{"id":15286,"date":"2026-09-17T11:17:15","date_gmt":"2026-09-17T11:17:15","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=15286"},"modified":"2026-09-17T11:17:15","modified_gmt":"2026-09-17T11:17:15","slug":"amazon-aws-certified-advanced-networking-specialty-ans-c01-practice-test-questions-and-exam-dumps-part-20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/amazon-aws-certified-advanced-networking-specialty-ans-c01-practice-test-questions-and-exam-dumps-part-20-q381-400\/","title":{"rendered":"Amazon AWS Certified Advanced Networking &#8211; Specialty ANS-C01 Practice Test Questions and Exam Dumps Part 20 Q381-400"},"content":{"rendered":"<h1><\/h1>\n<p><b>View Full <\/b><a href=\"https:\/\/www.examlabs.com\/aws-certified-advanced-networking-specialty-ans-c01-exam-dumps\"><b>Amazon AWS Certified Advanced Networking &#8211; Specialty ANS-C01 Exam Dumps<\/b><\/a><b> and Practice Test Dumps<\/b><\/p>\n<p>&nbsp;<\/p>\n<h3><b>Question 381. Which BGP attribute identifies how a route was originally introduced into BGP?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> MED<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> AS_PATH<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Origin<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Local preference<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Origin<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The BGP Origin attribute indicates how a route was introduced into BGP. Common origin values identify whether the route was learned through an interior gateway protocol, originated through a network statement, or was redistributed from another routing source. Origin is one of the attributes considered during BGP route selection after several other preferences have been evaluated. In AWS hybrid networking, understanding BGP attributes is important when multiple routes are exchanged between Direct Connect, VPN, and customer networks. Origin should not be confused with AS_PATH, which records autonomous-system traversal, or MED, which can influence the preferred entry path.<\/span><\/p>\n<h3><b>Question 382. A network team wants to attach informational tags to BGP routes so that routing policies can identify groups of routes consistently. Which BGP capability is commonly used for this purpose?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> BGP communities<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> MTU<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> LACP<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> GRE<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. BGP communities<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">BGP communities are attributes that can be attached to routes to classify or tag them for routing-policy purposes. Network administrators can use communities to identify groups of prefixes and apply consistent policies without having to create a separate rule for every individual prefix. This can simplify route-management strategies in complex environments. BGP communities are different from AS_PATH, which represents the autonomous systems through which a route has passed. They are also unrelated to LACP, which handles link aggregation, or GRE, which provides tunneling. When designing advanced hybrid networks, route tagging can help organize and automate policy decisions across interconnected routing domains.<\/span><\/p>\n<h3><b>Question 383. Two BGP routes have identical local preference and AS_PATH characteristics. One route has a lower MED than the other. What does the lower MED generally indicate?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The route should always be preferred globally<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The advertising network is suggesting a preferred entry point<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The route has a shorter IP prefix<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The route has higher local preference<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. The advertising network is suggesting a preferred entry point<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The Multi-Exit Discriminator, or MED, is a BGP attribute that can communicate a preference for how traffic should enter an autonomous system when multiple entry points are available. A lower MED is generally preferred when the relevant BGP decision process compares MED values. MED is therefore useful for influencing inbound traffic toward a network, although its exact treatment depends on the routing environment and BGP implementation. It differs from local preference, which is generally used within an autonomous system to influence outbound path selection. Understanding this directional distinction is essential when designing redundant Direct Connect or hybrid connectivity architectures.<\/span><\/p>\n<h3><b>Question 384. Which statement best describes a Direct Connect hosted virtual interface?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> It is always a physical Direct Connect connection<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It provides a virtual interface provisioned through a Direct Connect partner<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It can only access public AWS services<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It eliminates the need for BGP<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. It provides a virtual interface provisioned through a Direct Connect partner<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A hosted virtual interface, or hosted VIF, is a virtual interface provided through a Direct Connect partner. It allows a customer to obtain Direct Connect connectivity using the partner&#8217;s infrastructure rather than necessarily provisioning a dedicated physical Direct Connect connection directly. Depending on its type, a hosted VIF can provide private or public connectivity according to the supported architecture. BGP remains an important component for exchanging routing information over Direct Connect virtual interfaces. The hosted nature describes how the virtual interface is provisioned, not the elimination of routing protocols or a restriction to public AWS services.