Question bank
AWS Certified Advanced Networking – Specialty
42 AWS Certified Advanced Networking – Specialty questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Network Automation and Optimization
4 questions in this domain
- Question 1Single Choice
Which AWS service provides declarative templates for defining network resources as code?
- AAWS CloudFormationCorrect answer
- BAWS Cloud Development Kit (CDK)
- CAWS OpsWorks
- DAWS Elastic Beanstalk
Why this is the answer
AWS CloudFormation allows you to model and provision AWS resources using declarative templates. CDK uses programming languages but still synthesizes CloudFormation templates.
- Question 2Multiple Select
Which of the following are benefits of using AWS CloudFormation StackSets for network automation? (Select two.)
- ADeploy identical network stacks across multiple accounts and regionsCorrect answer
- BAutomatically roll back failed deployments without manual intervention
- CEnable cross-account resource sharing without IAM roles
- DProvide a single administration account to manage stack instances in target accountsCorrect answer
Why this is the answer
StackSets allow deploying stacks across multiple accounts and regions from a single admin account. Automatic rollback is not a native feature; it requires custom logic. Cross-account sharing still requires proper IAM roles.
- Question 3Interactive
Examine the CloudFormation snippet. Which property change will cause the VPC resource to be replaced?
- ACidrBlockCorrect answer
- BEnableDnsSupport
- CTags
- DInstanceTenancy
Why this is the answer
Changing the CIDR block of a VPC forces replacement. Other properties like EnableDnsSupport or Tags can be updated in-place.
- Question 4Single Choice
Which AWS service continuously monitors resource configurations and evaluates compliance against defined rules?
- AAWS ConfigCorrect answer
- BAmazon Inspector
- CAWS Trusted Advisor
- DAWS CloudTrail
Why this is the answer
AWS Config evaluates resource configurations against rules to determine compliance. Inspector is for vulnerability assessment, Trusted Advisor for best practices, CloudTrail for API auditing.
Network Design
13 questions in this domain
- Question 5Single Choice
What describes the statefulness of AWS security groups?
- ASecurity groups are stateful, meaning if you allow inbound traffic, the outbound return traffic is automatically allowed.Correct answer
- BSecurity groups are stateless, requiring explicit rules for both inbound and outbound traffic.
- CSecurity groups are stateful only for TCP traffic; UDP and ICMP require separate rules.
- DSecurity groups are stateless at the subnet level but stateful at the instance level.
Why this is the answer
Security groups act as a stateful virtual firewall at the instance (ENI) level. When you allow inbound traffic, the outbound return traffic is automatically permitted, regardless of outbound rules. This is a key differentiator from network ACLs, which are stateless and require explicit rules in both directions.
- Question 6Multiple Select
Which two AWS services are managed services that can inspect network traffic for security purposes? (Select two.)
- AAWS Network FirewallCorrect answer
- BAWS WAFCorrect answer
- CNetwork ACLs
- DVPC Flow Logs
Why this is the answer
AWS Network Firewall provides stateful intrusion prevention, web filtering, and deep packet inspection across VPCs. AWS WAF is a managed web application firewall that protects against common exploits like SQL injection and XSS. Network ACLs are stateless and not a managed service; VPC Flow Logs capture metadata only, not packet payloads.
- Question 7Interactive
Refer to the following network ACL rule configuration. Based on the rules shown, which statement is correct?
- AThe NACL will allow inbound HTTP traffic from any source.Correct answer
- BThe NACL blocks all inbound ICMP traffic.
- CThe NACL is stateful and automatically allows return traffic.
- DThe NACL evaluates rules in numeric order and denies all traffic by default.
