Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 24

Question 230

An engineer sees traffic leaving via an Internet VPN instead of the preferred private circuit after the circuit's BGP session recovered. What should be inspected?

  1. Examine the customer BGP policy and selected best path for the AWS prefixes
  2. Analyze VIF BGP state transitions alongside router logs and BGP timers or policy events
  3. The more-specific VPN route wins destination matching before general circuit preference
  4. Withdraw only that prefix using a router prefix-list or origination policy

Explanation

Correct Answer

A:

A restored adjacency may not be the preferred route if local preference, AS-path, or more-specific routes still favor VPN.

Incorrect Answers

B:

Physical transport can remain up while BGP sessions reset because of control-plane reachability, authentication, or timers; this belongs to correlating hybrid BGP flaps with control-plane causes, while the problem is post-recovery BGP path preference assessment.

C:

Route selection starts with prefix specificity, so an aggregate path preference may not override a more-specific destination learned elsewhere; this changes prefix-length precedence over broad backup preference, not the necessary post-recovery BGP path preference assessment.

D:

In the selective removal of an obsolete BGP prefix workflow, prefix-scoped BGP policy removes the obsolete reachability advertisement without tearing down the entire hybrid adjacency; the current case needs post-recovery BGP path preference assessment.

Question 231

An operations team needs to stop announcing a retired corporate subnet to AWS without disrupting other routes. What should it change?

  1. Examine the customer BGP policy and selected best path for the AWS prefixes
  2. Update the subnet route target to a valid live NAT gateway in an appropriate Availability Zone
  3. Update the relevant AWS route advertisements and corporate route acceptance for the new CIDR
  4. Update the enterprise prefix policy to permit only the intended AWS advertised networks
  5. Withdraw only that prefix using a router prefix-list or origination policy
  6. Compare the customer router's advertised-route policy and BGP updates for the missing prefix

Explanation

Correct Answer

E:

Prefix-scoped BGP policy removes the obsolete reachability advertisement without tearing down the entire hybrid adjacency.

Incorrect Answers

A:

A restored adjacency may not be the preferred route if local preference, AS-path, or more-specific routes still favor VPN; that addresses post-recovery BGP path preference assessment, rather than selective removal of an obsolete BGP prefix.

B:

Static VPC route targets do not automatically follow replaced network components, so an obsolete target breaks outbound forwarding; this belongs to repair of dangling VPC static routes, while the problem is selective removal of an obsolete BGP prefix.

C:

Associating a secondary VPC block does not by itself guarantee every hybrid gateway and on-premises router can reach that newly added range; this changes propagation of newly assigned VPC address space, not the necessary selective removal of an obsolete BGP prefix.

D:

In the prefix-filter diagnosis when BGP peering is established workflow, BGP session establishment and route acceptance are separate stages; a filter can reject all valid prefixes without dropping the adjacency; the current case needs selective removal of an obsolete BGP prefix.

F:

For route-specific BGP advertisement troubleshooting, prefix-specific withdrawal with the session alive points to routing policy or origination changes rather than a loss of the physical circuit; however, the present requirement is selective removal of an obsolete BGP prefix.

Question 232

A VPC CIDR block is being expanded, but hybrid corporate routers have no route toward the secondary CIDR. What must operations coordinate?

  1. Trace BGP next hops and firewall state in both directions of representative flows
  2. Withdraw only that prefix using a router prefix-list or origination policy
  3. Ensure the subnet route table has the peer CIDR pointing to the peering connection
  4. Update the relevant AWS route advertisements and corporate route acceptance for the new CIDR

Explanation

Correct Answer

D:

Associating a secondary VPC block does not by itself guarantee every hybrid gateway and on-premises router can reach that newly added range.

Incorrect Answers

A:

An IPsec tunnel being up does not imply symmetric forwarding; stateful inspection requires coherent return paths; that addresses path symmetry for hybrid stateful sessions, rather than propagation of newly assigned VPC address space.

B:

Prefix-scoped BGP policy removes the obsolete reachability advertisement without tearing down the entire hybrid adjacency; this belongs to selective removal of an obsolete BGP prefix, while the problem is propagation of newly assigned VPC address space.

C:

More-specific destination routes must exist in the source subnet table; peering acceptance alone does not provide them; this changes effective subnet next hop for peered VPC traffic, not the necessary propagation of newly assigned VPC address space.

Question 233

A corporate BGP router receives an AWS-related prefix but discards the UPDATE when it detects the router’s own ASN in AS_PATH. What should the operator correct?

  1. Raise BGP hold timers until the router accepts the route with its own ASN
  2. Set a higher local preference for the rejected route without changing AS_PATH
  3. Fix the route-leak or path policy that inserts the receiving router’s own ASN into the advertised AS_PATH
  4. Withdraw all routes from every hybrid peer to eliminate the warning
  5. Enable TGW route-table propagation to override the on-premises BGP AS-path check

Explanation

Correct Answer

C:

BGP AS_PATH loop prevention normally rejects routes containing the receiver’s own AS number. Remove the erroneous advertisement or unintended path manipulation instead of resetting healthy IPsec tunnels.

