Cloud Pass
なぜCloud Pass？合格体験記FAQブログ
AWS Certified Advanced Networking - Specialty (ANS-C01)
AWS Certified Advanced Networking - Specialty (ANS-C01)

模擬試験 1

65問と170分の制限時間で実際の試験をシミュレーションしましょう。AI検証済み解答と詳細な解説で学習できます。

65問題170分750/1000合格点
練習問題を見る

AI搭載

3重AI検証済み解答＆解説

すべての解答は3つの主要AIモデルで交差検証され、最高の精度を保証します。選択肢ごとの詳細な解説と深い問題分析を提供します。

GPT Pro
Claude Opus
Gemini Pro
選択肢ごとの解説
深い問題分析
3モデル合意の精度

練習問題

1
問題 1

A company has two AWS Direct Connect links to its on-premises data center. One Direct Connect link terminates in the us-east-1 Region, and the other Direct Connect link terminates in the af-south-1 Region. The company is using BGP to exchange routes with AWS. The company's on-premises environment needs to be configured to use the us-east-1 link as the primary path to AWS and the af-south-1 link as the secondary (backup) path. A network engineer must configure BGP on the on-premises router to ensure that the us-east-1 link is preferred for all traffic to AWS, and the af-south-1 link is used only if the primary link fails. The solution must use standard BGP attributes and AWS BGP community tags. How should a network engineer configure BGP to ensure that af-south-1 is used as a secondary link to AWS?

The local preference values are right for outbound traffic, but the AWS communities make AWS prefer the wrong return path by giving us-east-1 the lower community and af-south-1 the higher community. Trap: It looks attractive because 200 on us-east-1 and 50 on af-south-1 correctly handle the customer router's outbound decision.

This option sets us-east-1 local preference to 200 and af-south-1 to 50, so the customer router prefers us-east-1. It also tags us-east-1 with 7224:7300 and af-south-1 with 7224:7100, which aligns AWS-side preference with the primary/backup requirement.

This reverses the customer-side local preference by giving af-south-1 the higher value, so on-premises traffic would prefer the backup link. The AWS communities are also reversed for the intended primary/backup behavior. Trap: It includes both BGP local preference and AWS communities, but the values drive traffic opposite to the stated design.

The AWS community placement matches the intended return-path preference, but the local preference values make af-south-1 the preferred outbound path from the customer network. Trap: It can look plausible because the community tags are in the same positions as the correct answer.

問題分析

Use customer-side BGP local preference to make the us-east-1 Direct Connect link the preferred outbound path, and use AWS Direct Connect communities to influence AWS return-path preference. Option B keeps us-east-1 primary with higher local preference and the AWS high-preference community, while af-south-1 remains backup with lower local preference and the low-preference community. Scenario pattern: Active/passive Direct Connect routing Exam tip: For Direct Connect active/passive routing, use local preference for customer-to-AWS path selection and AWS communities for AWS-to-customer return-path preference.

関連サービス

AWS Direct ConnectBGPBGP local preferenceBGP communities

重要な学習ポイント

  • Higher BGP local preference is preferred inside the customer autonomous system.
  • AWS Direct Connect local-preference communities influence how AWS prefers customer-advertised prefixes.
  • Primary/backup Direct Connect designs need consistent policy in both traffic directions.
2
問題 2

A company recently implemented a security policy that prohibits developers from launching VPC network infrastructure. The policy states that any time a NAT gateway is launched in a VPC, the company's network security team must immediately receive an alert to terminate the NAT gateway. The network security team needs to implement a solution that can be deployed across AWS accounts with the least possible administrative overhead. The solution also must provide the network security team with a simple way to view compliance history. The solution must be able to detect the creation of a NAT Gateway in any VPC, alert the security team, automatically terminate the resource, and provide a historical record of compliance. The solution must also be easily deployable across multiple AWS accounts with minimal manual effort. Which solution will meet these requirements?

