AWS Certified Advanced Networking – Specialty (ANS-C01) Exam Learning Path

I recently cleared the AWS Certified Advanced Networking – Specialty (ANS-C01), which was my first, en route my path to the AWS Specialty certifications. Frankly, I feel the time I gave for preparation was still not enough, but I just about managed to get through. So a word of caution, this exam is inline or tougher than the professional exam especially for the reason that the Networking concepts it covers are not something you can get your hands dirty with easily.

AWS Certified Advanced Networking – Specialty (ANS-C01) exam focuses on AWS Networking concepts. It validates the ability to

• Design, implement, manage, and secure AWS and hybrid network architectures at scale
• Design and maintain network architecture for all AWS services
• Leverage tools to automate AWS networking tasks
• Implement network security, compliance, and governance controls

ANS-C01 Exam Domains

The ANS-C01 exam is structured into four domains (compared to six in the retired ANS-C00):

• Domain 1: Network Design (30%) — Design solutions incorporating edge networking, DNS, load balancing, routing, and connectivity
• Domain 2: Network Implementation (26%) — Implement routing, connectivity, multi-Region/multi-account solutions
• Domain 3: Network Management and Operation (20%) — Maintain, monitor, and troubleshoot network solutions
• Domain 4: Network Security, Compliance, and Governance (24%) — Implement and maintain network security controls

Refer to AWS Certified Advanced Networking – Specialty (ANS-C01) Exam Guide

AWS Certified Advanced Networking – Specialty (ANS-C01) Exam Resources

• Online Courses
  • Stephane Maarek & Chetan Agrawal – AWS Certified Advanced Networking Specialty 2026
  • Zeal Vora – AWS Certified Advanced Networking Specialty course
  • Pluralsight (formerly A Cloud Guru/Linux Academy) – AWS Certified Advanced Networking Specialty course
• Practice Tests
  • Stephane Maarek & Abhishek Singh – Practice Exam – AWS Certified Advanced Networking Specialty
  • Whizlabs — AWS Certified Advanced Networking Specialty ANS-C01 Practice Tests
  • Tutorials Dojo – AWS Certified Advanced Networking Specialty Practice Exams ANS-C01

