ANS-C01 Network Security, Compliance, and Governance Guide

Security answers on ANS-C01 usually combine path control, inspection, evidence, and encryption. The exam wants you to secure inbound, outbound, east-west, hybrid, and service-endpoint traffic without losing scale, shared-services governance, or private access requirements.

What AWS is explicitly testing

As of May 17, 2026, the current AWS ANS-C01 domain page breaks Network Security, Compliance, and Governance into three task areas:

• Task 4.1: implement and maintain network features to meet security and compliance needs and requirements
• Task 4.2: validate and audit security by using network monitoring and logging services
• Task 4.3: implement and maintain confidentiality of data and communications of the network

That split matters because ANS-C01 frequently mixes threat modeling, network enforcement, log analysis, and encryption controls into one scenario. Strong answers identify whether the problem is about controlling the path, proving the control works, or protecting the data moving across that path.

Current weight in the exam guide

AWS currently weights this domain at 24% of scored content.

Domain 4 decision model

Security questions usually become easier after you classify the requirement by layer and evidence.

The wrong answer often selects a familiar security service without making the traffic visible to that service. A firewall that is not on the routed path does not inspect the flow; a log source that cannot observe the control point does not prove compliance; a private route does not automatically encrypt data in transit.

Security control flow

Use this flow when the answer set mixes WAF, Shield, Network Firewall, Flow Logs, CloudTrail, TLS, and certificate services.

    flowchart TD
	  S["Security or compliance requirement"] --> P{"Prevent or enforce traffic?"}
	  P -- "Yes" --> B{"Which boundary?"}
	  B -- "Inbound" --> I["WAF, Shield, ingress routing, security groups, perimeter VPC"]
	  B -- "Outbound" --> O["Network Firewall, proxy, GWLB appliances, endpoints, DNS controls"]
	  B -- "East-west" --> E["Segmentation, TGW route domains, SGs, NACLs, endpoint policies"]
	  S --> V{"Prove or audit behavior?"}
	  V -- "Yes" --> L["Flow logs, Traffic Mirroring, CloudTrail, service logs, CloudWatch, Firewall Manager"]
	  S --> C{"Protect confidentiality?"}
	  C -- "Yes" --> T["TLS, IPsec, VPN over DX, ACM/PCA, DNSSEC, service transport controls"]
	  I --> R["Validate route, log, alert, and failover behavior"]
	  O --> R
	  E --> R
	  L --> R
	  T --> R

The exam trap is treating prevention, detection, and confidentiality as interchangeable. They support each other, but they answer different requirements.

Work this domain in order

Start with 4.1 Network Security Features and Architecture so the threat model and enforcement boundaries are clear first.

Then move through:

1. 4.2 Security Validation, