Browse AWS Certification Guides

ANS-C01 Network Management and Operations Guide

Study ANS-C01 network operations for route maintenance, BGP, Direct Connect, VPN, PrivateLink, VPC Flow Logs, Traffic Mirroring, Reachability Analyzer, Network Manager, subnet capacity, ENA, EFA, jumbo frames, and cost optimization.

This domain is less about provisioning and more about proving the path still works as networks change. Expect BGP maintenance, route priority, flow logs, packet evidence, route validation, subnet capacity, health checks, and optimization choices that reveal where a hybrid or multi-VPC path actually breaks.

What AWS is explicitly testing

As of May 17, 2026, the current AWS ANS-C01 domain page breaks Network Management and Operation into three task areas:

  • Task 3.1: maintain routing and connectivity on AWS and hybrid networks
  • Task 3.2: monitor and analyze network traffic to troubleshoot and optimize connectivity patterns
  • Task 3.3: optimize networks for performance, reliability, and cost-effectiveness

That split matters because many ANS-C01 operational questions blend route health, telemetry, and optimization into one story. The strongest answer usually identifies whether the immediate problem is path maintenance, traffic analysis, or an architecture that should be tuned for better throughput, resilience, or cost.

Current weight in the exam guide

AWS currently weights this domain at 20% of scored content.

Domain 3 operations model

Operations questions usually ask for the next best evidence or the safest maintenance action. The first job is to classify the problem.

Operational problem What to check first Better evidence
Hybrid route changed BGP state, advertised prefixes, accepted prefixes, route priority, propagation, DX/VPN health. Direct Connect/VPN metrics, route tables, TGW route tables, Route Analyzer, flow logs.
Private service access changed PrivateLink endpoint state, endpoint policy, private DNS, provider service permissions, VPC peering routes. Endpoint status, DNS answer, security groups, flow logs, provider target health.
Connectivity failure is unclear Source, destination, route, security, DNS, return path, and recent change. Reachability Analyzer, VPC Flow Logs, CloudWatch metrics, packet mirroring when needed.
Packet-size or throughput issue MTU, jumbo-frame support, ENA/EFA support, instance limits, tunnel/appliance path. Metrics, packet capture, Traffic Mirroring, CloudWatch, path MTU evidence.
Optimization request Bottleneck: latency, throughput, data-transfer cost, subnet IPs, route scale, or availability. Cost data, flow volume, subnet IP availability, health metrics, route count, load distribution.

Do not jump straight to packet capture. Most ANS-C01 operations questions can be narrowed first with route state, DNS answers, flow metadata, health metrics, and recent-change evidence.

Operations triage flow

Use this flow when a path previously worked or when an answer set mixes monitoring and optimization choices.

    flowchart TD
	  S["Symptom or change"] --> R{"Route or prefix changed?"}
	  R -- "Yes" --> B["Check BGP, propagation, route priority, TGW/VPC route tables"]
	  R -- "No" --> D{"DNS or endpoint path changed?"}
	  D -- "Yes" --> N["Check Resolver, hosted zone, PrivateLink DNS, endpoint policy"]
	  D -- "No" --> T{"Traffic evidence needed?"}
	  T -- "Flow-level" --> F["Use VPC Flow Logs, TGW Flow Logs, CloudWatch metrics"]
	  T -- "Packet-level" --> P["Use Traffic Mirroring with scoped filters"]
	  T -- "Topology/path" --> A["Use Reachability Analyzer, Route Analyzer, Network Manager"]
	  A --> O["Optimize only after failure layer is known"]
	  F --> O
	  P --> O

The trap is optimizing before diagnosing. If the route is wrong, increasing bandwidth is not the fix. If the subnet is out of IPs, changing DNS is not the fix.

Work this domain in order

Start with 3.1 Routing and Connectivity Maintenance so the steady-state path and route-behavior logic are clear first.

Then move through:

  1. 3.2 Traffic Analysis and Connectivity Troubleshooting
  2. 3.3 Network Performance, Reliability, and Cost Optimization

Fast routing inside this chapter

If the scenario is really about… Go first to…
route propagation, VIFs, Direct Connect gateways, BGP over Direct Connect, VPN route priority, PrivateLink maintenance, CIDR overlap, or keeping hybrid paths healthy 3.1 Routing and Connectivity Maintenance
VPC Flow Logs, TGW Flow Logs, packet mirroring, Reachability Analyzer, Network Manager, packet size issues, packet loss, topology evidence, or proving where a path breaks 3.2 Traffic Analysis and Connectivity Troubleshooting
VPC peering vs Transit Gateway, multicast, subnet exhaustion, secondary CIDRs, jumbo frames, ENA/EFA, Route 53 HA features, Global Accelerator, or bandwidth/cost tradeoffs 3.3 Network Performance, Reliability, and Cost Optimization

Tool chooser

Need Strong tool or signal Why
Who changed route/security configuration CloudTrail API activity and caller identity.
Whether traffic was accepted or rejected VPC Flow Logs or firewall logs Flow-level metadata and action.
Transit Gateway route-domain visibility TGW Flow Logs, Route Analyzer, Network Manager Central route and topology evidence.
Static path proof Reachability Analyzer Determines whether a modeled path is reachable under current configuration.
Packet-level payload/header analysis Traffic Mirroring Copies selected ENI traffic for packet analysis.
Service health and thresholds CloudWatch metrics and alarms Operational time-series and alerting.
DNS query behavior Resolver query logs and DNS test results Shows name-resolution behavior instead of packet forwarding.

Choose the narrowest signal that can prove the layer in question. Traffic Mirroring is too heavy when flow metadata is enough; CloudTrail is wrong when the question asks whether packets were accepted.

Optimization chooser

Bottleneck Strong first move
Hybrid route preference Check prefix length, BGP attributes, local preference communities, route source, and health.
Route table scale Summarize prefixes, reduce propagation, split route domains, or redesign overlap.
Packet loss or large-transfer failure Check MTU, jumbo frames, tunnel encapsulation, appliance path, and packet size.
EC2 network throughput Check instance network performance, ENA, placement, target health, and load distribution.
HPC or tightly coupled ML Consider EFA and placement-aware architecture.
NAT or cross-AZ cost Use endpoints where appropriate and review AZ placement of NAT, load balancers, and appliances.
Auto Scaling launch failures Check available subnet IP addresses and secondary CIDR/subnet strategy.
Global latency or fast failover Use CloudFront for cacheable HTTP; Global Accelerator for static Anycast IP TCP/UDP acceleration.

The strongest optimization answer identifies the bottleneck before changing the architecture.

What strong ANS-C01 answers usually do

  • maintain routing state deliberately instead of assuming the originally designed path still works
  • use the right observability tool for the question: flow-level, packet-level, route-path, or topology-wide
  • separate troubleshooting from optimization instead of doing both at once
  • tune connectivity and network services according to performance, reliability, and cost requirements explicitly named in the prompt
  • validate fixes with route, DNS, metric, and traffic evidence before declaring the incident resolved

Common operations traps

  • checking the wrong telemetry layer first
  • treating every path issue like a route-table problem when MTU, DNS, or health behavior is the actual failure
  • optimizing for bandwidth or latency without checking operational simplicity or cost
  • assuming the path is correct because the architecture diagram looked correct during design
  • using packet mirroring for every investigation when flow logs or analyzer output would be enough
  • fixing an Auto Scaling failure with routing changes when the subnet is out of IP addresses

In this section

Revised on Monday, June 15, 2026
2. Network Implementation
4. Network Security, Compliance, and Governance