AWS Certified Advanced Networking – SpecialtyStudy guide
The specialty certification for designing, implementing, operating, and securing complex networks on AWS (ANS-C01): VPC, hybrid connectivity, edge, DNS, and network security.
About AWS Certified Advanced Networking – Specialty (ANS-C01)
AWS Certified Advanced Networking – Specialty (ANS-C01) is a Specialty-level certification from AWS. This page organizes the exam scope into a 6-chapter, 18-section study guide and lets you check your understanding with exam-style practice questions. A good flow is to read the chapters below in order, then test yourself via "Practice questions."
Exam domains (approximate weighting)
- Network Design~30%
- Network Implementation~26%
- Network Management and Operation~20%
- Network Security, Compliance, and Governance~24%
Weights are approximate guidance for the live exam. Each domain is covered in detail in the chapters and sections below.
Official exam information: https://aws.amazon.com/certification/certified-advanced-networking-specialty/
1Network Design Fundamentals
- 1.1VPC and IP Addressing Design
Understand the foundation of network design—VPC, CIDR, subnets, non-overlapping address planning, and multi-AZ. The initial design dictates later scalability and connectivity.
- 1.2Subnet and Routing Design
Understand traffic paths—public/private subnets, route tables, internet gateway, and NAT gateway. The route table decides whether a subnet is public.
- 1.3Multi-VPC and Multi-Account Connectivity Design
Understand how to connect multiple networks—choosing among VPC peering, Transit Gateway, and PrivateLink. Scale and intent drive the choice.
2Hybrid Connectivity Design
- 2.1Choosing Direct Connect vs VPN
Connect on-prem to AWS—understand Direct Connect (dedicated), Site-to-Site VPN, and the virtual private gateway (VGW), and how to choose. Learn the trade-offs of stability, cost, and setup speed.
- 2.2Direct Connect Architecture and Resiliency
Go deeper on DX—private/public/transit VIFs, BGP, redundancy via multiple connections/locations, and the DX Gateway. A single connection is a single point of failure.
- 2.3Scaling Hybrid with Transit Gateway
Bundle at a hub—understand the Transit Gateway, segmentation via TGW route tables, DX/VPN attachments, and when to use it vs peering. Centrally bundle many VPCs and on-prem.
3Edge and DNS Design
- 3.1Route 53 and Routing Policies
Route smartly with DNS—understand Route 53, latency/geolocation/weighted/failover routing, health checks, and alias records. Pick the policy that fits the goal.
- 3.2Content Delivery with CloudFront
Fast and secure at the edge—understand CloudFront, caching, origins (S3/ALB), origin protection with OAC, and TLS/WAF at the edge. Deliver with low latency from edges worldwide.
- 3.3Global Accelerator and Choosing Edge Services
The other edge—understand Global Accelerator, static anycast IPs, the AWS backbone, fast regional failover, and how it differs from CloudFront. Choose it for non-HTTP or static-IP needs.
4Network Implementation
- 4.1Implementing VPC Endpoints
Connect privately—understand gateway endpoints, interface endpoints, PrivateLink, and private DNS. Reach AWS services without traversing the internet.
- 4.2Implementing and Choosing Load Balancers
Distribute traffic—understand ALB (L7), NLB (L4), GWLB, target groups/health checks, and cross-zone load balancing. Choose by layer and requirements.
- 4.3Automating Networks with IaC
Make networks reproducible in code—understand CloudFormation, CDK, Terraform, change sets/drift detection, and repeatable deployments. Eliminate manual click-ops drift.
5Network Management and Operation
- 5.1Visibility with VPC Flow Logs
See your traffic—understand VPC Flow Logs, capture scope (VPC/subnet/ENI), ACCEPT/REJECT, destinations (CloudWatch/S3), and how they differ from Traffic Mirroring.
- 5.2Monitoring Tools and Reachability
Measure state—understand CloudWatch metrics/alarms, Reachability Analyzer, Network Access Analyzer, and Traffic Mirroring. Choose the tool that matches your question.
- 5.3Troubleshooting and Optimizing Connectivity
Isolate and fix—understand route tables, security groups (stateful), NACLs (stateless), MTU/jumbo frames, and asymmetric routing. Systematically find the cause.
6Network Security, Compliance, and Governance
- 6.1Defense in Depth and Traffic Control
Defend in layers—understand security groups (stateful), NACLs (stateless), defense in depth, and least-privilege networking. Protect at every layer.
- 6.2Centralized Inspection and Firewalls
Inspect at one point—understand AWS Network Firewall, an inspection VPC, routing via Transit Gateway, appliance insertion with GWLB, and the Route 53 Resolver DNS Firewall.
- 6.3DDoS Protection and Governance
Attacks and governance—understand Shield Standard/Advanced, WAF, Firewall Manager, certificate management (ACM), and org-wide policy. Apply protection and control across the board.