Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Amazon
Exam Format
Registration
Validity
Skills this practice test covers
- Design redundant hybrid links with Direct Connect, VPN and BGP attributes that steer traffic.
- Connect many VPCs and accounts with Transit Gateway, PrivateLink and VPC sharing.
- Set up hybrid DNS with Route 53 Resolver endpoints, forwarding rules and private hosted zones.
- Choose CloudFront, Global Accelerator or a load balancer type for a global workload.
- Filter traffic with AWS Network Firewall, security groups and network ACLs, and audit it with flow logs.
- Troubleshoot reachability, MTU and routing faults with VPC flow logs and Reachability Analyzer.
Explore related topics
ANS-C01 exam content
4 domains · 16 topics · 229 of 587 questions are written for ANS-C01
Network Design30%76 questions
The largest domain covers design choices. Candidates design edge services, DNS, load balancing and monitoring requirements, and plan routing for hybrid links and for many accounts, Regions and VPCs.
Skills tested
- Choose CloudFront, Global Accelerator or Route 53 routing for global traffic.
- Design public and private hosted zones and Resolver endpoints for hybrid DNS.
- Select an Application, Network or Gateway Load Balancer for a use case.
- Design redundant hybrid connectivity, and use BGP attributes to prefer one path.
- Plan connectivity around overlapping IP ranges with the right AWS service.
Official topics
- Design edge network services for global architectures
- Design DNS solutions for public, private, and hybrid requirements
- Design load balancing solutions
- Define logging and monitoring requirements
- Design routing strategy for hybrid connectivity
- Design multi-account and multi-VPC connectivity
Network Implementation26%61 questions
This domain turns designs into working networks. Candidates configure hybrid routing over Direct Connect and VPN, hub-and-spoke VPC connectivity, DNS forwarding and DNSSEC, and they automate network builds with infrastructure as code.
Skills tested
- Configure Direct Connect virtual interfaces and their BGP sessions.
- Build a hub-and-spoke network with Transit Gateway route tables.
- Set up conditional forwarding between on-premises DNS servers and Route 53 Resolver.
- Sign a Route 53 hosted zone with DNSSEC.
- Deploy repeatable network configurations with CloudFormation or the AWS Cloud Development Kit (CDK).
Official topics
- Implement routing and connectivity for hybrid networks
- Implement multi-account and multi-VPC connectivity
- Implement complex DNS architectures
- Automate network infrastructure
Network Management and Operation20%48 questions
This domain keeps a network healthy after launch. Candidates maintain routing over static and dynamic protocols, analyze tool output to troubleshoot connectivity, and tune the network for throughput and cost.
Skills tested
- Maintain routes and private access to services across AWS and hybrid networks.
- Troubleshoot connectivity with VPC flow logs, Reachability Analyzer and route tables.
- Find maximum transmission unit (MTU) problems, such as jumbo frames sent over a path that cannot carry them.
- Lower data transfer and NAT gateway costs, for example with VPC endpoints.
Official topics
- Maintain routing and connectivity
- Monitor and analyze network traffic
- Optimize network performance and cost
Network Security, Compliance, and Governance24%44 questions
This domain protects traffic and proves that the controls work. Candidates secure inbound, outbound and inter-VPC flows, audit them with flow logs and automated alarms, and encrypt data in transit, including DNS traffic.
Skills tested
- Protect inbound traffic with AWS WAF, AWS Shield and AWS Network Firewall.
- Filter outbound traffic, and control endpoint access with VPC endpoint policies.
- Audit network rules across accounts with Firewall Manager and AWS Config.
- Encrypt traffic in transit with IPsec and certificates from AWS Certificate Manager (ACM).
Official topics
- Implement network security features
- Validate and audit security
- Implement data confidentiality
Requirements
- No formal prerequisites.
- Recommended: five or more years of hands-on experience designing and implementing network solutions.
- Recommended: two or more years with AWS networking services, and advanced knowledge of their architecture and best practices.
- Recommended: AWS Certified Solutions Architect - Associate or equal AWS knowledge first.
About the ANS-C01 exam
The ANS-C01 exam tests whether a network engineer can design, build, run and secure AWS networks that span many VPCs, accounts and Regions and reach on-premises sites. Its four domains follow that order, from design and implementation to management and operation, and finally security, compliance and governance. AWS recommends five or more years of hands-on network design and implementation work, with two or more of those years on AWS networking services. Passing earns the AWS Certified Advanced Networking - Specialty certification, which is valid for three years.
Network Design takes the largest share of the PlanetCert practice test, with many questions on global traffic management, multi-account routing and load balancing. The explanations help most where two designs both work, such as a VPN backup for a Direct Connect link against a second Direct Connect link. Study Mode suits the BGP and DNS questions, where one attribute or one forwarding rule changes the answer. Brainy AI Assistant can trace a packet through Transit Gateway route tables or explain why jumbo frames fail across a VPN.
How to earn the certification
- Earns
- AWS Certified Advanced Networking - SpecialtySpecialty
The certification is valid for three years.
- Before
- SAA-C03 AWS Certified Solutions Architect - Associate
Optional groundwork on VPCs, subnets and core AWS services.
- SOA-C03 AWS Certified CloudOps Engineer - Associate
Optional groundwork on running, monitoring and troubleshooting AWS workloads.
- SAA-C03 AWS Certified Solutions Architect - Associate
- After
- SAP-C02 AWS Certified Solutions Architect - Professional
A professional-level step that applies network design to whole organizations.
- DOP-C02 AWS Certified DevOps Engineer - Professional
The professional exam on automating delivery and operations on AWS.
- SAP-C02 AWS Certified Solutions Architect - Professional
How to prepare for ANS-C01
- 1
Build a two-VPC lab with a VPN
Create two VPCs, join them through a Transit Gateway, and add a Site-to-Site VPN to a software router that stands in for an on-premises site. Watch which routes BGP learns on each side.
- 2
Remove one DNS piece at a time
Set up a private hosted zone, Resolver inbound and outbound endpoints and a forwarding rule. Then remove one piece at a time and note which lookups fail.
- 3
Spend longest on design scenarios
Network Design is the largest domain. Compare global traffic options, such as CloudFront and Global Accelerator, and redundant hybrid models until the deciding requirement is clear in each case.
- 4
Trace a blocked path end to end
Block a path in the lab, then find it with VPC flow logs and Reachability Analyzer. Check route tables, security groups and network ACLs in turn.
- 5
Sit timed runs, then review designs
Take the ANS-C01 practice test in Timed Mode. Review the explanation for each missed design question, and ask Brainy AI Assistant to compare the two closest options.
Start a timed ANS-C01run
Who ANS-C01 is for
- Network engineers who extend data center networks into AWS.
- Solutions architects and cloud architects who own the network side of AWS designs.
- Operations staff who keep hybrid and multi-account AWS networks running.
Typical job titles: Network engineer · Cloud network engineer · Network architect · Solutions architect · Cloud architect
ANS-C01 glossary
18 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Alias records
- Route 53 records that point a name at an AWS resource, such as a load balancer, even at the zone apex.
- AWS Global Accelerator
- A service that gives an application static anycast IP addresses and carries its traffic over the AWS global network.
- AWS Network Firewall
- A managed stateful firewall service that filters traffic entering, leaving and moving between VPCs.
- AWS PrivateLink
- A service that exposes an application or AWS service to other VPCs through private endpoints, without crossing the internet.
- AWS Transit Gateway
- A regional hub that connects many VPCs and on-premises networks through one gateway with its own route tables.
- BGP
- Border Gateway Protocol: the routing protocol that exchanges routes over Direct Connect and dynamic VPN connections.
- Conditional forwarding
- Sending DNS queries for a chosen domain to a specific DNS server, such as an on-premises resolver.
- Direct Connect
- A dedicated private network link from an on-premises site or colocation facility to AWS.
- Direct Connect Gateway
- A global resource that lets Direct Connect virtual interfaces reach VPCs in many Regions and accounts.
- DNSSEC
- DNS Security Extensions: digital signatures that let resolvers check that DNS answers were not changed.
- Firewall Manager
- A service that applies firewall rules and security policies across many accounts from one place.
- Gateway Load Balancer
- A load balancer that passes traffic through a fleet of virtual appliances, such as third-party firewalls.
- Jumbo frames
- Ethernet frames larger than the usual size; they raise throughput but are dropped or split where a path's MTU is smaller.
- LAG
- A link aggregation group: several Direct Connect connections bundled so that they act as one.
- LOA process
- Getting the Letter of Authorization that allows a colocation provider to run the cross-connect for a Direct Connect link.
- Network ACLs
- Stateless allow and deny rules applied at a subnet boundary in a VPC.
- Route 53 Resolver
- The DNS resolver in every VPC; its inbound and outbound endpoints pass DNS queries between AWS and on-premises networks.
- VPC flow logs
- Records of the IP traffic to and from network interfaces in a VPC, used to troubleshoot and audit.