Use this glossary when AWS Certified Advanced Networking - Specialty (ANS-C01) terms start to blur together. The goal is practical recognition: what the term means on the exam, when it is the right answer, and when it is a distractor.
For full decision rules, pair this page with the ANS-C01 Cheat Sheet and ANS-C01 FAQ.
How to use this glossary
Do not memorize terms in isolation. For each term, know:
- The layer it belongs to: route, DNS, security, evidence, encryption, or governance.
- The scenario where it is the strongest answer.
- The common distractor scenario where it sounds plausible but solves the wrong problem.
- The evidence that proves it worked.
Routing and connectivity terms
| Term |
Exam meaning |
Common trap |
| VPC route table |
Determines the next hop for subnet or gateway traffic. |
Treating it as a firewall instead of a path selector. |
| Route propagation |
Automatic route insertion from a VPN, Direct Connect gateway, or Transit Gateway attachment. |
Assuming propagated routes appear in every route table. |
| Blackhole route |
Route entry that intentionally drops matching traffic. |
Missing an intentional blackhole during TGW or route-table troubleshooting. |
| Longest prefix match |
More-specific route wins over less-specific route. |
Ignoring prefix length when two paths advertise similar networks. |
| CIDR overlap |
Two networks use overlapping address space. |
Trying to fix overlap with more propagation instead of NAT, renumbering, PrivateLink, or isolation. |
| Prefix list |
Reusable set of CIDR blocks or AWS-managed service prefixes. |
Treating it as dynamic routing; it is a policy/route-reference object. |
| VPC peering |
Direct private routing between two VPCs. |
Using it as a transitive hub; VPC peering is not transitive. |
| Transit Gateway |
Regional hub for connecting VPCs, VPNs, and Direct Connect patterns. |
Forgetting TGW route table association and propagation. |
| Transit Gateway route table |
Route domain inside a TGW. |
Assuming every attachment uses the default table forever. |
| AWS Cloud WAN |
Global network policy and segmentation service. |
Choosing it for a simple single-Region TGW pattern. |
| AWS RAM |
Resource sharing across accounts. |
Confusing sharing a resource with granting broad network access. |
| VPC sharing |
Central network account owns subnets; participant accounts deploy resources. |
Assuming participants own subnet route tables or VPC-level controls. |
Hybrid networking terms
| Term |
Exam meaning |
Common trap |
| AWS Direct Connect |
Dedicated private connectivity from customer network to AWS. |
Assuming it encrypts traffic by default. |
| Direct Connect gateway |
Connects Direct Connect VIFs to VPCs or TGW across Regions depending on pattern. |
Confusing it with a Transit Gateway route table. |
| Private VIF |
Direct Connect virtual interface for private AWS resources through VGW or DX gateway. |
Using it for public AWS service prefixes. |
| Public VIF |
Direct Connect virtual interface for public AWS service prefixes. |
Using it for private VPC routing. |
| Transit VIF |
Direct Connect virtual interface used with Transit Gateway through DX gateway. |
Choosing private VIF when the requirement is TGW-scale routing. |
| Site-to-Site VPN |
IPsec tunnel between customer gateway and AWS VPN endpoint. |
Treating it as equivalent to DX for predictable bandwidth. |
| VPN over Direct Connect |
IPsec VPN tunnel that uses the Direct Connect path. |
Forgetting why both are needed: DX path plus IPsec confidentiality. |
| Customer gateway |
Customer-side device or configuration for VPN. |
Debugging only AWS when the customer router/BGP config changed. |
| Virtual private gateway |
AWS-side gateway for VPC VPN/DX patterns. |
Using it where Transit Gateway scale is required. |
| BGP |
Dynamic routing protocol used with Direct Connect and VPN. |
Treating link health as the only route-preference factor. |
| AS path |
BGP attribute that influences path selection. |
Ignoring prefix specificity and local preference/community behavior. |
| BGP community |
Tag that can influence Direct Connect route preference. |
Assuming active/passive DX works without route-policy design. |
| Route priority |
AWS preference among route sources and routes. |
Assuming DX, VPN, static, and propagated routes are always equal. |
DNS and service discovery terms
| Term |
Exam meaning |
Common trap |
| Route 53 public hosted zone |
Authoritative public DNS zone. |
Using it to solve private VPC-only name resolution. |
| Route 53 private hosted zone |
