AWS ANS-C01 Cheat Sheet: Hybrid Networking, DNS, and Routing

Use this AWS Certified Advanced Networking - Specialty (ANS-C01) Cheat Sheet after you have studied the domains and before timed practice. The goal is not to memorize every service name. The goal is to classify the stem, find the failing network layer, and reject attractive answers that solve the wrong problem.

Quick facts

I verified these current AWS exam facts on May 24, 2026.

With 65 questions in 170 minutes, the average budget is about 2.6 minutes per question. Long BGP, DNS, and multi-account routing stems can consume more than that, so mark the slow ones and return.

Domain weights

ANS-C01 is a path-reasoning exam. If two answers are technically valid, the better answer usually preserves segmentation, scales across accounts, proves the path, and gives operations evidence.

Network path proof stack

ANS-C01 questions usually ask whether a path works, scales, fails over, and leaves enough evidence for operations. Keep this stack in mind before choosing a service:

1. Source and destination: identify account, VPC, subnet, Region, on-premises network, endpoint, protocol, and port.
2. Route domain: check VPC route tables, Transit Gateway association and propagation, Cloud WAN segment, peering route, Direct Connect/VPN route, or PrivateLink endpoint path.
3. Return path: prove that response traffic can come back through a compatible route and does not break stateful inspection.
4. Policy boundary: check security groups, NACLs, endpoint policies, firewall policy, IAM/resource policy, SCP, and key/certificate requirements where relevant.
5. Name resolution: verify hosted-zone association, Resolver endpoints, forwarding rules, private DNS, health checks, and DNSSEC if integrity is required.
6. Evidence: use Reachability Analyzer, Route Analyzer, flow logs, CloudTrail, CloudWatch metrics, DNS query logs, firewall logs, and load balancer or edge logs.

If an answer changes a route, firewall, endpoint, or DNS record without proving the return path and evidence source, it is usually incomplete for this specialty exam.

Official task compression

Network Design covers edge services, DNS, load balancing, logging, hybrid routing, and multi-account or multi-Region connectivity. Design from requirements: protocol, source, destination, accounts, Regions, DNS, failover, visibility, and security boundary.

Network Implementation covers hybrid routing, multi-account/VPC connectivity, DNS, automation, and connectivity testing. Implement the route domain and validate it with Route Analyzer, Reachability Analyzer, logs, and metrics.

Network Management and Operation covers maintaining routing and connectivity, analyzing traffic, and optimizing performance, reliability, and cost. Troubleshoot from recent change, route table, propagation, BGP, DNS, flow evidence, and the actual bottleneck.

Network Security, Compliance, and Governance covers secure flows, security validation, audit, confidentiality, certificates, and DNSSEC. Security answers must include traffic steering, policy boundary, encryption or certificate choice, logging, audit, and alerting.

Network path evidence map

Exam-day answer algorithm

Use this for long connectivity, outage, or design stems.

    flowchart TD
	  S["Scenario"] --> C["Name the constraint: security, cost, latency, scale, failover, evidence"]
	  C --> P["Identify source, destination, account, VPC, subnet, Region"]
	  P --> R["Check route domain: VPC route table, TGW, DX, VPN, peering, PrivateLink"]
	  R --> G["Check guardrail: SG, NACL, firewall, endpoint policy, IAM, SCP"]
	  G --> D["Check DNS: hosted zone, Resolver, forwarding, health, DNSSEC"]
	  D --> E["Choose evidence: flow logs, CloudTrail, metrics, health checks, packet mirroring"]
	  E --> A["Pick the smallest answer that satisfies the stated constraint"]

If an answer changes a service but never proves the route, return path, DNS answer, control point, or evidence source, keep looking.

Final answer stack

When two choices both sound network-valid, keep the one that satisfies the whole path:

1. Classify the requirement first. Is the stem about connectivity, segmentation, failover, latency, DNS, private access, inspection, encryption, evidence, or cost?
2. Choose the right connectivity pattern. Use peering for simple direct private routing, Transit Gateway or Cloud WAN for routing domains, PrivateLink for one-service exposure, Direct Connect for predictable private hybrid bandwidth, and VPN/IPsec for encrypted tunnels.
3. Prove the route and return route. Prefix specificity, route source, propagation, BGP attributes, route tables, and stateful inspection matter before packet-level tools.
4. Keep DNS separate from routing. Resolver endpoints, forwarding rules, private hosted zones, aliases, health checks, TTLs, and DNSSEC solve name-resolution problems that route-table changes cannot.
5. Place security where traffic actually flows. WAF sees HTTP; Network Firewall and GWLB see routed flows; security groups control workload allow lists; endpoint policies govern private service access.
6. Collect the right evidence. CloudTrail proves API changes, flow logs prove flow metadata, Route Analyzer proves TGW route intent, Reachability Analyzer models VPC paths, and Traffic Mirroring captures packets only when targeted inspection is justified.

Service-fit shortcuts

Routing and connectivity traps

Routing questions reward discipline. Source, destination, prefix, route source, route priority, return path, and propagation matter before packet-level analysis.

Route-priority and return-path checks

Hybrid connectivity

Do not confuse private connectivity with encrypted connectivity. Direct Connect is private, but AWS states that DX traffic is not encrypted by default.

DNS decision rules

DNS answers are often wrong because they fix routing instead of name resolution, or they fix public DNS when the failure is a private hosted-zone or Resolver rule problem.

DNS implementation traps

Load balancing and edge

Match the control to the OSI layer. WAF does not inspect arbitrary TCP flows. NLB does not give HTTP host/path routing. Route 53 does not provide instant traffic movement or static Anycast IPs.

Multi-account and private access

PrivateLink is service exposure. Transit Gateway is network routing. VPC peering is direct private routing without transitive behavior.

Observability and audit

CloudTrail proves API changes. Flow logs prove network flow behavior. Traffic Mirroring is packet-level and should be targeted, not the default answer for every investigation.

Connectivity validation workflow

    flowchart TD
	  S["Connectivity symptom"] --> C["Define source, destination, port, protocol, account, VPC, Region"]
	  C --> R["Check routes and propagation"]
	  R --> P["Check policy controls: SG, NACL, endpoint, firewall, IAM/KMS where relevant"]
	  P --> D["Check DNS answer and resolver path"]
	  D --> E["Collect evidence: Reachability Analyzer, Route Analyzer, Flow Logs, metrics"]
	  E --> F["Change the smallest failing layer and retest"]

Optimization rules

Optimization is a tradeoff question. Name the bottleneck before choosing the service.

Security architecture

A firewall that traffic bypasses is not a control. Central inspection answers must include route steering and return-path compatibility.

Security boundary chooser

Confidentiality

Private does not automatically mean encrypted. Segmentation, routing, and firewalling are not substitutes for TLS, IPsec, MACsec, or a certificate-management design.

Multiple-response checklist

For “choose two” or “choose three” network questions, the correct set often contains different parts of one working path.

Do not select two services that both solve the same half of the problem while leaving routing, policy, DNS, or evidence missing.

Last-look eliminations

Final five-minute memory cues

Practice fit

Use IT Mastery for exact ANS-C01 practice routing, spaced review when available, and close-answer explanations after this final review.

Decision order

ANS-C01 networking questions are path questions: source, destination, route, security, DNS, return path, health, evidence, and constraint. Answer in that order, and many plausible distractors become obviously incomplete.