<\/span><\/p>\n<h3><b>Question 385. An enterprise has several VPCs connected to Transit Gateway and wants an SD-WAN appliance to exchange routes dynamically with Transit Gateway. Which Transit Gateway feature should the enterprise consider?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Transit Gateway Connect<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Transit Gateway multicast only<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> VPC gateway endpoint<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Internet Gateway<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Transit Gateway Connect<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Transit Gateway Connect is designed to simplify integration between Transit Gateway and network appliances such as SD-WAN solutions. It establishes Connect peers using GRE tunnels and supports dynamic routing through BGP. This allows an appliance to exchange routing information with Transit Gateway without requiring the same type of architecture used by Site-to-Site VPN attachments. The feature is particularly useful in enterprise environments where an SD-WAN platform already controls branch connectivity and route distribution. Gateway endpoints and Internet Gateways serve entirely different purposes, while Transit Gateway multicast addresses multicast traffic rather than general SD-WAN route exchange.<\/span><\/p>\n<h3><b>Question 386. Which technology does Transit Gateway Connect use as the underlying tunnel mechanism between Transit Gateway and a Connect peer?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> IPsec<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> GRE<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> TLS<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> LACP<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. GRE<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Transit Gateway Connect uses Generic Routing Encapsulation, or GRE, as its tunnel mechanism for Connect peers. BGP can then operate across the Connect peer relationship to exchange routes dynamically between Transit Gateway and the connected network appliance. This combination makes Transit Gateway Connect particularly useful for integrating SD-WAN and other supported network appliances into a centralized AWS routing architecture. GRE itself does not provide encryption in the way IPsec does, so security requirements should be evaluated separately. LACP is a link-aggregation protocol and TLS is associated with secure application communications, making neither appropriate as the Transit Gateway Connect tunnel mechanism.<\/span><\/p>\n<h3><b>Question 387. A company has IPv6-enabled private subnets and wants instances to initiate outbound IPv6 connections to the internet while preventing unsolicited inbound internet connections. Which AWS component is appropriate?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> NAT Gateway<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Internet Gateway<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Egress-only Internet Gateway<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Transit Gateway Connect<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Egress-only Internet Gateway<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">An egress-only Internet Gateway is designed for outbound-only IPv6 internet connectivity from resources in a VPC. It allows instances with IPv6 addresses to initiate connections to destinations on the internet while preventing unsolicited inbound IPv6 connections from being initiated toward those instances. This differs from a standard Internet Gateway, which supports bidirectional internet connectivity when routing and security controls permit it. NAT Gateway is commonly used for outbound IPv4 connectivity from private subnets and is not the equivalent mechanism for IPv6-only egress. Egress-only Internet Gateway is therefore appropriate when the architectural requirement specifically concerns outbound IPv6 access.<\/span><\/p>\n<h3><b>Question 388. An administrator needs VPC instances to receive IPv6 traffic from the internet as well as initiate outbound IPv6 traffic. Which gateway is required for internet connectivity?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Egress-only Internet Gateway<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Internet Gateway<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> NAT Gateway<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Resolver outbound endpoint<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Internet Gateway<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">An Internet Gateway provides the VPC component required for bidirectional internet connectivity for appropriately configured IPv6 resources. When an IPv6 subnet has a route toward an Internet Gateway and the relevant security controls permit the traffic, instances can communicate with internet destinations and can receive inbound traffic. An egress-only Internet Gateway intentionally restricts unsolicited inbound IPv6 connections, making it unsuitable when inbound connectivity is required. NAT Gateway is primarily associated with IPv4 address translation for private resources. Resolver endpoints handle DNS forwarding rather than general IP connectivity. The correct choice therefore depends on the required direction of internet traffic.<\/span><\/p>\n<h3><b>Question 389. A network engineer is troubleshooting a dual-stack VPC and discovers that an IPv6 subnet has no route for <\/b><b>::\/0<\/b><b>. What does this missing route prevent?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> All internal IPv4 communication<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> IPv6 traffic from using the default route toward an internet gateway<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> DNS queries inside the VPC<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> BGP route exchange<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. IPv6 traffic from using the default route toward an internet gateway<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">In an IPv6-enabled VPC, the <\/span><span style=\"font-weight: 400;\">::\/0<\/span><span style=\"font-weight: 400;\"> prefix represents the IPv6 default route. If a subnet&#8217;s route table does not contain an appropriate <\/span><span style=\"font-weight: 400;\">::\/0<\/span><span style=\"font-weight: 400;\"> route, IPv6 traffic does not have a default path toward destinations outside the explicitly known routes. For internet connectivity, that default route is typically directed to an Internet Gateway or, for outbound-only IPv6 designs, an egress-only Internet Gateway. The absence of <\/span><span style=\"font-weight: 400;\">::\/0<\/span><span style=\"font-weight: 400;\"> does not automatically disable IPv4 routing, DNS, or BGP. Troubleshooting dual-stack environments therefore requires examining IPv4 and IPv6 routes separately because each address family has its own routing requirements.<\/span><\/p>\n<h3><b>Question 390. Which VPC feature provides DHCP configuration information such as domain-name settings and DNS server behavior to instances?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> DHCP option set<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Network ACL<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Security group<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> NAT Gateway<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. DHCP option set<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A VPC DHCP option set provides network configuration information to instances that use DHCP. Depending on the configuration, it can specify settings such as domain name and DNS server information. This allows organizations to integrate VPC workloads with particular DNS and domain configurations when required. DHCP option sets are associated with VPCs and can influence how instances obtain network configuration at launch or through DHCP renewal. Security groups and network ACLs control traffic, while NAT Gateways provide address translation for supported outbound IPv4 traffic. DHCP option sets therefore address configuration and name-resolution-related parameters rather than packet filtering or routing.<\/span><\/p>\n<h3><b>Question 391. A company wants workloads in an AWS VPC to resolve an internal corporate namespace hosted on-premises. The organization already has a Resolver outbound endpoint. What additional configuration determines which domain queries are forwarded to the corporate DNS servers?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Route table propagation<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Resolver forwarding rule<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> CloudFront cache policy<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Security group rule only<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Resolver forwarding rule<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A Route 53 Resolver forwarding rule determines which DNS queries should be forwarded to specified DNS servers. For example, an organization can create a rule for a corporate namespace such as <\/span><span style=\"font-weight: 400;\">corp.example<\/span><span style=\"font-weight: 400;\"> and configure the rule to send matching queries to on-premises DNS resolvers through a Resolver outbound endpoint. The outbound endpoint provides the connectivity path, while the forwarding rule determines which queries use that path. These two components therefore work together in hybrid DNS architectures. Route table propagation and CloudFront cache policies do not determine DNS forwarding behavior, while security groups alone cannot define which domain names should be forwarded.<\/span><\/p>\n<h3><b>Question 392. Which Route 53 Resolver capability can help administrators investigate unexpected DNS queries originating from VPC resources?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Resolver query logging<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Transit Gateway multicast<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Direct Connect LAG<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> CloudFront signed cookies<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Resolver query logging<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Resolver query logging provides visibility into DNS queries handled by Route 53 Resolver. Administrators can use the resulting records to investigate which domain names are being queried and which resources or networks are generating the requests. This information can support troubleshooting, operational monitoring, and security investigations when unexpected DNS activity appears in a VPC. Resolver query logging is different from DNS Firewall, which is designed to apply filtering policies to DNS queries. It is also unrelated to Direct Connect LAG or CloudFront authentication features. When the goal is to understand DNS activity rather than block specific domains, query logging is the relevant capability.<\/span><\/p>\n<h3><b>Question 393. A CloudFront distribution retrieves private content from an Amazon S3 bucket. Which feature provides a mechanism for CloudFront to authenticate to the S3 origin without making the bucket broadly public?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Origin Access Control<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Client VPN<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Transit Gateway Connect<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Route 53 weighted routing<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Origin Access Control<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">CloudFront Origin Access Control, or OAC, allows CloudFront to securely access supported origins such as Amazon S3 while keeping the origin protected from general public access. The configuration uses AWS authentication mechanisms so that requests arriving through the CloudFront distribution can be authorized according to the origin policy. This architecture is preferable to simply making an S3 bucket publicly readable when content should be delivered through CloudFront. OAC is specifically concerned with origin access and authorization. Client VPN, Transit Gateway Connect, and Route 53 routing policies solve completely different networking problems and do not provide the same CloudFront-to-S3 access-control function.<\/span><\/p>\n<h3><b>Question 394. A CloudFront distribution should send requests to a secondary origin when the primary origin becomes unavailable. Which CloudFront configuration supports this behavior?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Cache key<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Origin group<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Signed cookie<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Cache policy only<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Origin group<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A CloudFront origin group can be configured with a primary origin and a secondary origin to support origin failover. When configured failure conditions occur for the primary origin, CloudFront can attempt to retrieve the requested content from the secondary origin. This provides an application-level resilience mechanism without requiring the client to know about the underlying origin change. Cache policies determine caching behavior, while signed cookies are used for controlled access to private content. An origin group is therefore the relevant CloudFront feature when the requirement is specifically to provide an alternate origin after defined failures at the primary origin.<\/span><\/p>\n<h3><b>Question 395. An application requires a load balancer that can preserve source IP information and support very high volumes of TCP connections with low processing overhead. Which AWS load balancer is most appropriate?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Application Load Balancer<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Gateway Load Balancer<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Network Load Balancer<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> CloudFront<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Network Load Balancer<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A Network Load Balancer, or NLB, operates primarily at the transport layer and is designed for high-performance TCP, UDP, and related workloads. It can handle large numbers of connections while maintaining low latency and can preserve client source IP information in supported configurations. This makes it suitable for applications that require transport-level load balancing rather than HTTP-specific routing features. Application Load Balancer is better suited to Layer 7 HTTP and HTTPS routing, while Gateway Load Balancer is designed for deploying and scaling virtual network appliances. CloudFront is a content-delivery service rather than a general-purpose transport-layer load balancer.<\/span><\/p>\n<h3><b>Question 396. A security architecture needs to insert third-party virtual appliances transparently into traffic flows while allowing the appliances to scale independently. Which AWS service is specifically designed for this appliance-insertion architecture?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Gateway Load Balancer<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Application Load Balancer<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Route 53<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Direct Connect gateway<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Gateway Load Balancer<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Gateway Load Balancer, or GWLB, is designed to deploy, scale, and manage virtual network appliances such as firewalls and intrusion-prevention systems. It operates using a transparent appliance-insertion model and works with Gateway Load Balancer endpoints so traffic can be directed through centralized inspection services. GWLB uses the GENEVE protocol for communication with supported appliances. This architecture is particularly useful when an organization wants security appliances to be inserted into network traffic without building complex application-level load-balancing logic. Application Load Balancer focuses on HTTP and HTTPS applications, while Direct Connect gateway provides hybrid routing connectivity rather than appliance insertion.<\/span><\/p>\n<h3><b>Question 397. What is the primary purpose of a Gateway Load Balancer endpoint in a VPC?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Provide access to an AWS service such as S3<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Provide private connectivity from a VPC to a Gateway Load Balancer-based appliance service<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Provide outbound IPv6 internet access<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Establish a BGP session with an on-premises router<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Provide private connectivity from a VPC to a Gateway Load Balancer-based appliance service<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A Gateway Load Balancer endpoint provides private connectivity between a VPC and a Gateway Load Balancer-based service. It is commonly used when traffic from application VPCs needs to pass through centralized security or inspection appliances deployed behind a GWLB. The endpoint is implemented using AWS PrivateLink technology and allows the service provider side to operate independently from the consuming VPC. An S3 gateway endpoint serves a different purpose, while an egress-only Internet Gateway handles IPv6 internet egress. BGP sessions are associated with routing technologies such as Direct Connect and VPN rather than GWLB endpoints.<\/span><\/p>\n<h3><b>Question 398. A network team needs to analyze the actual packets flowing between selected EC2 network interfaces without relying only on metadata about accepted or rejected traffic. Which feature should they consider?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> VPC Flow Logs<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Traffic Mirroring<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Route 53 query logging<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> AWS WAF<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Traffic Mirroring<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Traffic Mirroring allows copies of network traffic from supported network interfaces to be sent to a monitoring or security appliance for deeper packet-level analysis. This differs from VPC Flow Logs, which primarily provide metadata about network flows, such as source and destination information, ports, protocols, and traffic disposition depending on the configuration. Traffic Mirroring can therefore be useful for intrusion detection, troubleshooting, and detailed packet analysis when flow metadata alone is insufficient. Route 53 query logging focuses on DNS queries, while AWS WAF examines web requests. The appropriate feature depends on whether the investigation requires packet contents or flow-level metadata.<\/span><\/p>\n<h3><b>Question 399. An administrator observes that large packets fail between two network environments while smaller packets succeed. Which mechanism should be investigated first when diagnosing a possible MTU problem?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Path MTU Discovery<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Route 53 weighted routing<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> BGP communities<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> LACP<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Path MTU Discovery<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Path MTU Discovery, or PMTUD, helps hosts determine the largest packet size that can traverse a network path without requiring fragmentation. When large packets fail while smaller packets work, an MTU mismatch or PMTUD problem can be a significant clue. Network engineers should examine interface MTUs, tunnel overhead, ICMP handling, and intermediate network devices when troubleshooting this type of behavior. This issue is particularly relevant in environments involving VPN tunnels, Direct Connect, Transit Gateway, and other networking components where different links or encapsulation methods may impose different packet-size limitations. BGP and LACP do not directly solve packet-size compatibility problems.<\/span><\/p>\n<h3><b>Question 400. An organization has multiple equal-cost routes to the same destination and wants traffic to use multiple available paths rather than selecting only one path. Which routing capability is relevant?<\/b><\/h3>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> AS_PATH prepending<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> ECMP<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> MED<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Route 53 geolocation routing<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. ECMP<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Equal-Cost Multi-Path, or ECMP, allows traffic to use multiple paths when those paths meet the routing system&#8217;s criteria for equal cost. In supported AWS networking architectures, ECMP can improve utilization and provide additional path capacity by distributing traffic across available equivalent routes. The exact behavior depends on the specific service, routing protocol, and network architecture. AS_PATH prepending is generally used to make a route less preferred, while MED can influence path selection between routing domains. Route 53 geolocation routing operates at the DNS level and does not perform network-layer ECMP. ECMP is therefore the relevant concept for multipath forwarding across equal-cost routes.<\/span><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>View Full Amazon AWS Certified Advanced Networking &#8211; Specialty ANS-C01 Exam Dumps and Practice Test Dumps &nbsp; Question 381. Which BGP attribute identifies how a route was originally introduced into BGP? MED AS_PATH Origin Local preference Correct Answer: 3. Origin Explanation: The BGP Origin attribute indicates how a route was introduced into BGP. Common origin [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15286"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=15286"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15286\/revisions"}],"predecessor-version":[{"id":15289,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15286\/revisions\/15289"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=15286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=15286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=15286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}