AWS Certified Advanced Networking – Specialty Cheat Sheet (ANS-C01)
Every in-scope networking service, hybrid connectivity pattern, and routing decision the ANS-C01 exam actually tests — organised by the four exam domains with reference architectures and troubleshooting playbooks
AWS is retiring ANS-C01. December 31, 2026 is the last day to sit it, and no replacement exam has been announced. Certifications earned before then stay valid for the usual three years.
See the full timelineAbout This Cheat Sheet
- 15 pages
- Every in-scope ANS-C01 service
- For 5+ years of networking, 2+ of them in cloud and hybrid
- 5 reference architectures
- 20 answer-pattern scenarios
- Updated April 2026
Exam domains
Share of the scored ANS-C01 content
- Network Design30%
- Network Implementation26%
- Network Management and Operation20%
- Network Security, Compliance, and Governance24%
Services covered
VPC & addressing
- VPC
- IPAM
- NAT Gateway
- VPC endpoints
Hybrid connectivity
- Transit Gateway
- Direct Connect
- Site-to-Site VPN
- Client VPN
- Cloud WAN
DNS
- Route 53
- Route 53 Resolver
- Route 53 Resolver DNS Firewall
- Route 53 Profiles
Load balancing & edge
- ALB
- NLB
- GWLB
- CLB
- CloudFront
- Global Accelerator
Edge & network security
- WAF
- Shield
- Network Firewall
- Firewall Manager
- Verified Access
Show 27 more servicesShow fewer
Service networking
- PrivateLink
- VPC Lattice
- Cloud Map
- App Mesh
Visibility & troubleshooting
- Network Access Analyzer
- Reachability Analyzer
- Traffic Mirroring
- VPC Flow Logs
- CloudWatch Network Monitor
Multi-account networking
- IAM
- Organizations
- Control Tower
- RAM
Monitoring & audit
- Trusted Advisor
- CloudTrail
- Config
Application-level services
- API Gateway
- EventBridge
- SNS
- SQS
- Lambda
- ECS
- EKS
- Fargate
- ECR
- S3
Operations & automation
- FIS
Feature details
- VPC
- CIDR planning with IPAM · Subnets and route tables · IGW / egress-only IGW / NAT Gateway · Security Groups vs NACLs · ENI / ENA / EFA · Endpoints: Gateway, Interface/PrivateLink, GWLBe
- Transit Gateway
- Attachments · Route tables · ECMP · Inter-Region peering · Multicast · Appliance mode
- Direct Connect
- Dedicated vs hosted · VIFs · DX Gateway · LAG · SiteLink · MACsec · Resilience patterns · BGP + BFD
- Site-to-Site VPN
- Accelerated VPN · CloudHub · TGW + ECMP aggregation
- Route 53
- All routing policies incl. IP-based CIDR collections · Resolver inbound/outbound endpoints · DNSSEC · Query logging
- Load balancing
- CLB deprecation · Sticky sessions · Target group types · TLS termination · mTLS
- CloudFront
- OAC · Lambda@Edge · CloudFront Functions · Signed URLs · Field-level encryption · Real-time logs · Continuous deployment
- Shield
- Shield Standard/Advanced
- App Mesh
- App Mesh EOL migration
- FIS
- AWS FIS network experiments
Concepts covered
- Reference architectures
- Hub-and-spoke with centralised egress and inspection · Hybrid DNS · Multi-Region active/active · Large-scale hybrid with multiple Regions · Zero-trust with AWS Verified Access
- Design & cost
- Centralised inspection architectures · Advanced design patterns · Data-transfer optimization
- Protocols
- BGP/routing/IPv6/multicast protocol reference
- Deep dives
- ELB · Route 53 Resolver · PrivateLink · CloudFront
- Troubleshooting playbook
- EC2 internet · Hybrid DNS · TGW routing · DX failover · Cross-AZ cost
- Recent / beta topics
- PrivateLink Cross-Region · Route 53 Profiles · Network Firewall TLS inspection · Cloud WAN
- Exam practice
- 20-scenario Answer Patterns table · 10 common gotchas
Built from the official ANS-C01 exam guide; every service on its in-scope list is audited present.
What's Inside
Amazon VPC Fundamentals
The VPC building blocks every other networking topic depends on, with the limits and defaults exam questions turn on.
- CIDR planning with IPAM; subnets (AZ, reserved addresses)
- Route tables: longest-prefix, propagated vs static
- Internet Gateway, egress-only IGW, NAT Gateway (per-AZ, public + private)
- Security Groups (stateful, SG-to-SG) vs Network ACLs (stateless, numbered)
- ENI / ENA / EFA (up to 400 Gbps + SRD); DHCP option sets
- VPC endpoints with endpoint policies: Gateway, free for S3 + DynamoDB
- Interface PrivateLink endpoints; GWLB endpoints for appliance insertion
Transit Gateway & Hybrid Backbone
Transit Gateway as the hub of a large network: attachments, segmentation, scaling and visibility.
- TGW attachments: VPC, VPN, DX Gateway, TGW peering, Connect
- Multiple route tables for segmentation; blackhole routes
- ECMP: up to 8 VPN tunnels for 50 Gbps aggregate
- Inter-Region peering over AWS backbone
- TGW multicast domains (IGMPv2)
- Appliance mode for symmetric flow through stateful appliances
- Network Manager for unified topology visibility
AWS Direct Connect
Direct Connect connection types, gateways and resilience models, with the limits that decide hybrid designs.
- Dedicated vs Hosted connections; Private / Transit / Public VIFs
- Direct Connect Gateway: up to 10 VGWs across Regions
- Or TGWs via Transit VIF; not transitive between VGWs
- Link Aggregation Groups: up to 4 dedicated connections, LACP
- SiteLink for office-to-office WAN across the AWS backbone
- MACsec line-rate encryption on dedicated 10/100 Gbps ports
- Resilience patterns: high = 2 locations, max = 4 connections across 2 locations
- BGP with BFD for sub-second failover
- Site-to-Site VPN backup with BGP weighting
VPN (Site-to-Site & Client)
Site-to-Site and Client VPN: redundancy, routing, crypto settings and how to scale throughput.
- Site-to-Site VPN: two IPsec tunnels per connection, AZ-redundant AWS endpoints
- Static vs BGP routing
- Accelerated VPN via Global Accelerator edges
- VPN CloudHub for branch-to-branch
- IKEv1/v2 with AES-256 + SHA-2 + DH 14/24 + optional NAT-T
- TGW + ECMP aggregation beyond 1.25 Gbps per tunnel
- Client VPN: mutual-cert / AD / SAML / MFA authentication
- Authorization rules per user group; full vs split tunnel
- Self-service portal for client config
Route 53 & DNS
Hosted zones, routing policies and hybrid DNS with Route 53 Resolver, plus DNS security and logging.
- Public + private hosted zones, including split-horizon
- All eight routing policies: Simple, Weighted, Latency, Geolocation, Failover, Multivalue
- Geoproximity with Traffic Flow bias; IP-based with CIDR collections
- Route 53 Resolver: .2 VPC DNS, inbound + outbound endpoints
- Resolver rules shared via RAM
- Route 53 Resolver DNS Firewall with AWS-managed threat domain lists
- DNSSEC with KMS-backed KSK
- Query logging to CloudWatch / S3 / Firehose
Load Balancing (ALB / NLB / GWLB)
What each load balancer type does, and the features that decide which one an answer needs.
- ALB: L7 HTTP/HTTPS/gRPC, host/path/header/query/cookie routing, OIDC auth, WAF, mTLS
- ALB: weighted target groups for blue/green, Lambda targets, WebSocket, HTTP/2
- NLB: L4 TCP/UDP/TLS, static IPs per AZ + EIP, source IP preservation
- NLB: millions of rps with sub-ms latency; PrivateLink service provider
- GWLB: L3 GENEVE tunnels for transparent security appliance insertion via GWLB endpoints
- Sticky sessions, target group types, TLS termination with ACM + SNI
- Cross-zone load balancing defaults: ALB on free, NLB off by default
CloudFront & Global Accelerator
CloudFront caching, security and edge compute, and Global Accelerator for non-HTTP workloads or when static IPs are required.
- CloudFront: 450+ PoPs, price classes All/200/100, primary/secondary origin failover on 4xx/5xx
- Cache / origin request / response headers policies; real-time logs to Kinesis
- OAC replacing OAI, required for KMS-SSE + Lambda function URLs
- Lambda@Edge: 4 hooks, 5s viewer / 30s origin timeouts
- CloudFront Functions: <1ms viewer-only JS
- Signed URLs/cookies, field-level encryption, Origin Shield, continuous deployment
- Global Accelerator: two static anycast IPs, TCP/UDP on any port
- Cross-Region weighted + health-check failover, client affinity, traffic dials
PrivateLink, VPC Lattice & Service Discovery
Private service exposure across VPCs and accounts, service-to-service networking, service discovery and the App Mesh exit.
- PrivateLink producer: NLB or GWLB backed Endpoint Service
- Producer options: optional auto-accept, allowlist by account ARN, per-AZ scope
- PrivateLink consumer: interface endpoint ENI with SG per AZ, Private DNS toggle
- Cross-account and cross-Region support; 50-endpoint-per-VPC default quota
- VPC Lattice: service-to-service networking above L4
- Lattice service network, auth policies, weighted routing, HTTP path rules
- Cloud Map for service registration + DNS / API discovery
- App Mesh support ended 2026-09-30: migrate to VPC Lattice / Istio / Linkerd / Consul
IPAM, Analyzers & Traffic Visibility
The tools for planning IP space, proving connectivity, checking network policy and capturing traffic.
- VPC IP Address Manager (IPAM) for org-wide IP planning
- IPAM hierarchical pools preventing CIDR overlaps
- Network Reachability Analyzer: path-level connectivity debugging between ENIs/IGWs/TGWs
- Network Access Analyzer: org-wide policy checking via Network Access Scopes
- Example scope: "no internet egress from DB subnets"
- Traffic Mirroring from ENI to monitoring target (NLB or ENI)
- Mirroring for IDS/IPS + forensic packet capture
- VPC Flow Logs at ENI/subnet/VPC level (ALL/ACCEPT/REJECT), custom formats
- Route 53 Resolver query logs
Edge Security & Centralised Inspection
The edge and network security services, the layer each protects, and the centralised inspection VPC design.
- WAF on ALB / CloudFront / API GW / AppSync / Cognito / App Runner / Verified Access
- WAF rules: managed rule groups, rate-based, geo-match, IP sets, regex
- WAF: CAPTCHA / Challenge, Bot Control, Fraud Control / ATP / ACFP
- Shield Standard: free always-on L3/L4 DDoS
- vs Advanced: DRT, cost protection, global threat dashboard
- Network Firewall: managed Suricata L3-L7 with TLS inspection, domain filtering
- Firewall Manager for org-wide policies: WAF, Shield Advanced, SG baselines, NACL
- Firewall Manager also covers Network Firewall, Route 53 Resolver DNS Firewall
- Centralised inspection VPC: GWLB + third-party appliances + TGW appliance mode for symmetric flows
Reference Architectures
Five full walkthroughs of the network designs that the longest exam scenarios are built around.
- Hub-and-spoke with centralised egress + inspection
- Networking account with TGW + inspection VPC + egress VPC + ingress VPC + DNS VPC
- Hybrid DNS across on-prem + AWS: inbound + outbound Resolver endpoints, shared resolver rules
- Multi-Region active/active: Route 53 latency + Global Accelerator + CloudFront origin failover
- Active/active failover control with Application Recovery Controller
- Large-scale hybrid with multiple Regions: DX Gateway + Transit VIF
- Hybrid backbone: TGW inter-Region peering + SiteLink + IPSec-over-DX
- Zero-trust with Verified Access: IAM Identity Center + OIDC + device posture
- The zero-trust design uses no Client VPN
Scenario → Answer Patterns
20 ANS-C01 scenarios, each mapped to the AWS default answer.
- Hybrid: thousands of VPCs + on-prem, sub-second DX failover, office-to-office WAN
- DNS: on-prem resolution of private zones, DNS exfiltration blocking, ISP-based routing
- Security: predictable DDoS cost protection, DX line-rate encryption, zero-trust without VPN
- Visibility: unintended public egress detection, reachability debugging, forensic packet capture
- Services: private service exposure to partner, cross-account resource sharing, service mesh migration
- Addressing: overlapping CIDRs, multicast across VPCs, NAT egress cost reduction
- Edge: global non-HTTP acceleration, static IP + TLS passthrough
Why This Cheat Sheet Helps
ANS-C01 is the deepest networking exam AWS publishes. Questions reliably test the subtle differences: when does appliance mode matter, when does TGW lose to PrivateLink, why does your backup VPN not take over, what breaks when two spokes have overlapping CIDRs. This cheat sheet puts the decisions side by side with the exact AWS vocabulary examiners use, plus the protocol-level details (BGP preference rules, BFD timers, ECMP behaviour) that separate a pass from a fail.
It assumes you already know how packets move. Use it in the final weeks to map the exam's surface area, confirm your mental model of hybrid patterns matches AWS's prescribed architectures, and rehearse the troubleshooting playbooks for the most-tested scenarios.
How to Use It
Skim the whole sheet once to see how the four domains map to sections. Then hammer practice exams — for each wrong answer, find the relevant section and study the tables and decision trees. Pay extra attention to sections 3 (Transit Gateway), 4 (Direct Connect), 6 (Route 53), 11 (edge security with centralised inspection), 16 (Reference Architectures), 17 (Scenario → Answer Patterns), 18 (Gotchas), 19 (BGP + IPv6), and 21 (Troubleshooting Playbook).
In the final week, walk through the four domain weights against your confidence: Network Design (30%) → sections 1–10; Network Implementation (26%) → sections 3, 4, 5, 11, 16; Management & Operation (20%) → sections 10, 13, 24; Security, Compliance & Governance (24%) → sections 11, 12, 20, 23. Pair with CloudNinja's free ANS-C01 practice exam to surface gaps.
Frequently Asked Questions
Is this AWS Advanced Networking Specialty cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the ANS-C01 exam.
How much AWS experience do I need before ANS-C01?
AWS recommends five or more years of networking experience, including two or more years of cloud and hybrid networking experience. The exam is deeply protocol-aware — expect BGP preference rules, BFD timers, IPsec phase handshakes, TGW appliance mode, Route 53 Resolver endpoints, PrivateLink vs peering vs Transit Gateway decisions. If you do not already hold Solutions Architect Associate or have hands-on hybrid networking experience, build that foundation first.
How is ANS-C01 different from the Solutions Architect Professional?
SAP-C02 covers networking at an architectural level — you compare patterns. ANS-C01 goes protocol-deep: when BGP honours prefix vs AS-path vs MED, when TGW appliance mode matters, when Global Accelerator beats CloudFront, exactly which Load Balancer preserves source IP, whether Network Firewall or a GWLB-fronted appliance is the right answer. Expect longer scenarios with subtle wrong answers that are plausible but miss one networking detail.
Is this cheat sheet updated for the current ANS-C01 exam?
Yes, it is built directly from the current ANS-C01 exam guide (advanced-networking-specialty-01) and audited against the full in-scope services list. It also reflects recent updates — AWS App Mesh end of support (September 30, 2026), PrivateLink Cross-Region, Route 53 Profiles, Network Firewall TLS inspection, IPv4 pricing change with IPAM, AWS Cloud WAN as a TGW successor pattern, and Amazon Application Recovery Controller for deterministic Region failover.