Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 1

Question 1

An online publisher serves immutable product photographs worldwide and wants repeat requests answered near viewers without contacting the origin. Which design meets this goal?

  1. Put an Amazon CloudFront distribution in front of the image origin and set suitable cache behavior
  2. Disable edge object caching and rely only on CloudFront origin request collapsing for repeat viewers
  3. Configure CloudFront geographic restrictions for the distribution
  4. Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate

Explanation

Correct Answer

A:

CloudFront serves cacheable HTTP objects from edge locations, reducing origin requests and long-distance round trips.

Incorrect Answers

B:

Request collapsing can combine concurrent misses, but disabling object caching forces later viewers to contact the origin. It cannot substitute for cached edge copies.

C:

CloudFront evaluates the viewer country at the distribution and can prevent delivery to disallowed geographies; this changes geographic denial at the content edge, not the necessary edge caching of HTTP objects.

D:

In the TLS protection for both CloudFront connection segments workflow, the origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic; the current case needs edge caching of HTTP objects.

Question 2

A trading application uses a custom TCP protocol and must retain two fixed anycast public entry addresses while routing clients to healthy regional endpoints. What should be deployed?

  1. Configure Global Accelerator endpoint health and endpoint-group traffic dials
  2. Create an AWS Global Accelerator standard accelerator with TCP listeners and regional endpoint groups
  3. Adjust Global Accelerator endpoint weights in the endpoint groups
  4. Preserve the Global Accelerator static IP addresses and update accelerator endpoints

Explanation

Correct Answer

B:

Global Accelerator supplies static anycast addresses and steers TCP traffic across the AWS global network to healthy application endpoints.

Incorrect Answers

A:

Accelerator continuously uses endpoint health for failover and endpoint-group traffic dials to adjust the proportion of traffic offered to regional groups; that addresses network-layer health-aware global regional routing, rather than static anycast access for a non-HTTP application.

C:

Accelerator weights influence how a region's traffic is distributed among eligible endpoints without introducing an HTTP cache; this changes policy-based distribution of global network ingress, not the necessary static anycast access for a non-HTTP application.

D:

In the client-IP stability during regional backend migration workflow, clients continue targeting fixed anycast addresses while the accelerator's endpoint configuration controls destination changes; the current case needs static anycast access for a non-HTTP application.

Question 3

A media team publishes versioned JavaScript assets but sees visitors receiving an older object from edge caches. What is the most cache-efficient correction?

  1. Use CloudFront origin access control and a bucket policy allowing the distribution
  2. Publish the changed file under a versioned object name and reference that name in the application
  3. Submit a CloudFront invalidation for the affected object path
  4. Include the response-varying header in the CloudFront cache policy's cache key

Explanation

Correct Answer

B:

A new object path uses a new CloudFront cache key and avoids forcing frequent invalidations of otherwise reusable content.

Incorrect Answers

A:

Origin access control signs CloudFront requests to S3, so the bucket can stay private while edge delivery succeeds; that addresses private S3 content delivery through CloudFront, rather than deterministic publication of new cached asset versions.

C:

Invalidation causes CloudFront to remove matching cached representations so the origin's updated notice can be fetched on subsequent requests; this changes prompt eviction of a specific stale CDN object, not the necessary deterministic publication of new cached asset versions.

D:

In the accurate cache partitioning by an origin-varying request header workflow, the cache key must distinguish requests whose selected headers alter origin content, preventing incorrect reuse between those requests; the current case needs deterministic publication of new cached asset versions.

Question 4

An HTTP service must block requests from selected countries at the edge before forwarding requests to its origin. Which feature directly enforces the location restriction?

  1. Put an Amazon CloudFront distribution in front of the image origin and set suitable cache behavior
  2. Configure CloudFront geographic restrictions for the distribution
  3. Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate
  4. Use CloudFront origin access control and a bucket policy allowing the distribution

Explanation

Correct Answer

B:

CloudFront evaluates the viewer country at the distribution and can prevent delivery to disallowed geographies.

Incorrect Answers

A:

CloudFront serves cacheable HTTP objects from edge locations, reducing origin requests and long-distance round trips; that addresses edge caching of HTTP objects, rather than geographic denial at the content edge.

C:

The origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic; this changes TLS protection for both CloudFront connection segments, not the necessary geographic denial at the content edge.

D:

In the private S3 content delivery through CloudFront workflow, origin access control signs CloudFront requests to S3, so the bucket can stay private while edge delivery succeeds; the current case needs geographic denial at the content edge.

Question 5

A SaaS API needs one globally stable front door and should shift new TCP connections away from an unhealthy AWS Region. Which component should control the regional failover?

  1. Preserve the Global Accelerator static IP addresses and update accelerator endpoints
  2. Create Route 53 DNS failover records and expect their answers to provide fixed anycast TCP entry IPs
  3. Adjust Global Accelerator endpoint weights in the endpoint groups
  4. Configure Global Accelerator endpoint health and endpoint-group traffic dials

Explanation

Correct Answer

D:

Accelerator continuously uses endpoint health for failover and endpoint-group traffic dials to adjust the proportion of traffic offered to regional groups.

Incorrect Answers

A:

Clients continue targeting fixed anycast addresses while the accelerator's endpoint configuration controls destination changes; that addresses client-IP stability during regional backend migration, rather than network-layer health-aware global regional routing.

B:

Route 53 answers can steer clients toward healthy endpoints, but DNS does not supply two permanent anycast ingress addresses for a custom TCP service.

C:

Accelerator weights influence how a region's traffic is distributed among eligible endpoints without introducing an HTTP cache; this changes policy-based distribution of global network ingress, not the necessary network-layer health-aware global regional routing.

Question 6

A site delivers video clips stored in a private S3 bucket through an edge cache. How should the origin remain inaccessible to direct public requests?

  1. Configure CloudFront geographic restrictions for the distribution
  2. Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate
  3. Put an Amazon CloudFront distribution in front of the image origin and set suitable cache behavior
  4. Use CloudFront origin access control and a bucket policy allowing the distribution
  5. Submit a CloudFront invalidation for the affected object path

Explanation

Correct Answer

D:

Origin access control signs CloudFront requests to S3, so the bucket can stay private while edge delivery succeeds.

Incorrect Answers

A:

CloudFront evaluates the viewer country at the distribution and can prevent delivery to disallowed geographies; that addresses geographic denial at the content edge, rather than private S3 content delivery through CloudFront.

B:

The origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic; this belongs to TLS protection for both CloudFront connection segments, while the problem is private S3 content delivery through CloudFront.

C:

CloudFront serves cacheable HTTP objects from edge locations, reducing origin requests and long-distance round trips; this changes edge caching of HTTP objects, not the necessary private S3 content delivery through CloudFront.

E:

This produces prompt eviction of a specific stale CDN object: Invalidation causes CloudFront to remove matching cached representations so the origin's updated notice can be fetched on subsequent requests; the stem instead tests private S3 content delivery through CloudFront.

Question 7

A streaming platform wishes to issue cookies that authorize access to many protected objects under the same path. Which CloudFront access mechanism is best?

  1. Use CloudFront signed cookies with an appropriate trusted signer or key group
  2. Deploy a Lambda@Edge function for a supported event that needs network access
  3. Submit a CloudFront invalidation for the affected object path
  4. Use a CloudFront Function on the viewer-request event

Explanation

Correct Answer

A:

Signed cookies authorize groups of objects without generating a distinct signed URL for every requested segment.

Incorrect Answers

B:

Lambda@Edge supports more complex edge logic and network-access use cases than the restricted CloudFront Functions runtime; this belongs to edge function logic requiring external network calls, while the problem is authorization covering multiple restricted cached objects.

C:

Invalidation causes CloudFront to remove matching cached representations so the origin's updated notice can be fetched on subsequent requests; this changes prompt eviction of a specific stale CDN object, not the necessary authorization covering multiple restricted cached objects.

D:

In the lightweight viewer-event header processing at CDN edge workflow, cloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events; the current case needs authorization covering multiple restricted cached objects.

Question 8

A publisher needs to refresh one emergency notice at edge locations immediately, although the notice URL must remain unchanged. What should be initiated?

  1. Use a CloudFront Function on the viewer-request event
  2. Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate
  3. Use CloudFront signed cookies with an appropriate trusted signer or key group
  4. Submit a CloudFront invalidation for the affected object path

Explanation

Correct Answer

D:

Invalidation causes CloudFront to remove matching cached representations so the origin's updated notice can be fetched on subsequent requests.

Incorrect Answers

A:

CloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events; that addresses lightweight viewer-event header processing at CDN edge, rather than prompt eviction of a specific stale CDN object.

B:

The origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic; this belongs to TLS protection for both CloudFront connection segments, while the problem is prompt eviction of a specific stale CDN object.

C:

Signed cookies authorize groups of objects without generating a distinct signed URL for every requested segment; this changes authorization covering multiple restricted cached objects, not the necessary prompt eviction of a specific stale CDN object.

Question 9

An application sends HTTPS requests through CloudFront and needs encrypted connections from the edge to its custom origin as well as from viewers. What setting must be chosen?

  1. Use a CloudFront Function on the viewer-request event
  2. Submit a CloudFront invalidation for the affected object path
  3. Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate
  4. Choose the CloudFront viewer protocol policy Redirect HTTP to HTTPS

Explanation

Correct Answer

C:

The origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic.

Incorrect Answers

A:

CloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events; that addresses lightweight viewer-event header processing at CDN edge, rather than TLS protection for both CloudFront connection segments.

B:

Invalidation causes CloudFront to remove matching cached representations so the origin's updated notice can be fetched on subsequent requests; this belongs to prompt eviction of a specific stale CDN object, while the problem is TLS protection for both CloudFront connection segments.

D:

In the client-side transport upgrade at the CDN workflow, the viewer protocol policy controls client-to-edge connections and can issue an HTTPS redirect before origin processing; the current case needs TLS protection for both CloudFront connection segments.

Question 10

A global game lobby uses UDP and requires improved internet ingress latency without altering its protocol. Which AWS edge service is most suitable?

  1. Deploy a Lambda@Edge function for a supported event that needs network access
  2. Adjust Global Accelerator endpoint weights in the endpoint groups
  3. Place the UDP service behind a Global Accelerator listener with supported regional endpoints
  4. Create an AWS Global Accelerator standard accelerator with TCP listeners and regional endpoint groups

Explanation

Correct Answer

C:

Global Accelerator accepts UDP flows at edge locations and transports them over AWS networking toward application endpoints.

Incorrect Answers

A:

Lambda@Edge supports more complex edge logic and network-access use cases than the restricted CloudFront Functions runtime; that addresses edge function logic requiring external network calls, rather than global acceleration of UDP sessions.

B:

Accelerator weights influence how a region's traffic is distributed among eligible endpoints without introducing an HTTP cache; this belongs to policy-based distribution of global network ingress, while the problem is global acceleration of UDP sessions.

D:

In the static anycast access for a non-HTTP application workflow, global Accelerator supplies static anycast addresses and steers TCP traffic across the AWS global network to healthy application endpoints; the current case needs global acceleration of UDP sessions.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests