Amazon Web Services · ANS-C01

ANS-C01 Exam: Complete AWS Advanced Networking Guide

Current ANS-C01 exam guide covering the $300 USD fee, 170-minute format, four domains, 700 passing score, hybrid networking, security, and prep.

Last verified September 6, 2026

ANS-C01 exam at a glance

Facts last verified September 6, 2026

Domain breakdown

Who should take the ANS-C01 exam?

ANS-C01 is for network engineers, cloud network architects, and senior infrastructure or security engineers who design and operate AWS and hybrid networks at scale. AWS recommends five or more years of networking experience, including at least two years of cloud and hybrid networking.

Candidates should be comfortable with routing protocols, IP addressing, DNS, load balancing, encryption, network security, automation, observability, and the networking behavior of AWS compute and storage services. This is not an introduction to VPCs.

There is no prerequisite certification. An AWS Associate or Professional credential can provide useful platform context, but it does not replace packet-level reasoning, route analysis, hybrid connectivity work, and troubleshooting practice.

Plan to verify current quotas and service behavior throughout preparation.

Skills measured on ANS-C01

The official ANS-C01 exam guide defines four domains. Design and implementation form 56% of scored content, while operations and security test whether the network remains observable, governable, and safe.

Network Design (30%)

Design edge architectures using Route 53, CloudFront, Global Accelerator, load balancers, and appropriate routing policies. Understand DNS delegation, public and private hosted zones, Resolver endpoints and rules, health checks, split-horizon designs, TTL behavior, and hybrid name resolution.

Choose load balancers by protocol, target type, client-IP requirements, TLS behavior, scale, and application features. Distinguish global traffic steering from regional load distribution. Build high availability across Availability Zones and regions without creating asymmetric or stateful failure paths.

Hybrid and multi-account design includes Site-to-Site VPN, Client VPN, Direct Connect, transit gateways, Cloud WAN, VPC peering, PrivateLink, shared VPC patterns, and network accounts. Evaluate bandwidth, latency, encryption, route scale, transitivity, overlapping addresses, isolation, and operational ownership.

Define observability before deployment. Identify required flow, DNS, load balancer, firewall, VPN, Direct Connect, and application telemetry, where it will be centralized, and how long it must be retained.

Network Implementation (26%)

Implement VPCs, IPv4 and IPv6 subnets, route tables, internet and egress paths, NAT, gateways, endpoints, security controls, and connectivity between environments. Know route selection and propagation behavior well enough to predict the path from source to destination.

Hybrid implementation covers virtual private gateways, transit gateway attachments, BGP, customer gateways, Direct Connect virtual interfaces, gateways, link aggregation, VPN redundancy, and encryption. Practice route advertisement and failover rather than memorizing diagrams.

Automate with CloudFormation, APIs, CLI, tagging, IP Address Manager, Systems Manager, EventBridge, and Lambda where appropriate. Guard against partial deployment, duplicate changes, unsafe route updates, and configuration drift.

Application networking may include service discovery, Route 53, load balancers, API Gateway, PrivateLink, VPC Lattice, service meshes, Kubernetes networking, and container task networking. Understand how identities, addresses, ports, health, and policies interact.

Network Management and Operation (20%)

Maintain routing and connectivity as environments change. Monitor BGP sessions, VPN tunnels, Direct Connect links, transit routes, DNS resolution, NAT capacity, load-balancer targets, and service quotas. Plan maintenance and failover so the backup path is proven before the primary fails.

Troubleshoot systematically. Confirm name resolution, source and destination addresses, routes, stateful security groups, stateless network ACLs, firewall policy, return paths, MTU, fragmentation, port availability, and application health. VPC Flow Logs and CloudWatch Logs show evidence, but their absence or fields must be interpreted correctly.

Use Reachability Analyzer, Network Access Analyzer, Traffic Mirroring, CloudWatch, CloudTrail, Resolver query logs, Transit Gateway Network Manager, and service metrics according to the issue. Optimize architecture for throughput, latency, availability, data-transfer cost, and operational simplicity rather than one metric alone.

Network Security, Compliance, and Governance (24%)

Segment networks by trust, application, environment, account, and regulatory boundary. Combine security groups, network ACLs, AWS Network Firewall, Gateway Load Balancer appliances, WAF, Shield, Route 53 Resolver DNS Firewall, and centralized inspection patterns based on traffic and threat.

Secure hybrid connectivity with IPsec, MACsec where supported, TLS, certificate management, and appropriate key controls. Understand where traffic is encrypted, decrypted, inspected, logged, and forwarded. A design cannot claim end-to-end encryption if an inspection point terminates it.

Use Organizations, Control Tower, Firewall Manager, resource policies, RAM, Config, CloudTrail, Security Hub, and delegated administration for multi-account governance. Prevent unauthorized network creation or sharing while preserving controlled self-service for workload teams.

Design logging and evidence for compliance. Central accounts and immutable storage can reduce tampering risk. Apply least privilege to network automation and keep emergency access narrow, monitored, and tested.

How to prepare for ANS-C01

Build a multi-account lab with a central transit design, two workload VPCs, public and private DNS, endpoints, NAT, and a simulated hybrid connection. Trace routes in both directions and document which table, policy, and stateful component affects each hop.

Create failure drills: withdraw a BGP route, break return routing, exhaust a NAT path, misconfigure a Resolver rule, fail a health check, block traffic with an ACL, and exceed MTU. Diagnose using logs and analysis tools before looking at configuration randomly.

Study service quotas, pricing dimensions, and feature constraints from current AWS documentation. Use the official practice set for timing, then explain every answer in terms of control plane, data plane, failure behavior, and security boundary.

ANS-C01 practice questions

High-quality scenarios specify CIDRs, protocols, routing, accounts, regions, availability goals, and traffic direction. Draw the topology and eliminate answers that violate transitivity, return- path, encryption, scale, or ownership requirements.

Avoid exam dumps. AWS prohibits unauthorized material, and memorized choices cannot substitute for reasoning through a changed network topology.

ANS-C01 compared with Solutions Architect exams

Solutions Architect exams cover networking as part of a full workload. ANS-C01 goes deeper into BGP, Direct Connect, DNS, traffic engineering, multi-account connectivity, inspection, observability, and packet-path troubleshooting. It is appropriate when networking is a primary responsibility.

Career value of Advanced Networking Specialty

The certification aligns with cloud network engineer, network architect, hybrid connectivity engineer, and senior infrastructure roles. Its strongest signal comes with real designs and incident examples: route scale, failure testing, centralized inspection, DNS migration, or measurable latency and cost improvements.

AWS networking changes over time, so retain the engineering method behind the badge. Verify current service constraints, draw paths, test failure, and use telemetry to prove behavior.

Exam-day notes

• You have 170 minutes for 65 questions.
• Fifty questions are scored and 15 are unidentified unscored items.
• The US fee is $300 before tax or regional adjustments.
• The current official guide lists a minimum scaled score of 700.
• Use the on-screen help for listed service-name references when available.

Prep resources

← More Amazon Web Services exams