AWS ANS-C01 Practice Test

ANS-C01 practice test: what's covered

• Network Design
• Implementation
• Management & Operation
• Security, Compliance & Governance
• Transit Gateway
• Direct Connect
• Route 53
• PrivateLink

Free ANS-C01 sample questions

1. A company has 40 VPCs across three Regions and a growing number of on-premises data centers. The network team wants a hub-and-spoke design that allows transitive routing between all VPCs and the on-premises sites while minimizing the number of connections to manage. Which AWS service should anchor this design?

   • A. AWS Transit Gateway with inter-Region peering
   • B. Full mesh of VPC peering connections between every VPC
   • C. A separate VPN connection from each VPC to on-premises
   • D. AWS PrivateLink endpoints between each pair of VPCs
   Show answer

   Correct: A. Transit Gateway is the regional hub that provides transitive routing between thousands of VPCs and on-premises networks, and inter-Region peering connects hubs across Regions. VPC peering is non-transitive and does not scale to a full mesh of 40 VPCs; PrivateLink exposes single services, not transitive any-to-any routing.

2. An architect must connect two VPCs so that resources can reach each other privately. Both VPCs use the CIDR block 10.0.0.0/16. What is the correct conclusion about using VPC peering here?

   • A. VPC peering cannot be established because the two VPCs have overlapping CIDR blocks
   • B. Peering will work and AWS will automatically NAT the overlapping ranges
   • C. Peering will work as long as both VPCs are in the same Region
   • D. Peering will work but only IPv6 traffic will be routable
   Show answer

   Correct: A. VPC peering (and Transit Gateway attachments) require non-overlapping CIDR blocks because routing is based on destination IP. AWS does not NAT overlapping ranges across a peering connection, so one VPC must be re-addressed or a private NAT solution introduced.

3. A SaaS provider wants to expose a single internal application to hundreds of consumer VPCs owned by different AWS accounts without exposing its entire VPC, and without requiring non-overlapping CIDRs between provider and consumers. Which design meets these goals?

   • A. Publish the application behind a Network Load Balancer as an AWS PrivateLink endpoint service
   • B. Create a Transit Gateway and attach every consumer VPC
   • C. Set up VPC peering from the provider VPC to each consumer VPC
   • D. Place the application behind an internet-facing Application Load Balancer with IP allow-lists
   Show answer

   Correct: A. PrivateLink exposes only the specific service through an interface endpoint, works across overlapping CIDRs because traffic terminates on ENIs in the consumer VPC, and scales to many accounts. Transit Gateway and peering require non-overlapping CIDRs and expose more of the network than needed.

4. A company needs a private, dedicated, consistent-bandwidth connection from its data center to AWS that does not traverse the public internet. They also want resilience against a single device or path failure. Which design BEST meets these requirements?

   • A. Two AWS Direct Connect connections at two different Direct Connect locations
   • B. A single AWS Direct Connect connection with a backup Site-to-Site VPN over the same router
   • C. Two Site-to-Site VPN tunnels to a single virtual private gateway
   • D. A single 10 Gbps Direct Connect connection with link aggregation enabled
   Show answer

   Correct: A. AWS's maximum-resiliency recommendation uses Direct Connect connections terminating at separate Direct Connect locations so no single location, device, or path is a single point of failure. A single connection (even with LAG) or a VPN on the same router does not remove the single-location/single-path risk.

5. An enterprise wants centralized internet egress for dozens of spoke VPCs attached to a Transit Gateway, so it does not have to deploy a NAT gateway in every VPC. Which design pattern achieves this?

   • A. A central egress VPC with NAT gateways and an internet gateway, reached by spokes via Transit Gateway routes
   • B. A NAT gateway in each spoke VPC pointing at the Transit Gateway
   • C. An internet gateway attached directly to the Transit Gateway
   • D. PrivateLink endpoints in each spoke pointing at a shared internet gateway
   Show answer

   Correct: A. Centralized egress places NAT gateways and an IGW in one inspection/egress VPC; spoke route tables send 0.0.0.0/0 to the Transit Gateway, which forwards to the egress VPC. An internet gateway cannot attach to a Transit Gateway, and per-VPC NAT defeats the centralization goal.

Last updated: 2026-10-19

ANS-C01 practice test FAQ

Related practice tests

• AWS SAA-C03 practice test
• AWS SAP-C02 practice test
• Azure AZ-700 practice test
• AWS DOP-C02 practice test
• CCNA 200-301 practice test
• AWS SCS-C02 practice test