Incorrect Answers

A:

Hold timers control session liveness; they do not disable the normal AS-path loop check for the router’s own ASN.

B:

Local preference influences best-path selection among usable updates; a loop-rejected route never becomes an eligible candidate.

D:

Broad withdrawal removes legitimate connectivity and does not correct the improper AS-path origination that caused the loop check.

E:

A TGW forwarding-table setting cannot force an on-premises BGP receiver to accept an update containing its own ASN.

Question 234

A Transit Gateway VPC attachment is Deleted and recreated with a different attachment ID. Some static routes still target the old ID. What is the remedy?

  1. Examine the documented TGW route priority for equal-prefix static and propagated entries
  2. Replace or remove VGW-related route entries and propagation settings in affected subnet route tables
  3. Update the subnet route target to a valid live NAT gateway in an appropriate Availability Zone
  4. Replace stale attachment targets in affected TGW static routes

Explanation

Correct Answer

D:

Route tables may retain references to previous attachment identities; routing must target a currently attached next hop.

Incorrect Answers

A:

Same-prefix route priority differs from longest-prefix selection and determines which eligible attachment receives traffic; that addresses equal-prefix route source precedence inside TGW, rather than stale transit route targets after attachment replacement.

B:

Gateway detachment changes available next hops; legacy route propagation and explicit routes must be reconciled for the new connectivity pattern; this belongs to VPC route-table cleanup after gateway migration, while the problem is stale transit route targets after attachment replacement.

C:

Static VPC route targets do not automatically follow replaced network components, so an obsolete target breaks outbound forwarding; this changes repair of dangling VPC static routes, not the necessary stale transit route targets after attachment replacement.

Question 235

A new PrivateLink service version moves from one backend NLB to another, and consumers must maintain their existing interface endpoints. What provider-side component needs controlled updating?

  1. Verify target-group health and listening ports behind the PrivateLink endpoint service
  2. Update the supported load balancer associations and health of the existing endpoint service
  3. Withdraw only that prefix using a router prefix-list or origination policy
  4. Update the relevant AWS route advertisements and corporate route acceptance for the new CIDR

Explanation

Correct Answer

B:

Service consumers address the endpoint service; maintaining a viable provider backend avoids recreating customer-side connectivity.

Incorrect Answers

A:

Endpoint DNS and interface ENIs can be healthy even if the provider's actual application targets fail health checks or do not accept the port; that addresses distinguishing PrivateLink plumbing from provider backend health, rather than continuity of provider-managed PrivateLink service endpoints.

C:

Prefix-scoped BGP policy removes the obsolete reachability advertisement without tearing down the entire hybrid adjacency; this changes selective removal of an obsolete BGP prefix, not the necessary continuity of provider-managed PrivateLink service endpoints.

D:

In the propagation of newly assigned VPC address space workflow, associating a secondary VPC block does not by itself guarantee every hybrid gateway and on-premises router can reach that newly added range; the current case needs continuity of provider-managed PrivateLink service endpoints.

Question 236

A team wants AWS workloads to resolve the corporate namespace, but Resolver outbound endpoint security groups allow no outbound port 53 traffic. What maintenance action is needed?

  1. Verify target-group health and listening ports behind the PrivateLink endpoint service
  2. Update the subnet route target to a valid live NAT gateway in an appropriate Availability Zone
  3. Permit endpoint egress for DNS traffic to authorized corporate resolver addresses
  4. Audit route-propagation enablement and route-table associations for relevant VPN attachments

Explanation

Correct Answer

C:

Conditional DNS forwarding depends on the endpoint ENIs being able to reach external DNS targets, regardless of the rule's existence.

Incorrect Answers

A:

Endpoint DNS and interface ENIs can be healthy even if the provider's actual application targets fail health checks or do not accept the port; that addresses distinguishing PrivateLink plumbing from provider backend health, rather than outbound endpoint network permission for resolver forwarding.

B:

Static VPC route targets do not automatically follow replaced network components, so an obsolete target breaks outbound forwarding; this belongs to repair of dangling VPC static routes, while the problem is outbound endpoint network permission for resolver forwarding.

D:

In the containment of dynamically learned hybrid routes workflow, which prefixes enter each segmentation table is governed by its propagation settings, not merely by the existence of a branch VPN; the current case needs outbound endpoint network permission for resolver forwarding.

Question 237

A BGP session on a private VIF resets several times daily without corresponding physical connection alarms. What data should be inspected?

