ANS-C01 Network Design Guide

This domain is where ANS-C01 tests whether you can design the path before you troubleshoot it. Expect hybrid connectivity, routing domains, DNS decisions, segmentation, cross-Region patterns, and observability requirements rather than isolated service trivia.

What AWS is explicitly testing

As of May 17, 2026, the current AWS ANS-C01 domain page breaks Network Design into six task areas:

• Task 1.1: design edge network services for global user performance and traffic management
• Task 1.2: design DNS for public, private, and hybrid requirements
• Task 1.3: design load balancing for high availability, scalability, and security
• Task 1.4: define logging and monitoring requirements across AWS and hybrid networks
• Task 1.5: design hybrid routing and connectivity between on-premises networks and AWS
• Task 1.6: design routing and connectivity across multiple accounts, Regions, and VPCs

That split matters because many ANS-C01 questions mention VPCs, Route 53, or Transit Gateway while really testing a narrower design objective such as edge entry, DNS behavior, private hybrid routing, or multi-Region segmentation.

Current weight in the exam guide

AWS currently weights this domain at 30% of scored content, making it the largest ANS-C01 area.

Domain 1 decision model

Network Design questions usually start with a business requirement and ask for a network shape. Before choosing a service, identify the primary design lane.

The design answer should name the path and the reason. “Use Transit Gateway” is incomplete if the stem is really about PrivateLink service exposure, DNS forwarding, or centralized inspection.

Design path map

Use this compact flow when answer choices include several plausible networking services.

    flowchart TD
	  R["Requirement"] --> E{"Public edge or global entry?"}
	  E -- "Yes" --> EDGE["Route 53, CloudFront, Global Accelerator, ALB/NLB, WAF, Shield"]
	  E -- "No" --> DNS{"Name resolution requirement?"}
	  DNS -- "Yes" --> R53["Public/private hosted zones, Resolver endpoints, forwarding, DNSSEC"]
	  DNS -- "No" --> HYB{"Hybrid or multi-network routing?"}
	  HYB -- "Hybrid" --> DX["Direct Connect, VPN, BGP, SD-WAN, redundancy, encryption"]
	  HYB -- "Many VPCs/accounts" --> TGW["TGW, Cloud WAN, peering, PrivateLink, VPC sharing, overlap strategy"]
	  HYB -- "No" --> OBS["Define evidence: logs, metrics, analyzer, baseline, traffic mirror"]

If the flow points to more than one lane, preserve the stated constraint first. For example, a global application may need both CloudFront and Route 53, but the stronger answer depends on whether the stem emphasizes caching, static Anycast IPs, health-based DNS, WAF placement, or origin protection.

Work this domain in order

Start with 1.1 Edge Network Services because public entry, latency, and global traffic patterns often define the rest of the design.

Then move through:

1. 1.2 DNS, Service Discovery, and Resiliency
2. 1.3 Load Balancing and Traffic Management
3. 1.4 Network Observability by Design
4. 1.5 Hybrid Routing and Connectivity
5. 1.6 Multi-VPC and Multi-Region Connectivity

Fast routing inside this chapter

High-yield design comparisons

What to prove before picking an answer

For each design scenario, write a one-line path proof:

Users or workloads enter through entry point, resolve through DNS path, route through network domain, cross control point, reach destination, fail over through backup path, and are observed by evidence source.

If you cannot fill in one part, that is probably where the exam is testing you.

What strong ANS-C01 answers usually do

• define the path first: source, entry point, routing domain, inspection point, destination, and return path
• separate DNS decisions from traffic-forwarding decisions
• match load balancer or edge service choice to the protocol and resilience requirement
• design private and hybrid connectivity with redundancy and route-control behavior in mind
• include observability as part of the design instead of as a later add-on
• account for IP overlap, VPC sharing, and cross-account ownership before choosing a connectivity primitive

Common network-design traps

• answering every internet-facing question with only Route 53
• choosing peering when centralized routing or segmentation is the real requirement
• using a public encrypted path when the prompt clearly wants a private one
• designing the forward path but ignoring the return path or failure behavior
• adding monitoring after the path is already opaque
• treating PrivateLink, Transit Gateway, peering, and Cloud WAN as interchangeable
• forgetting that DNSSEC, TLS, IPsec, and MACsec protect different boundaries

In this section

• ANS-C01 Edge Network Services Guide
  Study ANS-C01 edge network services for CloudFront, Global Accelerator, Route 53, WAF, Shield, public entry design, and global traffic traps.
• ANS-C01 DNS, Service Discovery, and Resiliency Guide
  Study ANS-C01 DNS design for Route 53 routing policies, private hosted zones, Resolver endpoints, hybrid DNS, Cloud Map, TTLs, and failover behavior.
• ANS-C01 Load Balancing and Traffic Management Guide
  Study ANS-C01 load balancing for ALB, NLB, GWLB, target health, protocol fit, inspection paths, high availability, and traffic steering.
• ANS-C01 Network Observability by Design Guide
  Study ANS-C01 network observability for CloudWatch, flow logs, Reachability Analyzer, Traffic Mirroring, access logs, baselines, and hybrid visibility.
• ANS-C01 Hybrid Routing and Connectivity Guide
  Study ANS-C01 hybrid routing for Direct Connect, Site-to-Site VPN, Transit Gateway, Direct Connect Gateway, BGP, failover, and route control.
• ANS-C01 Multi-VPC and Multi-Region Connectivity Guide
  Study ANS-C01 multi-VPC and multi-Region connectivity for Transit Gateway, VPC peering, PrivateLink, VPC sharing, Cloud WAN, segmentation, and IP overlap.