ANS-C01 Network Observability by Design Guide

ANS-C01 observability questions are design questions, not after-the-fact logging trivia. AWS is testing whether you can decide what evidence the network must produce before users report an outage, a security team opens an incident, or a hybrid routing change breaks a critical path.

The current task statement is to define logging and monitoring requirements across AWS and hybrid networks. The official scope calls out Amazon CloudWatch metrics, agents, logs, alarms, dashboards, and insights; AWS Transit Gateway Network Manager; VPC Reachability Analyzer; flow logs; traffic mirroring; and access logging for services such as load balancers and CloudFront. The exam expects you to match each tool to the kind of proof it can actually provide.

What the exam is really testing

The common wrong answer is to “enable logging” without saying which hop the log proves.

Observability chooser

Evidence path model

Use this mental flow when a question asks how to design visibility for a network path.

    flowchart LR
	  S["Source"] --> N["Name and route decision"]
	  N --> C["Control point: SG, NACL, firewall, endpoint policy"]
	  C --> F["Flow evidence"]
	  F --> P["Packet or request evidence when needed"]
	  P --> A["Alarm, dashboard, baseline, or audit store"]

The point is not to collect every signal everywhere. The point is to collect enough evidence to prove the path, the control decision, the service behavior, and the deviation from normal.

Flow logs versus Traffic Mirroring

Traffic Mirroring is powerful, but it is not the default answer for every monitoring question. If the scenario needs flow-level auditability, flow logs usually fit better. If the scenario needs packet inspection or protocol-level evidence, mirroring becomes stronger.

Reachability Analyzer is not packet capture

Reachability Analyzer is a static configuration analysis tool. It models the network configuration between a source and destination and reports whether the path is reachable, including blocking components when it is not.

That makes it strong for questions about:

• validating a path before or after a change
• finding whether route tables, security groups, NACLs, gateways, endpoints, or attachments block a path
• proving the expected configured path through a VPC or Transit Gateway-related component

It is weaker when the question asks for live traffic volume, packet payload, intermittent congestion, application latency, target health, or real user request behavior. For those, use metrics, logs, packet capture, access logs, and application telemetry.

Access logs answer a different question

Flow logs tell you about network flows. Access logs tell you what a managed service saw.

If the stem asks why an HTTP request returned a specific status, flow logs alone are usually insufficient. If it asks whether packets were accepted or rejected at a network boundary, access logs alone are usually insufficient.

Hybrid and Transit Gateway visibility

Hybrid ANS-C01 questions often involve more than one team and more than one evidence plane.

Do not design AWS-only observability for a hybrid path and pretend the on-premises side cannot fail. Strong answers usually include AWS metrics plus customer-router, Direct Connect, VPN, or BGP evidence.

Baselines matter

AWS explicitly includes capturing baseline network performance in the ANS-C01 skill set. That means the exam may expect you to know the difference between a monitoring tool and a useful threshold.

Baseline these before a major migration, cutover, or multi-Region rollout:

• normal throughput by link, VPC, Transit Gateway attachment, load balancer, and NAT or endpoint path
• normal latency and error rates for critical flows
• normal DNS behavior and resolver query volume where relevant
• normal packet drops, rejects, and security-control matches
• normal BGP session stability, route advertisements, and failover timing for hybrid paths

Without baselines, a dashboard can show numbers without telling operators whether the numbers are healthy.

Common design patterns

Exam eliminations

Troubleshooting order

When the scenario describes a network outage or unexplained traffic behavior, work in this order:

1. Define the expected source, destination, protocol, port, and path.
2. Use Reachability Analyzer when the question is about configured reachability.
3. Use flow logs when the question is about accepted, rejected, or missing flows.
4. Use access logs when the managed service received the request and application-layer behavior matters.
5. Use Traffic Mirroring only when packet detail or security inspection is required.
6. Use CloudWatch, Network Manager, and baseline dashboards to detect trend, health, and hybrid topology issues.

This order prevents expensive packet-capture thinking when a route table, security group, NACL, or DNS mistake is more likely.

Sample exam question

A company has a hub-and-spoke network that uses AWS Transit Gateway across several accounts. After a route change, one spoke VPC cannot reach a shared services VPC. The network team wants to determine whether the AWS configuration permits the expected path and identify the blocking component if it does not. Which option is strongest first?

• Enable Traffic Mirroring on every workload ENI and inspect packets with a third-party appliance.
• Run VPC Reachability Analyzer for the expected source and destination path.
• Enable CloudFront access logs for the application domain.
• Increase the CloudWatch alarm threshold for the Transit Gateway attachment.

Answer: Run Reachability Analyzer.

Why: The question asks whether the configured path permits reachability and where it is blocked. Reachability Analyzer is designed for static path analysis and blocking-component identification. Traffic Mirroring is deeper than needed and does not directly model the configuration. CloudFront logs are irrelevant unless the failing hop is the edge HTTP service. Changing an alarm threshold does not diagnose the path.

Fast decision rule

Use Reachability Analyzer to prove configured reachability. Use flow logs to prove accepted or rejected flows. Use Traffic Mirroring when packet-level inspection is required. Use access logs when the managed service boundary matters. Use CloudWatch and Network Manager for health, topology, alerting, dashboards, and baselines across AWS and hybrid networks.

Quiz

Continue with 1.5 Hybrid Routing and Connectivity to connect the visibility model to hybrid path design.