  1. Examine the customer BGP policy and selected best path for the AWS prefixes
  2. Withdraw only that prefix using a router prefix-list or origination policy
  3. Compare the customer router's advertised-route policy and BGP updates for the missing prefix
  4. Analyze VIF BGP state transitions alongside router logs and BGP timers or policy events

Explanation

Correct Answer

D:

Physical transport can remain up while BGP sessions reset because of control-plane reachability, authentication, or timers.

Incorrect Answers

A:

A restored adjacency may not be the preferred route if local preference, AS-path, or more-specific routes still favor VPN; that addresses post-recovery BGP path preference assessment, rather than correlating hybrid BGP flaps with control-plane causes.

B:

Prefix-scoped BGP policy removes the obsolete reachability advertisement without tearing down the entire hybrid adjacency; this belongs to selective removal of an obsolete BGP prefix, while the problem is correlating hybrid BGP flaps with control-plane causes.

C:

Prefix-specific withdrawal with the session alive points to routing policy or origination changes rather than a loss of the physical circuit; this changes route-specific BGP advertisement troubleshooting, not the necessary correlating hybrid BGP flaps with control-plane causes.

Question 238

A private VPC subnet unexpectedly routes traffic to a NAT gateway that has been replaced, and the subnet route becomes blackhole. What should be repaired?

  1. Apply longest-prefix matching to the packet destination in the VPC route table
  2. Update the subnet route target to a valid live NAT gateway in an appropriate Availability Zone
  3. Replace or remove VGW-related route entries and propagation settings in affected subnet route tables
  4. Ensure the subnet route table has the peer CIDR pointing to the peering connection

Explanation

Correct Answer

B:

Static VPC route targets do not automatically follow replaced network components, so an obsolete target breaks outbound forwarding.

Incorrect Answers

A:

The effective route is chosen from matching network destinations; a general route to a transit hub does not automatically override a more-specific peer route; that addresses destination prefix match within subnet routing, rather than repair of dangling VPC static routes.

C:

Gateway detachment changes available next hops; legacy route propagation and explicit routes must be reconciled for the new connectivity pattern; this changes VPC route-table cleanup after gateway migration, not the necessary repair of dangling VPC static routes.

D:

In the effective subnet next hop for peered VPC traffic workflow, more-specific destination routes must exist in the source subnet table; peering acceptance alone does not provide them; the current case needs repair of dangling VPC static routes.

Question 239

A regional transit gateway contains static and propagated routes with the same destination prefix. Which priority behavior should the operator verify?

  1. The more-specific VPN route wins destination matching before general circuit preference
  2. The more-specific /24 route is selected by longest-prefix match
  3. Examine the documented TGW route priority for equal-prefix static and propagated entries
  4. Apply longest-prefix matching to the packet destination in the VPC route table
  5. Replace stale attachment targets in affected TGW static routes

Explanation

Correct Answer

C:

Same-prefix route priority differs from longest-prefix selection and determines which eligible attachment receives traffic.

Incorrect Answers

A:

Route selection starts with prefix specificity, so an aggregate path preference may not override a more-specific destination learned elsewhere; that addresses prefix-length precedence over broad backup preference, rather than equal-prefix route source precedence inside TGW.

B:

A broad propagated aggregate does not supersede a more-specific prefix even if both are valid transit routes; this belongs to longest-prefix path selection in transit routing, while the problem is equal-prefix route source precedence inside TGW.

D:

In the destination prefix match within subnet routing workflow, the effective route is chosen from matching network destinations; a general route to a transit hub does not automatically override a more-specific peer route; the current case needs equal-prefix route source precedence inside TGW.

E:

This produces stale transit route targets after attachment replacement: Route tables may retain references to previous attachment identities; routing must target a currently attached next hop; the stem instead tests equal-prefix route source precedence inside TGW.

Question 240

A corporate router advertises a more-specific route over backup VPN than over Direct Connect. The backup unexpectedly carries that subnet's traffic. What explains it?

  1. Apply longest-prefix matching to the packet destination in the VPC route table
  2. Examine the customer BGP policy and selected best path for the AWS prefixes
  3. The more-specific /24 route is selected by longest-prefix match
  4. The more-specific VPN route wins destination matching before general circuit preference

Explanation

Correct Answer

D:

Route selection starts with prefix specificity, so an aggregate path preference may not override a more-specific destination learned elsewhere.

Incorrect Answers

A:

The effective route is chosen from matching network destinations; a general route to a transit hub does not automatically override a more-specific peer route; that addresses destination prefix match within subnet routing, rather than prefix-length precedence over broad backup preference.

B:

A restored adjacency may not be the preferred route if local preference, AS-path, or more-specific routes still favor VPN; this belongs to post-recovery BGP path preference assessment, while the problem is prefix-length precedence over broad backup preference.

C:

A broad propagated aggregate does not supersede a more-specific prefix even if both are valid transit routes; this changes longest-prefix path selection in transit routing, not the necessary prefix-length precedence over broad backup preference.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests