AWS Advanced Networking Specialty Flashcards (ANS-C01)
The ANS-C01 is the AWS exam least forgiving of vocabulary-only knowledge. Most questions describe a working topology, break one thing, and ask which of four plausible components is responsible. Knowing that a Transit Gateway exists gets you nowhere; knowing that an attachment associates with exactly one route table, and that propagation is a separate control, gets you the answer.
These cards lean toward the details that decide questions: reserved addresses, BGP path selection order, which resolver endpoint direction you need, and the handful of asymmetries AWS likes to ask about, such as CloudFront certificates living in us-east-1 while ALB certificates must be regional.
Work through the deck with the diagram open. When a card mentions an attachment, a VIF, or a resolver endpoint, find it in the topology first. Most of the exam’s difficulty is holding this shape in your head, and the cards are much easier to retain once they are attached to a place on the map rather than floating as facts.
All cards in this deck40 cards
Listed for reference and for searching. Use the deck above to study; recall works better than reading.
Why can traffic not flow between VPC A and VPC C when both are peered to VPC B?
VPC peering does not support transitive routing. A peering connection only carries traffic between the two VPCs it joins, so A cannot reach C through B. To get transitive routing you need a Transit Gateway, a full mesh of peerings, or a routing appliance in B.
How many VPC peering connections does a full mesh of 10 VPCs require?
n(n-1)/2 = 45. This quadratic growth is the standard justification for moving to a Transit Gateway hub-and-spoke, which needs only 10 attachments.
// full mesh peering count const meshLinks = (n) => (n * (n - 1)) / 2; meshLinks(10); // 45 meshLinks(50); // 1225What are the five reserved IP addresses in every VPC subnet?
The first four and the last one. For 10.0.0.0/24: .0 network address, .1 VPC router, .2 Amazon DNS resolver (base of VPC CIDR + 2), .3 reserved for future use, and .255 broadcast (reserved even though VPCs do not support broadcast). A /24 therefore gives you 251 usable addresses, not 256.
What is the smallest and largest VPC CIDR block AWS allows?
Between /28 (16 addresses) and /16 (65,536 addresses) for the primary CIDR. Subnets follow the same /28 to /16 range. You can add secondary CIDR blocks to expand a VPC afterwards, but you can never resize the primary block.
Security group vs network ACL: name the four differences that matter on the exam.
Security groups are stateful, attach to ENIs, support allow rules only, and evaluate all rules together. NACLs are stateless, attach to subnets, support both allow and deny, and evaluate rules in numbered order until a match. Stateless is the trap: an NACL that allows inbound 443 also needs an outbound rule for the ephemeral port range 1024-65535.
A private subnet instance needs outbound internet access. NAT Gateway or NAT instance?
NAT Gateway for almost everything: managed, scales to 100 Gbps, AZ-resilient if you deploy one per AZ. Choose a NAT instance only when you need port forwarding, a bastion on the same host, or to use it as a security group target, none of which a NAT Gateway supports.
Gateway endpoint vs interface endpoint (PrivateLink): what is the practical difference?
Gateway endpoints exist only for S3 and DynamoDB, are free, use a route table entry with a prefix list, and cannot be reached from on-premises. Interface endpoints create an ENI with a private IP in your subnet, cost per hour and per GB, work for most services, and are reachable over DX or VPN from on-premises.
Your on-prem network needs to reach S3 privately. Gateway endpoint or interface endpoint?
Interface endpoint. A gateway endpoint is only reachable from within the VPC because it works through a route table entry, and on-premises traffic arriving over DX or VPN cannot use it. An interface endpoint has a real private IP that on-premises can route to.
What does BGP path selection consider first, before any attribute you can tune?
Longest prefix match. A more specific route always wins regardless of AS_PATH, local preference, or MED. Only among routes with identical prefixes does AWS then prefer static/propagated routes, then shortest AS_PATH, then lowest MED. Advertising a more specific prefix is the bluntest way to force a path.
Rank the four ways AWS prefers a route to on-premises when several exist.
1) A longer (more specific) prefix wins outright. 2) Static VPN routes are preferred over BGP-learned routes. 3) Direct Connect is preferred over VPN for the same prefix. 4) Among BGP routes, shortest AS_PATH, then lowest MED. So a VPN advertising 10.1.0.0/24 beats a DX advertising 10.0.0.0/8.
What is AS_PATH prepending used for?
To make a path look less attractive so traffic prefers another link. You advertise the same prefix with your ASN repeated several times, lengthening the AS_PATH. This is how you make a VPN a standby for a DX connection when both advertise the same prefix, since you cannot set local preference on what AWS advertises to you.
Is a single Direct Connect connection highly available?
No. A single connection is a single point of failure: one physical port, one router, often one location. AWS provides an SLA only with resilient topologies. Maximum resiliency means two connections at two separate locations with separate devices. A common budget option is one DX plus a Site-to-Site VPN as backup, which gives failover but not the DX SLA.
Private VIF, public VIF, transit VIF: what does each connect to?
A private VIF connects to one VPC (via a Virtual Private Gateway) or to a Direct Connect Gateway. A public VIF reaches AWS public service endpoints such as S3 over the DX rather than the internet, and does not reach your VPCs. A transit VIF connects a DX Gateway to Transit Gateways, which is how you get one DX serving many VPCs across accounts and regions.
Can a Direct Connect Gateway connect a VIF to a Transit Gateway?
Yes, but only through a transit VIF, and the DX must be a dedicated or hosted connection of 1 Gbps or more. A DX Gateway supports up to three Transit Gateway associations, and you must define allowed prefixes on the association because TGW routes are not automatically advertised on-premises.
How does a Transit Gateway decide where to send an attachment traffic?
Each attachment associates with exactly one TGW route table, which determines what that attachment can reach. Route propagation is separate and controls which attachments advertise their routes into a table. Associating an attachment with a route table that has no route to a destination blackholes the traffic, which is exactly how you isolate dev from prod.
How do you isolate two VPCs attached to the same Transit Gateway?
Give them separate TGW route tables with no routes to each other, or add an explicit blackhole route. Security groups and NACLs cannot help, because by the time traffic reaches the TGW it has already left the source VPC. Segmentation on a TGW is a routing decision, not a firewall decision.
Two VPCs have overlapping CIDR blocks and must communicate. What are your options?
Peering and Transit Gateway both refuse overlapping CIDRs. Your options are PrivateLink to expose specific services without routing, a NAT layer to translate addresses, or re-addressing one VPC. PrivateLink is usually the pragmatic answer because it needs no shared address space at all.
What does an inbound Route 53 Resolver endpoint do?
It lets on-premises DNS servers query Route 53 private hosted zones by forwarding to an IP inside your VPC. Traffic flows on-premises to AWS. Pair it with a conditional forwarder on your on-prem resolver for the private zone name.
What does an outbound Route 53 Resolver endpoint do?
It lets resources in your VPC resolve on-premises names by forwarding matching queries out to your on-prem DNS. You attach Resolver rules that match a domain such as corp.example.com and specify the on-prem target IPs. Traffic flows AWS to on-premises. Full bidirectional hybrid DNS needs both endpoint types.
Which two VPC attributes must be enabled for instances to get DNS hostnames that resolve?
enableDnsSupport (the Amazon-provided resolver at VPC base + 2 answers queries) and enableDnsHostnames (instances receive public DNS hostnames). Private hosted zone resolution and interface endpoint private DNS both silently fail if enableDnsSupport is off.
CloudFront or Global Accelerator?
CloudFront caches content at the edge and is for HTTP/HTTPS with cacheable responses. Global Accelerator does not cache; it gives you two static anycast IPs and routes over the AWS backbone from the nearest edge, working for TCP and UDP. Choose Global Accelerator for non-HTTP protocols, for static IPs that never change, or for fast regional failover; choose CloudFront for cacheable web content.
What is an origin access control (OAC) in CloudFront?
A CloudFront principal that signs requests to an S3 origin so the bucket can stay fully private and accept traffic only from your distribution. It replaces the legacy origin access identity (OAI), supports SSE-KMS and all regions, and is enforced with a bucket policy conditioned on the distribution ARN.
Where must an ACM certificate live for a CloudFront distribution?
us-east-1, regardless of where your origin is. For an Application Load Balancer the certificate must be in the same region as the balancer. This asymmetry is a favourite exam detail.
ALB, NLB, or GWLB: which do you pick for a third-party inspection appliance?
Gateway Load Balancer. It operates at layer 3, uses GENEVE encapsulation on port 6081 to hand packets to appliances transparently, and preserves the original source and destination. ALB is layer 7 for HTTP, NLB is layer 4 for TCP/UDP with static IPs and very high throughput.
VPC Flow Logs or Traffic Mirroring?
Flow Logs record metadata about accepted and rejected flows: 5-tuple, bytes, packets, action. They cannot show you payload. Traffic Mirroring copies actual packets from an ENI to a target for deep inspection with an IDS. Use Flow Logs to answer "was it blocked", Traffic Mirroring to answer "what was in it".
A Flow Log shows ACCEPT outbound and no matching inbound record. What does that tell you?
The traffic left but the reply never arrived, so the problem is beyond your subnet: a route table missing a return path, an asymmetric route, a NACL on the far side, or a stateless device in the middle. Because security groups are stateful, a security group blocking the return of an allowed outbound flow is not the explanation.
What is the MTU on a Direct Connect, a VPN, and inside a VPC?
Inside a VPC, 9001 bytes (jumbo frames) between instances that support it. Direct Connect supports 1500 or 9001 on private and transit VIFs. Site-to-Site VPN is capped at 1500 and in practice lower after IPsec overhead, around 1436 for TCP. Transit Gateway supports 8500 bytes. Mismatched MTU shows up as large transfers hanging while pings succeed.
What does "MTU black hole" mean and how do you diagnose it?
A path where oversized packets are dropped silently because ICMP "fragmentation needed" is blocked, so Path MTU Discovery never learns to shrink. Small packets work, large ones hang. Diagnose with ping -M do -s 1472 (do not fragment) and step the size down; fix by allowing ICMP type 3 code 4 or by clamping MSS.
Why might an instance in a public subnet still have no internet access?
Work the list: no route to an internet gateway in its route table, no public or Elastic IP assigned, a security group with no matching egress, a NACL missing the ephemeral return ports, or the instance is in a subnet whose route points to a NAT Gateway in the same subnet, which loops.
What is a prefix list and where is it useful?
A named, versioned collection of CIDR blocks you reference in security groups and route tables instead of repeating literals. Customer-managed lists hold your own ranges; AWS-managed lists cover service ranges such as S3 and DynamoDB, which is what a gateway endpoint route uses. Updating the list updates every rule that references it.
How do you centralise internet egress for many VPCs?
Put NAT Gateways in a shared egress VPC, attach every VPC plus the egress VPC to a Transit Gateway, and point spoke VPC default routes at the TGW. The TGW route table for spokes sends 0.0.0.0/0 to the egress attachment. Add Network Firewall in the egress VPC to inspect and filter it all in one place.
What is asymmetric routing and why does it break inspection appliances?
When the forward and return paths of a flow traverse different devices. A stateful firewall that sees only one direction has no session record for the reply and drops it. This is the main reason Gateway Load Balancer uses flow stickiness to pin both directions of a flow to the same appliance.
What happens to an Elastic IP when you stop and start an instance?
It stays attached; Elastic IPs survive stop/start. An auto-assigned public IPv4 address does not, and the instance gets a new one on start. This is the reason anything with a whitelisted address needs an Elastic IP, a NAT Gateway, or Global Accelerator rather than an auto-assigned IP.
Can you attach an internet gateway to two VPCs?
No. An internet gateway attaches to exactly one VPC, one-to-one. To share internet access across VPCs you route through a Transit Gateway to a shared egress VPC that owns its own internet gateway.
What is the difference between a Virtual Private Gateway and a Transit Gateway?
A VGW is the VPN and DX endpoint for a single VPC, supports no transitive routing, and allows one VGW per VPC. A TGW is a regional router that attaches many VPCs, VPNs and DX Gateways, supports transitive routing and multiple route tables, and can peer with TGWs in other regions. Anything beyond a handful of VPCs wants a TGW.
How do you connect Transit Gateways in two different regions?
TGW peering. Create a peering attachment between them, then add static routes in each TGW route table pointing at the peering attachment, because routes do not propagate across a peering. The traffic crosses the AWS backbone encrypted, and inter-region data transfer charges apply.
What does the Network Access Analyzer do that Reachability Analyzer does not?
Reachability Analyzer tests one specific source-to-destination path and tells you whether it is reachable and which component blocks it. Network Access Analyzer evaluates your configuration against declared scopes to find all unintended access paths, for example any route from the internet to a database subnet. One is a debugger, the other an auditor.
Your ALB target group shows all targets unhealthy but the app responds on the instance. What do you check?
The health check path, port and expected status code; whether the instance security group allows the ALB security group on the health check port; whether the app binds to 0.0.0.0 rather than 127.0.0.1; and the health check timeout versus the app cold-start time. A health check that expects 200 and receives a 302 redirect is a classic.
What is cross-zone load balancing and how does it differ between ALB and NLB?
It lets a load balancer node send traffic to targets in any AZ, not just its own. ALB has it always on and free. NLB has it off by default and charges for inter-AZ data when you enable it. With it off and uneven target counts per AZ, traffic distributes unevenly because each zonal node splits its share only among local targets.
When is IPv6 required rather than optional in a VPC design?
When you are out of RFC 1918 space, when regulation demands it, or when using an egress-only internet gateway to give private instances outbound access without NAT. Note IPv6 CIDRs are always /56 for a VPC and /64 for a subnet, addresses are public by design so security groups carry the whole burden, and dual-stack means every rule and route needs an IPv6 twin.
