnet.
• D. PrivateLink exposes individual services through interface endpoints; it does not let application teams deploy general-purpose EC2 instances into subnets that are centrally managed by the platform team.

Correct answer: A — Deploy a Transit Gateway per Region, attach the local VPCs, then peer the three Regional transit gateways together with static routes for cross-Region traffic.

• A. Deploying one Transit Gateway per Region and peering the Regional transit gateways together, with static routes since transit gateway peering attachments are not automatically propagated, gives one centrally managed hub-and-spoke topology per Region while extending reachability across Regions.
• B. A full mesh of VPC peering connections across three Regions still requires managing routes and security individually for every pair of VPCs, and it provides no single point of centralized route control the way transit gateway route tables do.
• C. Transit gateway attachments to VPCs must be in the same Region as the transit gateway, so a VPC in another Region cannot attach directly, and routing everything through Site-to-Site VPN over the internet adds latency and forfeits the AWS backbone that inter-Region transit gateway peering already uses.
• D. Route 53 latency-based routing directs DNS resolution to the closest endpoint for client requests; it does not create network-layer connectivity between VPCs in different Regions.

Correct answer: A — Enable accelerated Site-to-Site VPN so traffic enters the AWS network at the nearest edge location via AWS Global Accelerator.

• A. Accelerated Site-to-Site VPN routes traffic onto the AWS global network at the closest edge location using AWS Global Accelerator, which reduces the distance traveled over the public internet and stabilizes latency.
• B. Adding more tunnels to the same customer gateway does not change where traffic enters the AWS network; the packets still traverse the same public internet path before reaching the VPN endpoint.
• C. An internet gateway provides public internet access to a VPC and cannot terminate an IPsec Site-to-Site VPN connection, so it cannot replace the virtual private gateway for this purpose.
• D. A virtual private gateway does not support ECMP across its own tunnels for a single VPN connection; ECMP-style multi-path routing over VPN requires a Transit Gateway VPN attachment instead.

Correct answer: A — MACsec on the dedicated Direct Connect connection to encrypt Ethernet frames between the customer router and the AWS Direct Connect device.

• A. MACsec (IEEE 802.1AE) provides native line-rate encryption of Ethernet frames on supported dedicated Direct Connect connections, protecting data at the physical and data link layer without relying on an overlay tunnel.
• B. AWS Certificate Manager issues TLS certificates for services like Elastic Load Balancing and CloudFront; TLS operates above the data link layer and is not how Direct Connect frames themselves are encrypted.
• C. Site-to-Site VPN is an IPsec overlay that runs over a network path, including optionally over a public virtual interface; it is a separate service and is not applied directly to the Direct Connect physical port.
• D. Traffic Mirroring copies VPC network traffic to a monitoring target for inspection; it does not encrypt Direct Connect frames and is unrelated to link-layer confidentiality.

Correct answer: A — Create an AWS RAM resource share for the Transit Gateway with the target organizational units, and have each application account accept the shared attachment.

• A. AWS RAM supports sharing a Transit Gateway with specified organizational units in one operation instead of enumerating every account, and once shared, an application account creates the attachment and, if required, the owner accepts it, which matches the described scale and OU-based targeting.
• B. An identity-based policy in the application account cannot by itself grant permission to act on a resource owned by a different AWS account; the resource owner must first share the Transit Gateway through a mechanism like AWS RAM before that cross-account permission has any effect.
• C. Publishing the Transit Gateway ID in Parameter Store only distributes a reference value; it does not grant the cross-account permission needed to actually create an attachment against a Transit Gateway owned by another account.
• D. A service control policy sets the maximum permissions boundary for accounts in an organization but does not itself grant access to a specific resource in another account, so it cannot substitute for sharing the Transit Gateway through AWS RAM.

Correct answer: A — The rule for dev.example.com, because Resolver forwarding rules match on the most specific domain suffix available for the queried name.

• A. Route 53 Resolver applies the most specific matching domain when multiple forwarding rules could apply to a query, so a query for host1.dev.example.com is forwarded using the dev.example.com rule rather than the broader example.com rule.
• B. Rule selection is based on domain specificity, not the chronological order in which the rules were created, so creation order does not determine which rule wins for an overlapping name.
• C. Resolver forwards a given query using a single matching rule rather than broadcasting it to every applicable on-premises server and racing the responses, so this dual-forwarding behavior does not occur.
• D. Resolver forwarding rules do match subdomains of the configured domain, not just exact matches, which is exactly why the more specific dev.example.com rule can take precedence over example.com for this query.

Correct answer: A — Attach a resource policy to the Resolver rule with PutResolverRulePolicy so each application account can associate the shared rule with its own VPCs.

• A. Sharing a Resolver rule works by attaching a resource policy with PutResolverRulePolicy, which surfaces an AWS RAM invitation that each recipient account accepts, after which that account associates the shared rule with its own VPCs while the rule and endpoint stay owned and managed centrally.
• B. VPC peering only enables instances to resolve each other's private DNS hostnames across the peering link; it does not distribute a Resolver forwarding rule or let peered VPCs use the Shared-Services outbound endpoint for conditional forwarding.
• C. A public hosted zone publishes records for internet-wide resolution and has no mechanism to carry a Resolver forwarding rule, and exposing an internal corp domain publicly would also be an unwanted security exposure.
• D. Elastic network interfaces on a Resolver endpoint are bound to the subnets and VPC where the endpoint was created; they cannot be copied or replicated into other accounts' VPCs, and doing so is not how Resolver endpoints are designed to be reused.

Correct answer: A — Geoproximity routing, using AWS Traffic Flow with a bias value to expand or shrink each resource's geographic catchment area.

• A. Geoproximity routing, configured through AWS Traffic Flow, routes based on the geographic distance between the user and each resource and lets an operator apply a bias value to expand or shrink a resource's effective catchment area, which is exactly the mechanism needed to intentionally shift load toward a farther cluster.
• B. Geolocation routing assigns fixed geographic regions to specific resources based on the querier's location, but it has no distance-based bias mechanism for gradually shifting traffic between two resources during peak load.
• C. Latency-based routing always sends traffic to whichever cluster currently measures the best round-trip time and has no operator-controlled bias value to deliberately shift a percentage of traffic elsewhere during congestion.
• D. Multivalue answer routing returns a random subset of healthy records without any geographic or bias-based logic, so it cannot deliberately favor a farther cluster to relieve congestion at a nearer one.

Correct answer: A — An alias A record at the zone apex targeting the load balancer, which Route 53 resolves to its current IP addresses without a CNAME.

• A. Route 53 alias records can be created at the zone apex and can target an Application Load Balancer; internally Route 53 resolves the alias to the load balancer's current IP addresses at query time, which sidesteps the DNS protocol rule against CNAME records at the zone apex.
• B. The DNS protocol prohibits a CNAME record from coexisting with other records at the zone apex, such as the required SOA and NS records, and Route 53 does not relax this rule for standard CNAME records regardless of the target.
• C. A PTR record is used for reverse DNS lookups that map an IP address back to a hostname; it does not make a forward-facing zone apex name resolve to a load balancer's addresses.
• D. A TXT record only stores text data for informational or verification purposes and is not interpreted by browsers or DNS resolvers as a redirect or alias mechanism for the zone apex.

Correct answer: A — The route table identifier should be supplied dynamically, such as through a parameter or a stack output import, instead of being embedded as a literal value.

• A. Passing the route table ID in dynamically, for example through a parameter or Fn::ImportValue tied to the Region-specific stack, ensures the Lambda function always points at the route table that actually exists in that Region.
• B. The programming language used has no bearing on why the function is pointed at a stale identifier; the literal value would still be wrong regardless of how the code is written.
• C. Transit Gateway route tables are Regional resources and there is no single route table object that spans Regions, so this option does not describe how Transit Gateway actually works.
• D. Termination protection only prevents accidental stack deletion; it does nothing to fix a template that embeds the wrong Region's identifier as a literal value.

Correct answer: A — A CloudFormation drift detection operation on the stack, which compares the current resource configuration against the template's expected state and reports each differing property.

• A. Drift detection compares each managed resource's live configuration against what the template declares and reports the specific properties that no longer match, which is exactly the evidence the team wants before acting.
• B. Reapplying the template would overwrite the manual changes without first showing what was different, which destroys the evidence the team needs and skips the investigation step.
• C. An aggregated Config query would list Security Groups broadly but would not specifically compare them against what each CloudFormation stack expects, so it does not directly answer which properties drifted.
• D. Reachability Analyzer evaluates whether a specific path is currently allowed between two resources; it does not compare the live Security Group configuration against the CloudFormation template.

Correct answer: A — A transit virtual interface associated with a Direct Connect gateway that is itself associated with the Transit Gateway.

• A. A transit virtual interface is the interface type designed to reach one or more Transit Gateways through a Direct Connect gateway, letting on-premises routers reach every VPC attached to that Transit Gateway over one connection.
• B. A private virtual interface attaches to a virtual private gateway for a single VPC, not to a Transit Gateway route table, so it cannot fan out to every attached VPC on its own.
• C. A public virtual interface reaches public AWS service endpoints over public IP addressing and has no association with Transit Gateway attachments or private VPC CIDR ranges.
• D. Hosted connection is a Direct Connect connection ownership model, not a virtual interface type, so there is no such thing as a hosted connection virtual interface for reaching a Transit Gateway.

Correct answer: A — Equal-cost multi-path routing across the two equal-cost VPN attachments in the Transit Gateway route table.

• A. When two VPN attachments advertise the same prefix with equal-cost BGP attributes, Transit Gateway can spread flows across both using equal-cost multi-path routing, which is the mechanism for combining throughput across multiple equal VPN connections.
• B. Accelerated VPN improves the path from on-premises to a single VPN endpoint over the AWS global network; it does not perform flow distribution across two independent VPN connections attached to a Transit Gateway.
• C. Splitting the attachments across separate route tables would isolate them from each other rather than letting the Transit Gateway load-share traffic between them over the same prefix.
• D. Adding AS_PATH prepends makes a path look less preferred, not equally preferred, so this would bias traffic away from one connection rather than enabling simultaneous use of both.

Correct answer: A — VPC peering connections are non-transitive, so traffic cannot flow from VPC A to VPC C through VPC B even though both individual peerings are active.

• A. VPC peering connections are explicitly non-transitive: a peering relationship only provides connectivity between the two directly peered VPCs, so VPC A cannot reach VPC C through VPC B no matter how the route tables are configured.
• B. AWS Resource Access Manager is used for sharing resources like subnets or Transit Gateways across accounts, and has no role in enabling or blocking transitive routing over VPC peering connections.
• C. VPC peering supports connections across different AWS accounts and does not require all three VPCs to be in one account; the non-transitivity limitation applies regardless of account ownership.
• D. The scenario does not indicate any CIDR overlap between VPC A and VPC C, and even without overlap, the fundamental limitation is that peering never forwards traffic through an intermediate peered VPC.

Correct answer: A — Migrate the connection to AWS Direct Connect, which bills egress at a lower per-GB rate

• A. Direct Connect data transfer out is billed at a lower per-GB rate than internet-based data transfer over a VPN, so moving a large, steady, predictable volume to Direct Connect directly reduces the dominant cost driver.
• B. VPN acceleration improves latency and reliability by routing through AWS edge locations, but it does not change the per-GB data transfer pricing that is driving the cost in this scenario.
• C. Splitting traffic across two VPN tunnels with ECMP increases available throughput and resilience, but both tunnels still bill data transfer at the same internet-based VPN rate, so total cost is not reduced.
• D. Global Accelerator improves performance for internet-facing endpoints such as load balancers and EC2 instances, but it is not a private connectivity or data transfer pricing mechanism for data center-to-AWS transfer.

Correct answer: C — AWS Global Accelerator with a standard accelerator pointed at Network Load Balancers in each Region

• A. CloudFront terminates HTTP/HTTPS traffic at edge locations and caches content; it is not designed for a custom TCP protocol on a non-standard port and does not provide the same fixed IP address set for this kind of traffic.
• B. Route 53 latency routing changes which IP address a DNS query resolves to, but DNS caching by clients and resolvers means failover is not immediate, and it does not provide a small set of fixed IP addresses since it just returns each Region's own IPs.
• C. Global Accelerator provides a small set of static anycast IP addresses that work for any TCP or UDP port, and it continuously health-checks regional endpoints so it can shift traffic to a healthy Region within seconds, which matches both the fixed-IP allowlisting and fast-failover requirements.
• D. A single Region's Application Load Balancer has no mechanism to fail traffic over to another Region, and ALBs use DNS names with IP addresses that can change over time rather than fixed static IPs.

Correct answer: B — The network ACL associated with the destination subnet, since Reachability Analyzer also evaluates stateless network ACL rules and will report a blocking rule when security groups permit the traffic

• A. Reachability Analyzer evaluates route tables independently of security group state, not only when a security group misconfiguration is also present, so this describes an incorrect precondition.
• B. Reachability Analyzer evaluates stateless network ACL rules on both the source and destination subnets, so a network ACL denying the traffic is the correct next component to inspect once security groups are confirmed to permit it.
• C. Endpoint policies apply to traffic through interface VPC endpoints, not general subnet-to-subnet traffic within a VPC, so this component is not relevant to this scenario and Reachability Analyzer does not treat it as the sole possible cause.
• D. Placement groups affect instance placement for networking performance, not path reachability, and Reachability Analyzer does not evaluate placement group configuration as part of its path analysis.

Correct answer: A — Lower the interface MTU, or configure TCP MSS clamping, on hosts sending traffic across the VPN tunnel to fit the roughly 1500-byte path MTU and IPsec overhead, rather than the Direct Connect jumbo frame size

• A. Site-to-Site VPN does not support the 9001-byte jumbo frame size used on Direct Connect transit virtual interfaces, so packets sized for Direct Connect exceed the VPN path MTU after IPsec overhead and require fragmentation; clamping MSS or lowering MTU avoids that fragmentation and the resulting retransmissions.
• B. Site-to-Site VPN connections do not support the same 9001-byte jumbo frame size as Direct Connect, so increasing the MTU further in this direction would worsen, not resolve, the fragmentation causing retransmissions.
• C. Enhanced Networking improves packet-per-second performance on EC2 instances, but the reported symptom is caused by packet size relative to the VPN path MTU, not by network interface driver throughput.
• D. BGP multipath and ECMP distribute traffic across multiple paths or tunnels, but they do not change the MTU of any individual path and therefore do not address fragmentation-related retransmissions.

Correct answer: A — The Transit Gateway route table for the source VPC attachment has no route matching the destination CIDR when the packets arrive, so there is no valid next hop and the traffic is dropped

• A. `PacketDropCountNoRoute` specifically counts packets dropped because the Transit Gateway route table had no matching route for the destination, which directly matches a missing or intermittently missing route to the on-premises CIDR.
• B. Exceeding an advertised route limit would prevent specific routes from being learned at all, but the metric reported is about missing routes at forwarding time, not about a route-count ceiling being enforced per packet.
• C. On-premises routers are not governed by AWS security groups, and `PacketDropCountNoRoute` reflects a routing decision inside the Transit Gateway, not a security group evaluation at the destination.
• D. Subnet IP address exhaustion would prevent new elastic network interfaces from being created, but it does not cause the Transit Gateway to drop already-routed traffic or increment a no-route metric.

Correct answer: A — Layer 2 encryption of Ethernet frames on eligible dedicated connections, using MKA for automated key rotation between the customer router and the AWS Direct Connect device

• A. MACsec operates at the data link layer, encrypting Ethernet frames on the physical link between the customer router and the AWS Direct Connect device on eligible dedicated connections, using the MACsec Key Agreement protocol to automate key rotation without manual intervention.
• B. MACsec is a Layer 2 technology, not a Layer 3 IPsec mechanism; IPsec encryption at Layer 3 over a Direct Connect virtual interface would instead require a VPN overlay, which is a separate feature from MACsec.
• C. MACsec encrypts at the Ethernet frame level on the physical link, not at the application layer, and it is not a TLS termination service.
• D. MACsec protects only the physical point-to-point link between the customer router and the AWS Direct Connect device, not the full path all the way to the originating VPC resource or on-premises host.

Correct answer: A — Temporarily disable or delete the NAT Gateway in one AZ and confirm that instances in the unaffected AZs' private subnets still reach the internet through their own AZ's NAT Gateway

• A. Because each AZ's private subnet routes only to its own AZ's NAT Gateway, disabling one NAT Gateway isolates the failure to that AZ, and confirming the other AZs' subnets remain unaffected directly validates the AZ-isolation requirement the design is meant to provide.
• B. Deleting the internet gateway removes the shared path to the internet for the entire VPC, which would be expected to disrupt every AZ simultaneously; this tests a different, VPC-wide failure mode rather than validating AZ-level isolation of a single NAT Gateway.
• C. Changing the Elastic IP allocation on a healthy NAT Gateway does not simulate an AZ outage at all, and DNS resolution success is unrelated to whether NAT Gateway failures are properly isolated per AZ.
• D. Consolidating every private subnet into a single AZ removes the multi-AZ redundancy the design depends on, making a single NAT Gateway a single point of failure rather than testing whether the existing multi-AZ isolation works as intended.

Correct answers: A, B — A global network view that visualizes transit gateway attachments, VPN connections, and Direct Connect links across Regions and accounts in one place.; Event and health monitoring that surfaces the operational status of registered transit gateways, VPN connections, and Direct Connect links.

• A. Network Manager provides a global network construct that aggregates and visualizes transit gateways, VPN connections, and Direct Connect links spanning multiple Regions and accounts in a single view.
• B. Network Manager includes event and health monitoring that reports the operational status of the registered network resources, giving operations staff visibility into connection health.
• C. Enforcing a common security group policy across accounts is the role of AWS Firewall Manager, not Transit Gateway Network Manager, which focuses on topology visualization and health monitoring.
• D. Transit Gateway does not automatically encrypt traffic between attachments; encryption for inter-Region or inter-VPC traffic requires pairing with a service such as Site-to-Site VPN, and Network Manager does not add this capability.
• E. Evaluating IAM policy compliance is outside the scope of Network Manager, which is focused on network topology and connection health rather than identity and access governance.

Correct answer: A — The network ACL associated with the application server's subnet lacks an inbound rule permitting the ephemeral return ports, since NACLs are stateless and evaluate each direction independently.

• A. Network ACLs are stateless, so an outbound rule permitting the request does not automatically allow the corresponding inbound return traffic on ephemeral ports; a missing explicit inbound rule on the subnet's NACL would produce exactly this REJECT pattern.
• B. Security groups are stateful, meaning that allowing outbound traffic automatically permits the associated inbound return traffic, so a security group misconfiguration on return traffic is not the correct explanation here.
• C. The aggregation interval only affects how often captured records are published; it has no bearing on whether inbound response packets are actually delivered or rejected.
• D. The Nitro platform affects the flow log aggregation interval, not whether response traffic is delivered, and Traffic Mirroring is unrelated to whether packets are permitted through the network.

Correct answer: A — Enable MACsec on the dedicated Direct Connect connection to encrypt frames between the customer router and the AWS device

• A. MACsec encrypts frames at the data link layer directly on a dedicated connection, satisfying the requirement to encrypt the circuit itself with hardware-based, low-latency processing.
• B. A VPN over a public virtual interface does encrypt traffic, but it works by tunneling IP packets at layer 3 rather than encrypting the dedicated circuit itself, and it adds IPsec processing overhead.
• C. Shield Advanced provides DDoS protection and cost protection; it does not encrypt frames traversing a Direct Connect connection.
• D. S3 server-side encryption protects objects at rest once they arrive in the bucket; it does nothing to protect the confidentiality of the dedicated circuit while data is in transit.

Correct answer: A — On the Application Load Balancer that Global Accelerator routes traffic to

• A. Global Accelerator operates at the network layer and forwards traffic to endpoints such as an Application Load Balancer, so TLS termination and the ACM certificate belong on that ALB.
• B. Global Accelerator does not support attaching ACM certificates to its static IP addresses, since it is a network-layer routing service and does not terminate application-layer protocols.
• C. Global Accelerator listeners forward TCP or UDP traffic to endpoints without decrypting TLS; TLS termination happens at the endpoint, not at the accelerator listener.
• D. AWS Network Firewall inspects and filters traffic; it is not a TLS termination point and is not placed in front of Global Accelerator's static IP addresses for this purpose.