Private DNS namespace associated with VPCs. |
Forgetting cross-account or multi-VPC associations. |
| Alias record |
Route 53 record that maps to supported AWS resources without normal CNAME restrictions. |
Choosing CNAME at the zone apex. |
| Health check |
Route 53 or service health signal for routing/failover. |
Assuming DNS failover is instant. |
| Resolver inbound endpoint |
Lets on-premises resolvers query VPC Resolver. |
Reversing inbound and outbound direction. |
| Resolver outbound endpoint |
Lets VPC Resolver forward selected queries to external resolvers. |
Creating only private hosted zones when forwarding rules are required. |
| Resolver rule |
Conditional forwarding rule for DNS queries. |
Forgetting association with the correct VPCs/accounts. |
| DNSSEC |
DNS data authenticity and integrity mechanism. |
Treating it as encryption for application payloads. |
| Resolver query logs |
Logs DNS queries from VPC resources. |
Using flow logs when the question asks what name was queried. |
| AWS Cloud Map |
Service discovery registry and namespace integration. |
Choosing it when the requirement is public authoritative DNS failover. |
Load balancing and edge terms
| Term |
Exam meaning |
Common trap |
| Application Load Balancer |
Layer 7 HTTP/HTTPS load balancer. |
Choosing it for raw TCP/UDP static-IP transport requirements. |
| Network Load Balancer |
Layer 4 TCP/UDP/TLS load balancer with high-performance transport behavior. |
Choosing it when host/path HTTP routing is required. |
| Gateway Load Balancer |
Transparent insertion and scaling of virtual network appliances. |
Replacing every NLB pattern with GWLB just because traffic is TCP. |
| CloudFront |
Global edge delivery and caching service. |
Choosing it for non-HTTP static Anycast IP acceleration. |
| Global Accelerator |
Static Anycast IPs, health-aware regional endpoint routing, TCP/UDP acceleration. |
Using it as a cache or WAF replacement. |
| Origin |
Backend service CloudFront fetches from. |
Encrypting viewer-to-edge only when edge-to-origin encryption is required. |
| Target group |
Load balancer grouping of targets and health checks. |
Debugging DNS when target health is the failure. |
| Cross-zone load balancing |
Distributes load across enabled AZ targets depending on load balancer type/config. |
Ignoring cross-AZ data-transfer and placement implications. |
| Stickiness |
Session affinity behavior. |
Using it as a reliability substitute rather than an application-session choice. |
Private access and endpoint terms
| Term |
Exam meaning |
Common trap |
| Gateway endpoint |
Route-table endpoint for S3 or DynamoDB. |
Using NAT gateway by default for private S3/DynamoDB access. |
| Interface endpoint |
ENI-based private endpoint for supported services or PrivateLink services. |
Forgetting security groups, subnet IP usage, endpoint policy, or private DNS. |
| Endpoint policy |
Policy restricting what can be accessed through a VPC endpoint. |
Assuming it replaces IAM or resource policies completely. |
| Private DNS for endpoints |
Lets standard service names resolve to endpoint private addresses. |
Creating an endpoint but leaving DNS resolving to public names. |
| PrivateLink endpoint service |
Provider-side service exposed privately to consumers. |
Confusing service exposure with broad VPC routing. |
| NAT gateway |
Managed outbound internet path for private subnets. |
Treating it as a security inspection service or private AWS service access requirement. |
| Egress-only internet gateway |
IPv6 outbound-only internet path. |
Applying IPv4 NAT assumptions to IPv6. |
Observability and operations terms
| Term |
Exam meaning |
Common trap |
| VPC Flow Logs |
Flow-level metadata for accepted/rejected traffic. |
Expecting packet payload, HTTP headers, or DNS names. |
| Extended flow-log fields |
Additional fields for richer path and packet context. |
Relying on default fields when NAT, endpoints, or intermediaries matter. |
| Traffic Mirroring |
Packet-level copy from selected ENIs to a monitoring target. |
Using it when flow metadata is enough. |
| Reachability Analyzer |
Static path analysis for VPC reachability. |
Treating it as live packet capture. |
| Route Analyzer |
Transit Gateway route/path analysis tool. |
Debugging TGW route tables manually when a route-analysis feature fits. |
| Network Manager |
Global network topology and monitoring for TGW/Cloud WAN patterns. |
Using it as a firewall or packet inspector. |
| CloudWatch alarm |
Alarm on metric threshold or expression. |
Assuming logs alert people without metric filters, alarms, or EventBridge. |
