AWS Certified Advanced Networking – Specialty Cheat Sheet (ANS-C01)
Every in-scope networking service, hybrid connectivity pattern, and routing decision the ANS-C01 exam actually tests — organised by the four exam domains with reference architectures and troubleshooting playbooks
About This Cheat Sheet
A 15-page specialty-tier reference covering every in-scope service from the official ANS-C01 exam guide, organised around the four exam domains: Network Design (30%), Network Implementation (26%), Network Management & Operation (20%), Network Security, Compliance & Governance (24%). Structured for candidates with 5+ years of networking and 2+ years of AWS architecture — sections move from VPC fundamentals (CIDR planning with IPAM, subnets, route tables, IGW / egress-only IGW / NAT Gateway, Security Groups vs NACLs, ENI / ENA / EFA, VPC endpoints — Gateway, Interface/PrivateLink, GWLBe) through Transit Gateway patterns (attachments, route tables, ECMP, inter-Region peering, multicast, appliance mode), AWS Direct Connect (dedicated vs hosted, VIFs, DX Gateway, LAG, SiteLink, MACsec, resilience patterns, BGP + BFD), Site-to-Site VPN and Client VPN (accelerated VPN, CloudHub, TGW + ECMP aggregation), Route 53 (all routing policies including IP-based CIDR collections, Resolver inbound/outbound endpoints, Resolver DNS Firewall, DNSSEC, query logging), Load Balancing (ALB / NLB / GWLB / CLB deprecation, sticky sessions, target group types, TLS termination, mTLS), CloudFront & Global Accelerator (OAC, Lambda@Edge, CloudFront Functions, signed URLs, field-level encryption, real-time logs, continuous deployment), PrivateLink + VPC Lattice + AWS Cloud Map + App Mesh EOL migration, IPAM + Network Access Analyzer + Reachability Analyzer + Traffic Mirroring + VPC Flow Logs, edge security (WAF, Shield Standard/Advanced, Network Firewall, Firewall Manager) with centralised inspection architectures, IAM + Organizations + Control Tower + RAM for multi-account networking, monitoring (CloudWatch Network Monitor, Trusted Advisor, CloudTrail, Config), application-level services (API Gateway, EventBridge, SNS/SQS, Lambda, ECS/EKS/Fargate/ECR, S3), cost management focused on data-transfer optimization, five reference architectures (hub-and-spoke with centralised egress and inspection, hybrid DNS, multi-Region active/active, large-scale hybrid with multiple Regions, zero-trust with AWS Verified Access), a 20-scenario Answer Patterns table, 10 common gotchas, a BGP/routing/IPv6/multicast protocol reference, four service deep-dives (ELB, Route 53 Resolver, PrivateLink, CloudFront), a troubleshooting playbook (EC2 internet, hybrid DNS, TGW routing, DX failover, cross-AZ cost), advanced design patterns, operations & automation including AWS FIS network experiments, and recent/beta topics (PrivateLink Cross-Region, Route 53 Profiles, Network Firewall TLS inspection, Cloud WAN). Every service on the ANS-C01 in-scope list is audited present.
What's Inside
Amazon VPC Fundamentals
CIDR planning with IPAM, subnets (AZ, reserved addresses), route tables (longest-prefix, propagated vs static), Internet Gateway, egress-only IGW, NAT Gateway (per-AZ, public + private), Security Groups (stateful, SG-to-SG), Network ACLs (stateless, numbered), ENI / ENA / EFA (up to 400 Gbps + SRD), DHCP option sets, VPC endpoints (Gateway free for S3 + DynamoDB, Interface PrivateLink, GWLB endpoints for appliance insertion) with endpoint policies.
Transit Gateway & Hybrid Backbone
TGW attachments (VPC, VPN, DX Gateway, TGW peering, Connect), multiple route tables for segmentation, blackhole routes, ECMP (up to 8 VPN tunnels for 50 Gbps aggregate), inter-Region peering over AWS backbone, TGW multicast domains (IGMPv2), appliance mode for symmetric flow through stateful appliances, Network Manager for unified topology visibility.
AWS Direct Connect
Dedicated vs Hosted connections, Private / Transit / Public VIFs, Direct Connect Gateway (up to 10 VGWs across Regions, or TGWs via Transit VIF — not transitive between VGWs), Link Aggregation Groups (up to 4 dedicated connections, LACP), SiteLink for office-to-office WAN across the AWS backbone, MACsec line-rate encryption on dedicated 10/100 Gbps ports, resilience patterns (high = 2 locations, max = 4 connections across 2 locations), BGP with BFD for sub-second failover, Site-to-Site VPN backup with BGP weighting.