A cron script on EC2 in every account is polling-based, operationally heavy, and does not provide native compliance history. Trap: It appears to automate detection and deletion, but it creates instances, schedules, custom logging, and an RDS dependency in every account.

A Lambda polling design still requires custom state, custom reporting, and OpenSearch clusters in each account instead of managed compliance history. Trap: SAM and Lambda sound serverless, but the governance and historical compliance requirements remain custom-built.

GuardDuty is for threat findings and does not provide a standard NAT gateway creation compliance rule with audit-ready Config history. Trap: EventBridge plus Step Functions looks event-driven, but the cited GuardDuty finding type is not the right control plane for this policy.

A custom AWS Config rule detects prohibited NAT gateways, AWS Systems Manager Automation alerts and deletes them, and StackSets deploys the control consistently across accounts.

問題分析

AWS Config provides managed compliance evaluation and historical compliance views for prohibited NAT gateways. Systems Manager Automation can alert and remediate, while CloudFormation StackSets deploys the rule and runbooks across accounts with low administrative overhead. Scenario pattern: Multi-account compliance remediation Exam tip: When a question combines multi-account deployment, compliance history, and automated remediation, start with AWS Config plus SSM Automation and StackSets.

関連サービス

AWS ConfigNAT gatewayAWS CloudFormation StackSets

重要な学習ポイント

  • Compliance history plus resource remediation maps to AWS Config with automated remediation.
  • Use StackSets when the same governance control must be deployed across many accounts.
  • GuardDuty is threat detection, not a general NAT gateway creation compliance engine.
3
問題 3

A company is migrating applications from an on-premises data center to AWS, requiring data exchange with an on-premises mainframe. The solution must achieve 4 Gbps transfer speeds for peak traffic and ensure high availability and resiliency against circuit or router failures. Design a highly available, resilient networking solution that supports 4 Gbps and withstands circuit or router failures. Which solution will meet these requirements?

Four 10 Gbps connections distributed over two Direct Connect locations and two customer routers provide redundant circuits, router diversity, and enough remaining throughput after failures.

Two 10 Gbps links provide bandwidth, but only one circuit exists at each Direct Connect location, so the design has less circuit-level redundancy than required for a highly resilient pattern. Trap: The 10 Gbps size looks sufficient, but the question is about surviving circuit and router failures with maximum resiliency.

Four 1 Gbps links total 4 Gbps only in normal operation; losing one circuit leaves only 3 Gbps, and losing a router could leave only 2 Gbps. Trap: The four-link layout is resilient, but the per-link bandwidth is too small for the failure requirement.

Two 1 Gbps links provide only 2 Gbps before any failure and less after a link or router failure. Trap: Using two locations and routers sounds redundant, but it fails the stated throughput requirement.

問題分析

The design must keep at least 4 Gbps available while surviving a circuit, router, or Direct Connect location failure. Four 10 Gbps Direct Connect connections split across two locations and two customer routers provide both capacity headroom and redundant failure domains. Scenario pattern: Maximum-resiliency Direct Connect design Exam tip: For Direct Connect resiliency questions, size capacity for the failure state when the prompt says the design must withstand failures.

関連サービス

AWS Direct Connect

重要な学習ポイント

  • For highly resilient Direct Connect, use multiple connections at multiple Direct Connect locations and terminate them on separate customer routers.
  • Bandwidth requirements should be evaluated under failure conditions when the question explicitly requires resiliency.
  • Four 1 Gbps links provide 4 Gbps only before a link or router failure.
4
問題 4

A fintech company has multiple development environments across different AWS accounts, all operating in the us-east-1 Region. These environments host backend services on Amazon EC2 instances within private subnets, which are accessed via a Network Load Balancer (NLB) in a public subnet. For compliance reasons, API access to these services is restricted to a small number of approved third-party vendors. The NLB's security group is configured to only allow inbound TCP traffic on port 443 from a specific set of vendor IP address ranges. The company has a strict policy that whenever a new vendor is onboarded, their IP address range must be added to the NLB's security group in every account. A network engineer must find the most operationally efficient way to centrally manage these vendor IP address ranges across all accounts. The network engineer needs to implement a solution that allows for a single, centralized update of a new vendor's IP address range. This change must then be automatically reflected in the security groups of all relevant accounts without manual intervention in each account. The solution must be highly efficient and scalable. Which solution will meet these requirements in the MOST operationally efficient manner?

A DynamoDB table and Lambda updater can push CIDR changes, but it requires custom code, IAM, deployment, retries, and drift handling in every account. Trap: It creates a central data store, but the actual security group changes still depend on bespoke synchronization.

It uses a prefix list, but then adds EventBridge and Lambda in every account and omits AWS RAM sharing. Directly referencing a shared prefix list is simpler and more scalable. Trap: Prefix list is the right primitive, but the option reintroduces avoidable automation.

A shared customer-managed prefix list centralizes the vendor CIDRs and lets security groups in participating accounts reference the same object. New vendor ranges are added once to the prefix list.

S3 plus Lambda is another custom fan-out mechanism that must be deployed and operated across accounts. It is not as operationally efficient as a native shared prefix list. Trap: S3 can hold a central file, but storing CIDRs is not the same as making security groups consume them natively.

問題分析

A customer-managed prefix list shared with AWS RAM gives every account one reusable CIDR object for the approved vendor ranges. Updating that prefix list once lets security group rules that reference it consume the new range without per-account Lambda synchronization. Scenario pattern: Centralized CIDR allow list across accounts Exam tip: When many accounts need the same CIDR allow list, think customer-managed prefix list shared by AWS RAM before building Lambda-based updaters.

関連サービス

AWS Resource Access ManagerManaged prefix listsSecurity groupsAWS RAMAWS LambdaAmazon S3Amazon DynamoDB

重要な学習ポイント

  • Customer-managed prefix lists are reusable CIDR sets for security group and route table references.
  • AWS RAM is the native way to share supported network resources across accounts.
  • For repeated allow lists, prefer direct references to a managed object over custom update automation.
5
問題 5

A TGW is attached to a DX gateway and 19 VPCs. Two new VPCs (10.0.32.0/21 and 10.0.40.0/21) will be attached. The allowed prefix list has room for only one more entry. Advertise the routes from AWS to on‑premises while staying within the prefix‑list entry limit. What should the engineer do?

AWS managed prefix lists are reusable CIDR sets for VPC resources, not the control point for DX gateway route advertisements, and this still uses two prefixes. Trap: The words prefix list match the clue, but the feature is the wrong kind of prefix list.

Adding both /21s to the allowed prefix list would require two entries, but the list has room for only one. Trap: It uses the correct allowed prefix list, but it ignores the entry-limit constraint.

10.0.32.0/20 is the right aggregate, but placing it in AWS managed prefix lists would not advertise routes over Direct Connect. Trap: The CIDR math is right, which can hide that the AWS feature is wrong.

10.0.32.0/20 covers both new VPC CIDRs and, when added to the DX gateway allowed prefix list, uses one entry to permit AWS-to-on-premises advertisement.

問題分析

The Direct Connect gateway allowed prefix list controls which AWS-side routes are advertised to on-premises. Add the single aggregate 10.0.32.0/20 to that allowed prefix list so both new VPC CIDRs fit within the one remaining entry. Scenario pattern: DX gateway route advertisement summarization Exam tip: For DX gateway questions, distinguish the DXGW allowed prefix list from AWS managed prefix lists before doing CIDR summarization.

関連サービス

AWS Transit GatewayAWS Direct Connect gatewayVPC CIDRroute summarizationallowed prefix listBGPAWS Direct ConnectCIDR aggregation

重要な学習ポイント

  • DX gateway allowed prefixes determine what AWS routes are advertised to on-premises.
  • AWS managed prefix lists do not control Direct Connect BGP advertisements.
  • A broader aggregate can reduce prefix-list entries when the advertised range is acceptable.

外出先でもすべての問題を解きたいですか？

Cloud Passをダウンロード — 模擬試験、学習進捗の追跡などを提供します。

6
問題 6

A company has a 2 Gbps AWS Direct Connect hosted connection from its office to a VPC in ap-southeast-2 and adds a 5 Gbps hosted connection from a different Direct Connect location in the same Region. The connections terminate at different routers with an iBGP session between them. The network engineer wants the VPC to prioritize the 5 Gbps connection, with failover to the 2 Gbps connection if the 5 Gbps connection fails. Ensure the VPC uses the 5 Gbps Direct Connect connection for traffic to the office, with failover to the 2 Gbps connection when the 5 Gbps connection is down. Which solution will meet these requirements?

Prepending AS_PATH on the 2 Gbps router makes that advertisement less preferred by AWS while keeping it available for failover.

Advertising a longer, more-specific prefix from the 2 Gbps router would attract traffic to the slower link because longest-prefix match wins before BGP attribute comparison. Trap: The word 'longer' sounds like de-preference, but a longer prefix is more specific and therefore more preferred.

Advertising a less-specific route from the 5 Gbps router would make the desired primary path less attractive if the 2 Gbps side advertises a more-specific route. Trap: It modifies the 5 Gbps path, but in the wrong direction for AWS route selection.

Prepending AS_PATH on the 5 Gbps router would make the primary link less preferred and steer traffic to the 2 Gbps path. Trap: AS_PATH prepending is the right tool, but it must be applied to the backup path, not the preferred path.

問題分析

AWS chooses between Direct Connect paths by BGP attributes, not by connection speed alone. Prepending AS_PATH on the 2 Gbps router makes that path less attractive, so AWS prefers the 5 Gbps path and falls back to 2 Gbps if the primary route disappears. Scenario pattern: Direct Connect return-path preference Exam tip: For Direct Connect inbound path control, de-prefer the backup route you advertise to AWS rather than trying to make AWS prefer a faster circuit automatically.

関連サービス

AWS Direct ConnectBGPiBGP

重要な学習ポイント

  • To influence AWS-to-on-premises traffic, change the routes and BGP attributes advertised to AWS.
  • A longer AS_PATH is less preferred than a shorter AS_PATH when other BGP attributes are equal.
  • More-specific prefixes attract traffic; they do not make a path a backup.
7
問題 7
(2つ選択)

An internal website runs behind an internal ALB in a VPC (172.31.0.0/16). A private hosted zone example.com exists in Route 53. An AWS Site-to-Site VPN connects the office network to the VPC. Employees must access https://example.com from the office network. Enable private DNS resolution for example.com from on-premises across the VPN to the VPC’s private hosted zone and ALB. Which combination of steps will meet this requirement? (Choose two.)

A Route 53 alias record in the private hosted zone can map the apex name example.com to the internal ALB and track ALB address changes.

A CNAME is not valid at the zone apex example.com and is less appropriate for AWS load balancer targets than an alias record. Trap: A CNAME to an ALB DNS name looks familiar for subdomains, but the requirement is https://example.com.

A Resolver inbound endpoint gives the on-premises DNS server reachable IPs in the VPC, and the conditional forwarder sends example.com queries to those IPs across the VPN.

A Resolver outbound endpoint is for forwarding DNS queries from the VPC to on-premises DNS, which is the opposite direction. Trap: The word Resolver is right, but the endpoint direction is wrong.

AmazonProvidedDNS at 172.31.0.2 is intended for resources inside the VPC and is not the supported target for on-premises conditional forwarding. Trap: The .2 resolver is tempting because it resolves VPC DNS, but hybrid access requires Resolver endpoints.

問題分析

The private hosted zone needs an alias record that maps example.com to the internal ALB. On-premises resolvers then need a Route 53 Resolver inbound endpoint as the supported path for forwarding private DNS queries into the VPC over the VPN. Scenario pattern: Hybrid private DNS into Route 53 Exam tip: For on-premises resolution of Route 53 private hosted zones, choose Resolver inbound endpoint plus conditional forwarding.

関連サービス

Application Load BalancerAmazon VPCAmazon Route 53private hosted zoneAWS Site-to-Site VPNRoute 53 ResolverRoute 53 Resolver inbound endpointconditional forwarding

重要な学習ポイント

  • Use Resolver inbound endpoints for on-premises-to-VPC private DNS resolution.
  • Use Route 53 alias records for ALB targets, especially at the zone apex.
  • AmazonProvidedDNS is for resources inside the VPC, not on-premises DNS forwarding.
8
問題 8

An HPC workload needs low‑latency communication with 10 Gbps flows per node and ~100 Gbps aggregate throughput across many Amazon EC2 instances. Design the in‑VPC placement and networking to maximize east‑west performance for the HPC cluster. Which architecture solution will optimize this workload?

A single subnet in one AZ, cluster placement group, and EFA drivers on supported instances is the AWS pattern for low-latency, high-throughput HPC east-west traffic.

A spread placement group separates instances for failure isolation and ENA alone does not provide the EFA HPC communication model. Trap: Spread placement groups sound resilient, but this question is optimizing performance rather than blast-radius isolation.

Multiple VPCs and Transit Gateway add routing hops and are not used to maximize microsecond-level EC2 cluster communication. Trap: Transit Gateway is excellent for scalable routing domains, not tightly coupled HPC east-west performance.

A cluster placement group does not span multiple AZs, and cross-AZ placement adds latency that works against the HPC requirement. Trap: Multi-AZ is tempting for availability, but the workload asks for the fastest node-to-node path.

問題分析

Tightly coupled HPC traffic needs instances placed close together in one AZ with a cluster placement group for low latency and high bisection bandwidth. EFA on supported instances adds the HPC networking path needed for high-throughput east-west communication. Scenario pattern: HPC east-west performance in a VPC Exam tip: For HPC keywords like low latency, east-west traffic, and MPI-style throughput, map to single AZ + cluster placement group + EFA.

関連サービス

Amazon EC2Elastic Fabric AdapterEC2 placement groupscluster placement groupAWS Transit Gateway

重要な学習ポイント

  • Cluster placement groups are for low-latency, high-throughput networking within a single AZ.
  • EFA is the EC2 networking feature for tightly coupled HPC and MPI-style workloads.
  • Spread placement groups and multi-AZ designs optimize resilience, not minimum east-west latency.
9
問題 9

Multiple AWS accounts and VPCs in one Region must log all network traffic for EC2 instances and Amazon RDS. Logs will be used for incident investigation, must retain for 12 months, and will be accessed infrequently after 90 days. Required metadata includes vpc-id, subnet-id, and tcp-flags. Provide cost‑optimized network logging with custom fields and long‑term retention. Which solution will meet these requirements at the LOWEST cost?

Default Flow Logs do not satisfy the custom metadata requirement, and CloudWatch Logs is usually costlier for 12-month high-volume retention. Trap: Flow Logs are the right service, but both the default format and destination miss key requirements.

Traffic Mirroring captures packets and requires monitoring targets, which is excessive and expensive for broad long-term metadata logging. Trap: It sounds like it logs all traffic, but the question asks for flow metadata and lowest cost.

Custom-format VPC Flow Logs provide the required fields, and Amazon S3 supports low-cost retention with lifecycle transitions for infrequent access.

CloudWatch Logs can receive custom Flow Logs, but it is not the lowest-cost destination for large-scale 12-month retention with archival access patterns. Trap: It satisfies custom fields, but the destination conflicts with the lowest-cost retention clue.

問題分析

VPC Flow Logs can capture custom metadata fields such as vpc-id, subnet-id, and tcp-flags for EC2 and RDS network flows. Delivering the logs to Amazon S3 with lifecycle policies is the lowest-cost fit for 12-month retention and infrequent access after 90 days. Scenario pattern: Low-cost long-retention flow logging Exam tip: For custom VPC Flow Logs plus long retention, pair a custom log format with S3 and lifecycle policies.

関連サービス

VPC Flow LogsTraffic MirroringAmazon S3S3 LifecycleCloudWatch Logs

重要な学習ポイント

  • VPC Flow Logs support custom log formats with fields such as vpc-id, subnet-id, and tcp-flags.
  • S3 is usually preferred for high-volume, long-retention flow logs.
  • Traffic Mirroring captures packets and is not the low-cost default for broad flow metadata retention.
10
問題 10

A media streaming company is deploying a new application on AWS that relies on dynamic multicasting. The application spans five VPCs, all connected to a transit gateway. Amazon EC2 instances in each VPC must dynamically register to receive multicast transmissions. The solution must enable dynamic multicast registration and support multicast traffic across VPCs. How should a network engineer configure the AWS resources to meet these requirements?

Static source multicast does not meet the dynamic receiver registration requirement. Trap: It includes UDP, but misses IGMP dynamic joins.

It is static and uses TCP, so both membership and transport are wrong. Trap: The TGW wording looks close, but not the multicast mechanics.

An IGMP TGW multicast domain with subnet associations, sender ENI registration, and UDP rules satisfies dynamic multicast across VPCs.

IGMP is correct, but TCP does not carry the multicast payload traffic. Trap: It gets control plane right and data plane wrong.

問題分析

Dynamic multicast joins across VPCs require an IGMP multicast domain on Transit Gateway. Multicast payload traffic is UDP, so the network ACLs must allow UDP to the receivers and group address. Scenario pattern: Dynamic multicast across VPCs Exam tip: For TGW multicast, choose IGMP for dynamic joins and UDP for the payload.

関連サービス

IGMPTransit Gateway multicastAWS Transit GatewayUDPNetwork ACL

重要な学習ポイント

  • Dynamic TGW multicast membership maps to IGMP.
  • Multicast data is UDP, not TCP.

合格体験記(9)

C
c*****Nov 23, 2025

学習期間: 2 months

This practice questions help you in understanding the concepts on which you can get the questions in certification exam. Solutions and the explanation is really good. I was able to crack the exam. Thank you.

박
박**Nov 17, 2025

学習期間: 1 month

I reset and completed the roughly 200 questions in the app twice, studying until I fully understood the concepts.

R
r***********Nov 14, 2025

学習期間: 2 months

Excellent practice questions. It helped in refreshing a lot a concepts

김
김**Nov 9, 2025

学習期間: 2 months

The questions covered a wide range of patterns, and many similar ones appeared on the actual exam. They helped a lot.

진
진**Nov 9, 2025

学習期間: 3 months

I learned the concepts through Udemy courses and studied the questions and explanations in this app. I also reviewed unfamiliar AWS resources separately. The app was very useful.

← すべてのAWS Certified Advanced Networking - Specialty (ANS-C01)問題を見る

今すぐ学習を始める

Cloud Passをダウンロードして、すべてのAWS Certified Advanced Networking - Specialty (ANS-C01)練習問題を利用しましょう。

Get it on Google PlayDownload on the App Store
Cloud PassCloud Pass

IT認定試験問題演習アプリ

Get it on Google PlayDownload on the App Store

認定資格

AWSGoogle CloudMicrosoft Azure

法務

FAQブログプライバシーポリシー利用規約

会社

お問い合わせアカウント削除

© Copyright 2026 Cloud Pass, All rights reserved.