AWS ANS-C01 FAQ for exam format, domain weights, study order, hybrid networking, DNS, Transit Gateway, security, practice questions, and final review.
Use this FAQ to answer common planning questions for AWS Certified Advanced Networking - Specialty (ANS-C01). It is intentionally practical: what the exam covers, how to sequence preparation, how to handle long networking stems, and where to go next inside this guide.
ANS-C01 is the AWS Certified Advanced Networking - Specialty exam. AWS positions it for candidates who perform an AWS networking specialist role and can design, implement, manage, and secure AWS and hybrid network architectures at scale.
The exam has 65 total questions. AWS states that 50 questions are scored and 15 are unscored. The unscored questions are not identified during the exam, so treat every question as scored.
The exam duration is 170 minutes. That is about 2.6 minutes per question on average. Long BGP, DNS, Transit Gateway, or multi-account routing scenarios can take longer, so mark slow questions and return after collecting easier points.
AWS reports ANS-C01 results on a 100-1000 scaled score, with 700 as the passing score.
AWS currently lists the exam cost as 300 USD, with additional pricing details depending on currency and location.
AWS currently lists the exam in English, Japanese, Korean, and Simplified Chinese, with testing through Pearson VUE testing centers or online proctored delivery. Check the live AWS certification page before scheduling because delivery details can change.
AWS describes the target candidate as someone with 5 or more years of networking experience, including 2 or more years of cloud and hybrid networking experience. In practice, the exam is strongest for people who already understand routing, DNS, TCP/IP, VPNs, BGP, firewalls, load balancing, and AWS network services.
AWS says candidates can benefit from earning an AWS Associate and/or Professional certification before a Specialty certification, but it is not a strict prerequisite. If you are weak on core AWS services, take time to review VPC, IAM, EC2, load balancing, Route 53, CloudFront, monitoring, and security basics before going deep into ANS-C01.
| Domain | Weight |
|---|---|
| Network Design | 30% |
| Network Implementation | 26% |
| Network Management and Operation | 20% |
| Network Security, Compliance, and Governance | 24% |
The exam is balanced enough that you cannot ignore security or operations. Network Design is the largest domain, but security/governance and implementation together carry major weight.
Start with Network Design because it teaches the routing, DNS, edge, load balancing, and multi-account patterns that show up everywhere else. Then move through implementation, operations, and security.
Use the structured path here: ANS-C01 Study Plan.
The hardest part is usually not memorizing service names. It is choosing the best answer when several services could technically work.
The exam often asks you to optimize for one constraint:
| Constraint | What to emphasize |
|---|---|
| Reliability | Failure domains, health checks, redundancy, failover evidence. |
| Security | Trust boundary, policy, route steering, encryption, audit evidence. |
| Cost | Data-transfer path, NAT, endpoints, cross-AZ traffic, route scale. |
| Performance | Latency, throughput, MTU, ENA/EFA, caching, acceleration. |
| Operations | Logs, metrics, automation, validation, rollback, drift control. |
| Governance | Multi-account policy, delegated admin, central logging, guardrails. |
The highest-risk trap is route table tunnel vision. Many wrong answers fix one route table while ignoring DNS, return path, security groups, NACLs, endpoint policies, BGP advertisements, propagation, or asymmetric inspection.
Use the path order from the cheat sheet: source, destination, route, security, DNS, return path, health, evidence, and constraint.
Read the question in this order:
Then read the answers. This prevents service-name distraction.
Multiple-response questions often require multiple parts of a working design. Do not choose two services that solve the same half of the problem.
| If the question asks for | Look for |
|---|---|
| Hybrid failover | Connectivity plus routing or health/failover behavior. |
| Private service access | Endpoint pattern plus policy or DNS behavior. |
| Central inspection | Inspection service plus route-table steering and return-path symmetry. |
| DNS across hybrid | Resolver endpoint plus forwarding rule or hosted-zone association. |
| Compliance evidence | Log source plus delivery, retention, alerting, or audit control. |
| Encryption | Encryption mechanism plus certificate, key, or endpoint lifecycle. |
You need practical BGP reasoning, not vendor-router trivia. Know route advertisements, accepted prefixes, prefix specificity, AS path, local preference behavior, active/passive Direct Connect patterns, failover, and how BGP interacts with VPN, Direct Connect, Transit Gateway, and route propagation.