Why this is the answer
The NACL has an inbound rule with rule number 100 that allows TCP traffic on port 80 from any source (0.0.0.0/0). Rules are evaluated in order; if a rule matches, it is applied. Since the default rule ( * ) denies all traffic, any traffic not explicitly allowed is denied. The NACL is stateless, so return traffic must be explicitly allowed. ICMP is not allowed by any rule, but the statement about blocking is not necessarily true because there is no explicit deny – it would be denied by the default rule. The question asks which statement is correct: only the first option is directly supported by the rule shown.
- Question 8Single Choice
What is the primary purpose of a VPC Gateway Endpoint?
- ATo provide private connectivity to AWS services without traversing the public internet.Correct answer
- BTo enable internet access for instances in a private subnet.
- CTo peer two VPCs together in the same region.
- DTo create a VPN connection to an on-premises network.
Why this is the answer
A VPC Gateway Endpoint (e.g., for S3 or DynamoDB) allows instances in a VPC to communicate with the service over the AWS network without requiring a public IP, NAT device, or internet gateway. This improves security and reduces data transfer costs because traffic stays within the AWS backbone.
- Question 9Multiple Select
Which two PCI DSS requirements directly relate to network security controls in AWS? (Select two.)
- ARequirement 1 – Install and maintain a firewall configuration.Correct answer
- BRequirement 4 – Encrypt cardholder data over public networks.Correct answer
- CRequirement 2 – Do not use default passwords.
- DRequirement 8 – Identify and authenticate users.
Why this is the answer
Requirement 1 mandates a firewall (e.g., AWS Network Firewall, security groups) to protect cardholder data. Requirement 4 requires encryption of cardholder data transmitted over open/public networks, which can be met using TLS, VPN, or Direct Connect with MACsec. Requirements 2 and 8 deal with password management and access control, not directly network security.
- Question 10Interactive
Examine this security group rule snippet. Based on the configuration, which incoming traffic is allowed?
- AOnly inbound SSH (port 22) from any source.
- BInbound SSH (port 22) from 203.0.113.0/24 and inbound HTTP (port 80) from any source.Correct answer
- COnly inbound HTTP (port 80) from any source.
- DInbound SSH (port 22) from any source and inbound HTTP (port 80) from any source.
Why this is the answer
The security group has two inbound rules: one allows TCP port 22 from the CIDR 203.0.113.0/24, and another allows TCP port 80 from 0.0.0.0/0. Therefore, SSH is restricted to the specific IP range, while HTTP is open to the internet. The other options improperly open SSH to all or omit one of the allowed ports.
- Question 11Single Choice
Which AWS service provides centralized stateful inspection across VPCs using Suricata-compatible rules?
- AAWS Network FirewallCorrect answer
- BAWS WAF
- CSecurity Groups
- DAWS Shield Advanced
Why this is the answer
AWS Network Firewall is a managed service that provides stateful inspection, intrusion prevention, and web filtering using Suricata-compatible rules. It can be centrally managed and deployed across VPCs. AWS WAF works at the application layer on load balancers, not at the network layer. Security groups are stateful but applied per ENI, not centralized. AWS Shield Advanced is for DDoS protection.
- Question 12Multiple Select
Which two options can be used for hybrid connectivity between an on-premises data center and AWS? (Select two.)
- AAWS Direct ConnectCorrect answer
- BSite-to-Site VPNCorrect answer
- CVPC Peering
- DAWS PrivateLink
Why this is the answer
AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS. Site-to-Site VPN creates an encrypted tunnel over the public internet. VPC Peering connects VPCs, not on-premises networks. AWS PrivateLink exposes services within the same AWS network, not for hybrid connectivity.
- Question 13Interactive
Refer to the Route 53 health check configuration. What is the default evaluation interval for the health check?
- A10 seconds
- B30 secondsCorrect answer
- C60 seconds
- D5 minutes
Why this is the answer
By default, Route 53 health checks run every 30 seconds. You can configure a fast interval of 10 seconds at an additional cost. The health check type shown is HTTP, and the default interval is 30 seconds.
- Question 14Single Choice
What is the maximum data throughput supported by a single NAT Gateway in an Availability Zone?