AWS Certified Advanced Networking – Specialty (ANS-C01) Exam Summary

• AWS Certified Advanced Networking – Specialty exam covers extensive Networking concepts like VPC, VPN, Direct Connect, Transit Gateway, Route 53, ALB, NLB, Gateway Load Balancer, AWS Network Firewall, VPC Lattice, and Cloud WAN.
• One of the key tactics when solving questions is to read the question and use paper and pencil to draw a rough architecture and focus on the areas that you need to improve. You will be able to eliminate 2 answers for sure and then need to focus on only the other two.
• Be sure to cover the following topics
  • Networking & Content Delivery
    • You should know everything in Networking.
    • Understand VPC in depth
      • Understand VPC, Subnets
      • Know that AWS allows you to extend your VPC by adding secondary CIDR blocks (hint: focus on the IP limitations that you can assign to a created VPC)
      • Understand Security Groups, NACLs (Hint: know NACLs are stateless and how it is reflected in VPC Flow Logs)
      • Understand DHCP Option Sets esp. how to resolve DNS from both on-premises data center and AWS.
      • Understand VPC Peering, configuration and its limitations (Hint: try it yourself esp. cross account ones to know whats needed)
      • Understand Placement Groups, Enhanced Networking
      • Understand VPC Endpoints esp. services supported by Gateway and Interface Endpoints. Interface Endpoints are also called AWS PrivateLink.
    • AWS Transit Gateway
      • Understand Transit Gateway as the primary hub-and-spoke architecture for connecting VPCs and on-premises networks (replaces Transit VPC pattern)
      • Know Transit Gateway route tables, associations, propagations, and peering across Regions
      • Understand Transit Gateway Connect attachments for SD-WAN integration using GRE tunnels and BGP
      • Know Transit Gateway Network Manager for global network visibility
    • AWS Cloud WAN
      • Know AWS Cloud WAN for building and managing global WANs using a central dashboard and network policies
      • Understand Core Network, segments, attachments, and policies
      • Know when to use Cloud WAN vs Transit Gateway (Cloud WAN for multi-Region global networks; Transit Gateway for single-Region hub-and-spoke)
      • Understand Service Insertion for centralized inspection architectures
    • Amazon VPC Lattice
      • Know Amazon VPC Lattice as an application-layer networking service for service-to-service connectivity
      • Understand service networks, services, target groups, and listeners
      • Know that VPC Lattice works across VPCs and accounts without requiring VPC peering or Transit Gateway
      • Understand the difference: VPC Lattice (Layer 7 application networking) vs Transit Gateway (Layer 3 network connectivity)
    • AWS VPC IPAM
      • Know VPC IP Address Manager (IPAM) for planning, tracking, and monitoring IP addresses at scale
      • Understand IPAM pools, scopes, and allocations across multi-account environments
    • Virtual Private Network to establish connectivity between on-premises data center and AWS VPC
      • Understand Site-to-Site VPN, accelerated VPN (using Global Accelerator), and VPN over Direct Connect
      • Know CloudHub for connecting multiple VPN sites
    • Direct Connect to establish connectivity between on-premises data center and AWS VPC and Public Services
      • Make sure you understand Direct Connect in detail — without this you cannot clear the exam
      • Understand Direct Connect connections – Dedicated (1, 10, 100, 400 Gbps) and Hosted connections
      • Understand how to create a Direct Connect connection (hint: LOA-CFA provides the details for partner to connect to AWS Direct Connect location)
      • Understand virtual interfaces options – Private VIF for VPC resources, Public VIF for public resources, and Transit VIF for Transit Gateway
      • Understand Route Propagation, propagation priority, BGP connectivity, and BFD (Bidirectional Forwarding Detection)
      • Understand High Availability options: Second Direct Connect connection, VPN as backup, or LAG (Link Aggregation Group)
      • Understand Direct Connect Gateway – provides connectivity to multiple VPCs across Regions from on-premises using a single DX connection
      • Know Direct Connect SiteLink – enables sending data between Direct Connect locations bypassing AWS Regions (site-to-site connectivity)
      • Understand Direct Connect + Cloud WAN integration (direct gateway association with Core Network)
      • Understand MACsec encryption for Direct Connect (Layer 2 encryption for dedicated connections)
    • Route 53
      • Understand Route 53 and Routing Policies and their use cases. Focus on Weighted, Latency, Geolocation, and Geoproximity routing policies
      • Understand Route 53 Split View DNS for same DNS to access a site externally and internally
      • Understand Route 53 Resolver – inbound/outbound endpoints for hybrid DNS resolution between on-premises and AWS
      • Know Route 53 Resolver DNS Firewall – filters outbound DNS queries, blocks malicious domains, prevents DNS tunneling and DGA attacks
      • Know Route 53 Resolver DNS Firewall Advanced (launched Nov 2024) – provides intelligent protection with real-time threat detection
    • Understand CloudFront and use cases including Origin Shield and real-time logs
    • AWS Global Accelerator
      • Know Global Accelerator for improving global application availability and performance using the AWS global network
      • Understand the difference between CloudFront (content caching/CDN) and Global Accelerator (network-layer acceleration with static anycast IPs)
      • Know dual-stack support for NLB endpoints
    • Load Balancer
      • Understand ALB, NLB, and Gateway Load Balancer (GWLB)
      • Understand the difference: ALB (Layer 7 – content, host, path-based routing), NLB (Layer 4 – static IP, ultra-low latency, TLS passthrough), GWLB (Layer 3 – transparent network gateway for third-party appliances)
      • Know Gateway Load Balancer for deploying, scaling, and managing third-party virtual appliances (firewalls, IDS/IPS) with GENEVE encapsulation
      • Know how to design VPC CIDR block with NLB (Hint – minimum number of IPs required are 8)
      • Know how to pass original Client IP to the backend instances (Hint – X-Forwarded-For for ALB, Proxy Protocol for NLB, and client IP preservation for GWLB)
    • Know WorkSpaces requirements and setup
  • Security
    • AWS Network Firewall
      • Know AWS Network Firewall as a managed stateful network firewall and IDS/IPS for VPCs
      • Understand rule groups (stateless and stateful), firewall policies, and deployment models (centralized, distributed)
      • Know integration with Gateway Load Balancer for centralized inspection architectures
    • AWS Verified Access
      • Know AWS Verified Access for secure application access without VPN using Zero Trust principles
      • Evaluates each request based on user identity and device health rather than network location
      • Now supports non-HTTP(S) protocols (announced re:Invent 2024)
    • Know AWS GuardDuty as managed threat detection service
    • Know AWS Shield esp. Shield Advanced and features (DDoS cost protection, SRT access, advanced mitigation)
    • Know WAF as Web Traffic Firewall — (Hint – WAF can be attached to CloudFront, ALB, API Gateway, AppSync, and Cognito User Pools)
    • Know AWS Firewall Manager for centrally managing firewall rules across accounts and resources in AWS Organizations
  • Monitoring & Management Tools
    • Understand CloudFormation esp. in terms of Network creation. (Hint – Know Custom resources can be used to handle activities not supported by AWS)
    • Understand CloudTrail for audit and governance
    • Understand AWS Config and its use case for network compliance monitoring
    • Know VPC Reachability Analyzer for troubleshooting connectivity issues between resources
    • Know Network Access Analyzer for identifying unintended network access
    • Know Transit Gateway Network Manager for global network monitoring and SD-WAN integration
  • Integration Tools
    • Know how CloudWatch integration with SNS and Lambda can help in notification and automated remediation
  • Whitepapers and articles
    • AWS Network Connectivity Options
    • AWS Certification – Networking Services – Cheat Sheet
    • AWS Certification – Security & Identity Services – Cheat Sheet
    • AWS VPC Connectivity Options
    • Building a Scalable and Secure Multi-VPC AWS Network Infrastructure
    • Hybrid Connectivity Whitepaper
    • DNS Resolution between On-premises and AWS

Key Differences: ANS-C01 vs ANS-C00

• Structure: ANS-C01 has 4 domains (vs 6 in ANS-C00) — more streamlined and focused
• New Services: Transit Gateway, Cloud WAN, VPC Lattice, IPAM, Network Firewall, Gateway Load Balancer, Global Accelerator, Verified Access, Route 53 Resolver endpoints
• Deprecated Patterns: Transit VPC pattern replaced by Transit Gateway; complex VPN hub-and-spoke designs replaced by Transit Gateway with Cloud WAN
• Emphasis Changes: Greater focus on multi-account/multi-Region networking, Zero Trust architecture, network automation, and centralized security
• Direct Connect: Transit VIF, SiteLink, MACsec encryption, 400 Gbps connections, and Cloud WAN integration are new topics