AWS Advanced Networking - Specialty (ANS-C01) — Practice Questions and Mock Exam

AWS PrivateLink lets a service provider expose a single service to consumers as a VPC endpoint service. The provider places a Network Load Balancer in front of the application and registers it as an endpoint service; consumers create interface VPC endpoints that map to private IP addresses in their own subnets. Because traffic flows over private ENIs and never touches the public internet, and because only the service - not the whole VPC - is exposed, PrivateLink works even when provider and consumer CIDR ranges overlap. For high availability the provider should enable the NLB in at least two Availability Zones; enabling cross-zone load balancing is an option but incurs inter-AZ data transfer charges. VPC peering and transit gateways both route between entire VPCs and require non-overlapping CIDRs, making them a poorer fit for one-to-many private service exposure. Exam tip: 'expose one application privately to many accounts, overlapping CIDRs OK' points to PrivateLink + NLB endpoint service.

A single AWS Site-to-Site VPN connection provides two tunnels primarily for high availability, and each tunnel is capped at roughly 1.25 Gbps. To scale aggregate throughput you terminate multiple VPN connections on an AWS Transit Gateway that has equal-cost multi-path (ECMP) routing enabled. When your on-premises routers advertise the same prefixes over BGP across multiple tunnels, the transit gateway distributes flows across them using ECMP, allowing throughput to scale beyond the single-tunnel limit. This requires dynamic (BGP) routing, not static routing, and it requires a transit gateway, because virtual private gateways do not support ECMP. Accelerated VPN is a separate feature that uses the AWS global network for more consistent performance but does not change bandwidth limits. Exam tip: 'scale VPN beyond per-tunnel bandwidth' equals transit gateway + ECMP + BGP advertising identical prefixes across tunnels.

To ensure that only CloudFront-processed requests reach the origin, you configure CloudFront to add a custom HTTP header (with a secret value) to every request it forwards to the origin. You then attach an AWS WAF web ACL to the origin Application Load Balancer that allows only requests containing that header and value, blocking everything else. Because AWS WAF inspects the request headers at the ALB, any client that tries to hit the ALB directly without the secret header is denied, which prevents bypassing CloudFront and its associated WAF rules at the edge. For stronger protection you can rotate the secret using AWS Secrets Manager. Field-level encryption is a different feature that encrypts specific sensitive form fields end to end and does not address origin bypass. Exam tip: 'prevent direct-to-origin access / force traffic through CloudFront' equals secret custom header plus WAF allow rule at the origin.

VPC Reachability Analyzer is a configuration-analysis tool that uses automated reasoning to test connectivity between a source and a destination resource without sending any live traffic. When a path is reachable, it returns the hop-by-hop virtual network path; when it is not, it identifies the blocking component and provides an explanation code, such as a security group, network ACL, route table, or load balancer misconfiguration. It supports endpoints like instances, ENIs, internet gateways, VPN gateways, VPC endpoints, peering connections, and transit gateways, and you can specify protocol and port (for example TCP 22). This makes it ideal for verifying intended connectivity and troubleshooting after changes. Flow Logs and Traffic Mirroring both require live traffic, and Internet Monitor focuses on internet performance. Exam tip: 'identify the blocking component without sending packets' equals Reachability Analyzer; 'see whether traffic was accepted or rejected from records' equals Flow Logs.