| CloudTrail |
AWS API activity evidence. |
Using it to prove packet-level network behavior. |
| AWS Config |
Resource configuration history and compliance rules. |
Using it as real-time traffic telemetry. |
| Trusted Advisor |
Best-practice checks including selected security/network items. |
Treating it as full custom compliance automation. |
Security and governance terms
| Term |
Exam meaning |
Common trap |
| Security group |
Stateful allow-list control attached to ENIs or supported resources. |
Forgetting return traffic is statefully allowed. |
| Network ACL |
Stateless subnet-level allow/deny rules. |
Forgetting ephemeral ports and return rules. |
| AWS WAF |
HTTP(S) application-layer filtering. |
Choosing it for non-HTTP east-west inspection. |
| AWS Shield |
DDoS protection for supported AWS resources. |
Treating it as an application firewall. |
| AWS Network Firewall |
Managed network firewall for routed VPC traffic. |
Deploying it without route-table steering. |
| Firewall Manager |
Central policy management across AWS Organizations. |
Manually editing every account when central governance is required. |
| AWS Organizations |
Account governance and organization-wide control structure. |
Confusing organizational membership with network connectivity. |
| Service control policy |
Organization-level permission guardrail. |
Using it as a network packet filter. |
| IAM policy |
Identity/API authorization. |
Using it instead of route, firewall, or endpoint policy controls. |
| Resource policy |
Policy attached to resource such as S3 bucket or endpoint service. |
Forgetting identity policy must also allow the action. |
Confidentiality terms
| Term |
Exam meaning |
Common trap |
| TLS |
Application/transport encryption for client-service paths. |
Assuming TLS at one hop means every hop is encrypted. |
| ACM |
Certificate management for supported AWS services. |
Assuming ACM public certs can be exported to arbitrary servers. |
| ACM PCA |
Private certificate authority for internal/private trust. |
Using public certificates for every private internal name. |
| Mutual TLS |
Both client and server authenticate with certificates. |
Using it when ordinary server-authenticated TLS is enough. |
| IPsec |
Network-layer tunnel encryption used by Site-to-Site VPN. |
Confusing it with MACsec link encryption. |
| MACsec |
Layer 2 encryption on supported dedicated Direct Connect paths. |
Assuming it protects every application hop end to end. |
| DNSSEC |
DNS authenticity and integrity. |
Treating it as DNS confidentiality or app payload encryption. |
| HTTPS-only policy |
Policy condition requiring encrypted transport such as S3 HTTPS access. |
Confusing encryption at rest with encryption in transit. |
| KMS |
Key management for encryption workflows. |
Assuming KMS alone encrypts network traffic. |
High-value confusion pairs
| Pair |
How to separate them |
| VPC peering vs Transit Gateway |
Peering is simple direct non-transitive routing; TGW is hub routing and segmentation. |
| Transit Gateway vs PrivateLink |
TGW gives network reachability; PrivateLink exposes one service privately. |
| Direct Connect vs VPN |
DX is dedicated private connectivity; VPN is IPsec encryption over a network path. |
| VPN over Direct Connect vs MACsec |
VPN over DX is Layer 3 IPsec over the DX path; MACsec is Layer 2 DX link encryption. |
| ALB vs NLB |
ALB is HTTP/HTTPS Layer 7; NLB is TCP/UDP/TLS Layer 4. |
| NLB vs GWLB |
NLB distributes transport connections; GWLB inserts/scales appliances transparently. |
| CloudFront vs Global Accelerator |
CloudFront caches/distributes HTTP content; Global Accelerator gives static Anycast IPs and health-aware TCP/UDP acceleration. |
| WAF vs Network Firewall |
WAF filters web requests; Network Firewall inspects routed network flows. |
| Security group vs NACL |
Security groups are stateful workload controls; NACLs are stateless subnet controls. |
| CloudTrail vs Flow Logs |
CloudTrail proves API changes; flow logs prove network flow behavior. |
| Flow Logs vs Traffic Mirroring |
Flow logs are metadata; mirroring is packet-level copy. |
| DNSSEC vs TLS |
DNSSEC protects DNS answer integrity; TLS protects application transport. |
Final study rule
For each glossary term, write one sentence in this format:
Use TERM when the stem says SCENARIO, but reject it when the real issue is DISTRACTOR.
Example: Use PrivateLink when many consumers need private access to one provider service, but reject it when the real issue is broad bidirectional routing among VPCs.