- A45 GbpsCorrect answer
- B10 Gbps
- C100 Gbps
- D1 Gbps
Why this is the answer
Each NAT Gateway can burst up to 45 Gbps in its Availability Zone. For higher throughput, you must deploy multiple NAT Gateways across different AZs and distribute traffic. The 10 Gbps limit is outdated; 100 Gbps applies to some other services like Direct Connect ports.
- Question 15Multiple Select
Which two statements correctly differentiate an Application Load Balancer (ALB) from a Network Load Balancer (NLB)? (Select two.)
- AALB operates at Layer 7 and supports path-based routing; NLB operates at Layer 4 and supports TCP/UDP traffic.Correct answer
- BALB provides static IP addresses; NLB provides dynamic IP addresses.
- CALB is designed for HTTP/HTTPS traffic; NLB is designed for low-latency TCP/UDP traffic.Correct answer
- DBoth ALB and NLB can terminate TLS connections.
Why this is the answer
ALB works at Layer 7 (application layer) and supports path-based and host-based routing, ideal for HTTP/HTTPS services. NLB works at Layer 4 (transport layer), handling TCP, UDP, and TLS with ultra-low latency, and provides static IP addresses. NLB can also terminate TLS (with listener TLS). So the statement that ALB provides static IPs is false; NLB does. The last statement is true for both, but the question asks for differences, so the correct selections are the first and third options.
- Question 16Interactive
Study the following BGP configuration. In AWS Direct Connect, which type of virtual interface is used to connect to a Transit Gateway?
- ATransit VIFCorrect answer
- BPrivate VIF
- CPublic VIF
- DHosted VIF
Why this is the answer
To connect a Direct Connect circuit to an AWS Transit Gateway, you must create a Transit Virtual Interface (Transit VIF) on the Direct Connect connection. The Transit VIF is associated with a Direct Connect Gateway, which is then associated with the Transit Gateway. Private VIF connects to a Virtual Private Gateway for a single VPC; Public VIF is for access to AWS public services.
- Question 17Single Choice
What does 'stateless' mean in the context of Network ACLs?
- AEach packet is examined independently; both inbound and outbound rules must explicitly allow traffic.Correct answer
- BReturn traffic is automatically allowed if the inbound request was permitted.
- COnly inbound rules are evaluated; outbound traffic is always permitted.
- DRules are evaluated in random order.
Why this is the answer
A stateless firewall, such as a Network ACL, does not track connection state. Each packet is evaluated independently against the rule set. Therefore, you must configure separate inbound and outbound rules to allow return traffic. This is in contrast to security groups, which are stateful and automatically allow return traffic for permitted connections.
Network Implementation
11 questions in this domain
- Question 18Single Choice
Which AWS service provides a dedicated physical connection between on-premises and AWS?
- AAWS Site-to-Site VPN
- BAWS Direct ConnectCorrect answer
- CAWS Transit Gateway
- DAWS Client VPN
Why this is the answer
Direct Connect provides a dedicated physical connection, bypassing the internet for consistent performance.
- Question 19Multiple Select
Which two features are characteristics of AWS Security Groups?
- AStateful filteringCorrect answer
- BStateless filtering
- CApplied at subnet level
- DAllow rules onlyCorrect answer
Why this is the answer
Security Groups are stateful and only support allow rules; they operate at the ENI level.
- Question 20Interactive
Examine the CloudFormation snippet. What does the 'SourceSecurityGroupId' reference achieve?
- AIt allows traffic from any instance in the referenced security groupCorrect answer
- BIt denies traffic from that security group
- CIt allows traffic from a specific IP range
- DIt sets the rule to apply only to the subnet
Why this is the answer
Referencing a security group as a source decouples rules from IPs, simplifying management.
- Question 21Single Choice
Which routing protocol is required for AWS Direct Connect private virtual interfaces?