VPN (Site-to-Site & Client)
Site-to-Site VPN with two IPsec tunnels per connection (different AZ-redundant AWS endpoints), static vs BGP routing, Accelerated VPN via Global Accelerator edges, VPN CloudHub for branch-to-branch, IKEv1/v2 with AES-256 + SHA-2 + DH 14/24 + optional NAT-T, TGW + ECMP aggregation beyond 1.25 Gbps per tunnel. AWS Client VPN with mutual-cert / AD / SAML / MFA authentication, authorization rules per user group, full vs split tunnel, self-service portal for client config.
Route 53 & DNS
Public + private hosted zones (including split-horizon), all eight routing policies (Simple, Weighted, Latency, Geolocation, Geoproximity with Traffic Flow bias, Failover, Multivalue, IP-based with CIDR collections), Route 53 Resolver (.2 VPC DNS, inbound + outbound endpoints, Resolver rules shared via RAM), Route 53 Resolver DNS Firewall with AWS-managed threat domain lists, DNSSEC with KMS-backed KSK, query logging to CloudWatch / S3 / Firehose.
Load Balancing (ALB / NLB / GWLB)
ALB (L7 HTTP/HTTPS/gRPC, host/path/header/query/cookie routing, weighted target groups for blue/green, Lambda targets, WebSocket, HTTP/2, OIDC auth, WAF, mTLS), NLB (L4 TCP/UDP/TLS, static IPs per AZ + EIP, millions of rps with sub-ms latency, PrivateLink service provider, source IP preservation), GWLB (L3 GENEVE tunnels for transparent security appliance insertion via GWLB endpoints), sticky sessions, target group types, TLS termination with ACM + SNI, cross-zone load balancing defaults (ALB on free, NLB off by default).
CloudFront & Global Accelerator
CloudFront with 450+ PoPs (price classes All/200/100), origin failover between primary/secondary on 4xx/5xx, cache / origin request / response headers policies, OAC replacing OAI (required for KMS-SSE + Lambda function URLs), Lambda@Edge (4 hooks, 5s viewer / 30s origin timeouts) vs CloudFront Functions (<1ms viewer-only JS), signed URLs/cookies, field-level encryption, Origin Shield, continuous deployment, real-time logs to Kinesis. AWS Global Accelerator with two static anycast IPs, TCP/UDP on any port, cross-Region weighted + health-check failover, client affinity, traffic dials — best for non-HTTP workloads or when static IPs are required.
PrivateLink, VPC Lattice & Service Discovery
PrivateLink producer (NLB or GWLB backed Endpoint Service, optional auto-accept, allowlist by account ARN, per-AZ scope) and consumer (interface endpoint ENI with SG per AZ, Private DNS toggle), cross-account and cross-Region support, 50-endpoint-per-VPC default quota. VPC Lattice for service-to-service networking above L4 (service network, auth policies, weighted routing, HTTP path rules). AWS Cloud Map for service registration + DNS / API discovery. AWS App Mesh EOL 2026-09-30 with migration guidance to VPC Lattice / Istio / Linkerd / Consul.
IPAM, Analyzers & Traffic Visibility
Amazon VPC IP Address Manager (IPAM) for org-wide IP planning with hierarchical pools preventing CIDR overlaps, Network Reachability Analyzer for path-level connectivity debugging between ENIs/IGWs/TGWs, Network Access Analyzer for org-wide policy checking (e.g., "no internet egress from DB subnets") via Network Access Scopes, Traffic Mirroring from ENI to monitoring target (NLB or ENI) for IDS/IPS + forensic packet capture, VPC Flow Logs at ENI/subnet/VPC level (ALL/ACCEPT/REJECT) with custom formats, Route 53 Resolver query logs.
Edge Security & Centralised Inspection
AWS WAF (ALB / CloudFront / API GW / AppSync / Cognito / App Runner / Verified Access) with managed rule groups, rate-based, geo-match, IP sets, regex, CAPTCHA / Challenge, Bot Control, Fraud Control / ATP / ACFP. AWS Shield Standard (free always-on L3/L4 DDoS) vs Advanced (DRT, cost protection, global threat dashboard). AWS Network Firewall (managed Suricata L3-L7 with TLS inspection, domain filtering). AWS Firewall Manager for org-wide policies (WAF, Shield Advanced, SG baselines, Network Firewall, Route 53 Resolver DNS Firewall, NACL). Centralised inspection VPC with GWLB + third-party appliances + TGW appliance mode for symmetric flows.