It is about both, but in different ways.
| Service | What the exam tests |
|---|---|
| Direct Connect | Physical/logical connectivity, VIFs, DX gateways, BGP, redundancy, route preference, jumbo frames, encryption choices. |
| Transit Gateway | Hub routing, route tables, associations, propagation, segmentation, inspection, hybrid attachment patterns. |
Many hard questions combine them.
PrivateLink is strong when many consumers need private access to one provider service without receiving broad routed access into the provider VPC. It is not a general substitute for Transit Gateway, peering, or Cloud WAN when the requirement is network-level bidirectional routing.
VPC peering is still strong for simple direct VPC-to-VPC routing when CIDRs do not overlap and there is no need for transitive routing, central inspection, or large-scale route-domain management.
Choose Transit Gateway when the scenario needs hub-and-spoke routing, many VPCs, many accounts, segmentation, centralized inspection, hybrid aggregation, route-domain control, or transitive connectivity.
Focus on Route 53 public hosted zones, private hosted zones, alias records, health checks, routing policies, Resolver inbound and outbound endpoints, forwarding rules, hybrid DNS, cross-account hosted-zone association, DNSSEC, and DNS logging.
DNS questions often look like routing questions until you notice that the wrong name is resolving or the private hosted zone is associated with the wrong VPC.
Know the difference between:
| Control | Best fit |
|---|---|
| AWS WAF | HTTP(S) application-layer filtering. |
| AWS Shield | DDoS resilience for supported public resources. |
| AWS Network Firewall | Managed routed-flow inspection. |
| Gateway Load Balancer | Scalable appliance insertion. |
| Security groups | Stateful workload boundary controls. |
| NACLs | Stateless subnet guardrails. |
| Endpoint policies | Control private AWS service access through endpoints. |
| Firewall Manager | Central governance across AWS Organizations. |
The strongest security answers usually include the route path and the evidence path, not only the control name.
| Need | Strong source |
|---|---|
| Who changed a security group or route table | CloudTrail. |
| Whether a flow was accepted or rejected | VPC Flow Logs or firewall logs. |
| Packet-level visibility from selected ENIs | VPC Traffic Mirroring. |
| HTTP request evidence | WAF, CloudFront, or ALB logs. |
| Transit Gateway traffic/topology | TGW Flow Logs, Route Analyzer, Network Manager. |
| Near-real-time alarm | CloudWatch metrics, metric filters, alarms, EventBridge. |
| Organization-wide posture | Firewall Manager, AWS Config, Trusted Advisor, Security Hub. |
Know the boundary:
| Requirement | Likely control |
|---|---|
| Public HTTPS | TLS with ACM on supported AWS endpoints. |
| Internal private trust | ACM PCA or enterprise private CA. |
| Hybrid network-layer encryption | IPsec Site-to-Site VPN. |
| Direct Connect plus IPsec | VPN over Direct Connect. |
| Direct Connect link encryption | MACsec on supported dedicated Direct Connect paths. |
| DNS integrity | DNSSEC. |
| S3 transport enforcement | HTTPS-required bucket or IAM policy conditions. |
Private connectivity is not automatically encrypted connectivity.
Use practice questions after each focused read, not before any context. For every miss, write:
Use ANS-C01 Sample Questions with Explanations for the free guide layer, then use IT Mastery when you want more practice routing and spaced review.
Use the ANS-C01 Cheat Sheet in the final week and again immediately before practice blocks. It is designed as a decision-rule page, not as a substitute for reading the guide.
Check the live AWS sources before scheduling:
| Fact | Why it can change |
|---|---|
| Exam status and version | AWS can update or retire exams. |
| Price | Local currency and tax details vary. |
| Duration and delivery options | Vendor scheduling details can change. |
| Languages | Availability can change by exam/version. |
| Domain outline | AWS can update the exam guide. |
| Testing policies | Identification, rescheduling, online-proctoring, and exam rules change over time. |
Use the ANS-C01 Resources page as the official-link hub.