- AOSPF
- BBGPCorrect answer
- CEIGRP
- DStatic routing
Why this is the answer
AWS Direct Connect private virtual interfaces require BGP for dynamic routing.
- Question 22Multiple Select
Which two services can be used to automate AWS network resource deployment?
- AAWS CloudFormationCorrect answer
- BAWS CDKCorrect answer
- CAWS OpsWorks
- DAWS Elastic Beanstalk
Why this is the answer
CloudFormation and CDK are IaC services; OpsWorks and Elastic Beanstalk are not primarily for networking.
- Question 23Interactive
Examine the BGP configuration snippet. What does the 'neighbor 169.254.10.1 remote-as 64512' command do?
- AIt establishes a BGP session with the AWS peer on that IPCorrect answer
- BIt defines the local router's AS number as 64512
- CIt creates a static route to the VPC
- DIt enables OSPF routing
Why this is the answer
This command establishes a BGP session with the AWS side using the assigned link-local address.
- Question 24Single Choice
What is the default MTU for an AWS Site-to-Site VPN tunnel?
- A1500Correct answer
- B9001
- C4470
- D1460
Why this is the answer
VPN tunnels use standard Ethernet MTU 1500 due to IPsec overhead; jumbo frames are not supported.
- Question 25Multiple Select
Which two AWS services provide DDoS protection?
- AAWS Shield StandardCorrect answer
- BAWS Shield AdvancedCorrect answer
- CAWS WAF
- DAWS Network Firewall
Why this is the answer
Shield Standard and Advanced are DDoS protection services; WAF is a web application firewall.
- Question 26Interactive
Examine the CloudWatch alarm snippet. What does 'NetworkOut' metric measure?
- ABytes sent out from the network interfaceCorrect answer
- BBytes received on the network interface
- CNumber of packets dropped
- DCPU utilization
Why this is the answer
NetworkOut measures outgoing data from the instance, useful for bandwidth monitoring.
- Question 27Single Choice
Which AWS service allows transitive routing between multiple VPCs and on-premises networks?
- AAWS Transit GatewayCorrect answer
- BVPC Peering
- CDirect Connect Gateway
- DInternet Gateway
Why this is the answer
Transit Gateway provides transitive routing for VPCs, VPNs, and Direct Connect attachments.
- Question 28Multiple Select
Which two types of virtual interfaces can be created on an AWS Direct Connect connection?
- APrivate VIFCorrect answer
- BPublic VIFCorrect answer
- CTransit VIF
- DVPN VIF
Why this is the answer
Direct Connect supports private, public, and transit VIFs; VPN VIF is not a type.
Network Management and Operations
8 questions in this domain
- Question 29Single Choice
Which of the following fields is captured by VPC Flow Logs?
- AsrcaddrCorrect answer
- Bpacket payload
- CHTTP method
- DSSL certificate
Why this is the answer
VPC Flow Logs capture metadata fields such as source IP address (srcaddr), not payload or application-layer details.
- Question 30Multiple Select
Which two AWS services can be used to implement Infrastructure as Code for network resources?
- AAWS CloudFormationCorrect answer
- BTerraform with AWS providerCorrect answer
- CAWS OpsWorks
- DAWS CodeDeploy
Why this is the answer
CloudFormation and Terraform are IaC tools used to define and provision network resources in a repeatable manner.
- Question 31Interactive
Based on the CloudFormation template snippet, what resource type is being created?
- AVPCCorrect answer
- BSubnet
- CInternet Gateway
- DRoute Table
Why this is the answer
The snippet defines an AWS::EC2::VPC resource with a CIDR block, indicating a VPC creation.
- Question 32Single Choice
What is the default quota for VPC peering connections per VPC?
- A50
- B125Correct answer
- C100
- D250
Why this is the answer
Each VPC is limited to 125 peering connections by default, as noted in the AWS documentation.
- Question 33Multiple Select
Which two destinations can VPC Flow Logs be published to?
- AAmazon CloudWatch LogsCorrect answer
- BAmazon S3Correct answer
- CAmazon Kinesis Data Firehose
- DAmazon DynamoDB
Why this is the answer
VPC Flow Logs can be sent to either CloudWatch Logs or S3; other destinations are not directly supported.
- Question 34Interactive
What is the AWS CLI command doing?
- AEnabling VPC Flow LogsCorrect answer
- BCreating a new VPC
- CModifying a security group
- DDeleting a flow log
Why this is the answer
The 'create-flow-logs' command enables flow logs for a VPC, sending all traffic metadata to CloudWatch Logs.
- Question 35Single Choice
Which AWS service provides transitive routing at scale between VPCs and on-premises networks?
- AVPC Peering
- BAWS Transit GatewayCorrect answer
- CAWS Direct Connect
- DAWS VPN CloudHub
Why this is the answer
AWS Transit Gateway enables transitive routing between many VPCs and on-premises networks using a hub-and-spoke model.
- Question 36Multiple Select
Which two statements are true about Security Groups?
- AThey are statefulCorrect answer
- BThey support allow and deny rules
- CThey operate at the subnet level
- DThey evaluate all rules before allowing trafficCorrect answer
Why this is the answer
Security Groups are stateful and evaluate all rules; they only support allow rules and operate at the ENI level, not subnet.
Network Security, Compliance, and Governance
6 questions in this domain
- Question 37Single Choice
Which statement best describes the statefulness of an AWS Security Group?
- AReturn traffic is automatically allowed for permitted inbound flows.Correct answer
- BReturn traffic must be explicitly allowed in outbound rules.
- CAll traffic is allowed by default.
- DRules are evaluated in order until a match is found.
Why this is the answer
Security Groups are stateful: return traffic for allowed inbound flows is automatically permitted, regardless of outbound rules.
- Question 38Multiple Select
Which of the following are characteristics of an AWS Network ACL? (Select two)
- AStateless: return traffic must be explicitly allowed.Correct answer
- BSupports both allow and deny rules.Correct answer
- CStateful: return traffic is automatically allowed.
- DRules are evaluated all together before decision.
Why this is the answer
Network ACLs are stateless, support allow/deny rules, and are evaluated in ascending order until a match is found.
- Question 39Interactive
Refer to the VPC Flow Log entry below. What does the 'REJECT' field indicate?
- AThe traffic was allowed.
- BThe traffic was blocked.Correct answer
- CThe traffic was inspected by Network Firewall.
- DThe traffic was encrypted.
Why this is the answer
The REJECT action indicates that the traffic was denied by a security group or network ACL rule.
- Question 40Single Choice
At which OSI layer does AWS WAF operate?
- ALayer 7 (Application)Correct answer
- BLayer 4 (Transport)
- CLayer 3 (Network)
- DLayer 2 (Data Link)
Why this is the answer
AWS WAF is a web application firewall that operates at Layer 7 to protect against application-layer attacks.
- Question 41Multiple Select
Which of the following are true about AWS Shield Advanced? (Select two)
- AProvides enhanced DDoS protection for specifically subscribed resources.Correct answer
- BAutomatically protects all resources in the account.
- CIncludes 24/7 access to the DDoS Response Team (DRT).Correct answer
- DApplies to all VPCs by default.
Why this is the answer
Shield Advanced offers enhanced DDoS mitigation for subscribed resources, including DRT access.
- Question 42Interactive
Based on the CloudFormation template snippet, which ports are allowed inbound? (Select all that apply)
- A22 (SSH)Correct answer
- B80 (HTTP)Correct answer
- C443 (HTTPS)
- D3389 (RDP)
Why this is the answer
The template allows inbound TCP ports 22 and 80 from specified CIDRs.
Frequently asked questions
Everything about the AWS Certified Advanced Networking – Specialty question bank and how to use it.