Reference Architectures
Five full walkthroughs: hub-and-spoke with centralised egress + inspection (networking account with TGW + inspection VPC + egress VPC + ingress VPC + DNS VPC), hybrid DNS across on-prem + AWS (inbound + outbound Resolver endpoints with shared resolver rules), multi-Region active/active (Route 53 latency + Global Accelerator + CloudFront origin failover + Application Recovery Controller), large-scale hybrid with multiple Regions (DX Gateway + Transit VIF + TGW inter-Region peering + SiteLink + IPSec-over-DX), and zero-trust with AWS Verified Access (IAM Identity Center + OIDC + device posture, no Client VPN).
Scenario → Answer Patterns
20 ANS-C01 scenarios mapped to the AWS default answer: thousands of VPCs + on-prem, sub-second DX failover, office-to-office WAN, predictable DDoS cost protection, private service exposure to partner, on-prem resolution of private zones, DNS exfiltration blocking, global non-HTTP acceleration, NAT egress cost reduction, overlapping CIDRs, static IP + TLS passthrough, unintended public egress detection, reachability debugging, forensic packet capture, DX line-rate encryption, zero-trust without VPN, cross-account resource sharing, multicast across VPCs, ISP-based routing, service mesh migration.
Why This Cheat Sheet Helps
ANS-C01 is the deepest networking exam AWS publishes. Questions reliably test the subtle differences: when does appliance mode matter, when does TGW lose to PrivateLink, why does your backup VPN not take over, what breaks when two spokes have overlapping CIDRs. This cheat sheet puts the decisions side by side with the exact AWS vocabulary examiners use, plus the protocol-level details (BGP preference rules, BFD timers, ECMP behaviour) that separate a pass from a fail.
It assumes you already know how packets move. Use it in the final weeks to map the exam's surface area, confirm your mental model of hybrid patterns matches AWS's prescribed architectures, and rehearse the troubleshooting playbooks for the most-tested scenarios.
How to Use It
Skim the whole sheet once to see how the four domains map to sections. Then hammer practice exams — for each wrong answer, find the relevant section and study the tables and decision trees. Pay extra attention to sections 3 (Transit Gateway), 4 (Direct Connect), 6 (Route 53), 11 (edge security with centralised inspection), 16 (Reference Architectures), 17 (Scenario → Answer Patterns), 18 (Gotchas), 19 (BGP + IPv6), and 21 (Troubleshooting Playbook).
In the final week, walk through the four domain weights against your confidence: Network Design (30%) → sections 1–10; Network Implementation (26%) → sections 3, 4, 5, 11, 16; Management & Operation (20%) → sections 10, 13, 24; Security, Compliance & Governance (24%) → sections 11, 12, 20, 23. Pair with CloudNinja's free ANS-C01 practice exam to surface gaps.
Frequently Asked Questions
Is this AWS Advanced Networking Specialty cheat sheet free?
Yes, completely free with no signup required. Download the PDF directly from CloudNinja and use it as a study reference for the ANS-C01 exam.
How much AWS experience do I need before ANS-C01?
AWS recommends five or more years of networking experience plus two or more years of AWS architecture. The exam is deeply protocol-aware — expect BGP preference rules, BFD timers, IPsec phase handshakes, TGW appliance mode, Route 53 Resolver endpoints, PrivateLink vs peering vs Transit Gateway decisions. If you do not already hold Solutions Architect Associate or have hands-on hybrid networking experience, build that foundation first.
How is ANS-C01 different from the Solutions Architect Professional?
SAP-C02 covers networking at an architectural level — you compare patterns. ANS-C01 goes protocol-deep: when BGP honours prefix vs AS-path vs MED, when TGW appliance mode matters, when Global Accelerator beats CloudFront, exactly which Load Balancer preserves source IP, whether Network Firewall or a GWLB-fronted appliance is the right answer. Expect longer scenarios with subtle wrong answers that are plausible but miss one networking detail.
Is this cheat sheet updated for the current ANS-C01 exam?
Yes, it is built directly from the current ANS-C01 exam guide (advanced-networking-specialty-01) and audited against the full in-scope services list. It also reflects recent updates — AWS App Mesh end-of-life (September 2026), PrivateLink Cross-Region, Route 53 Profiles, Network Firewall TLS inspection, IPv4 pricing change with IPAM, AWS Cloud WAN as a TGW successor pattern, and Amazon Application Recovery Controller for deterministic Region failover.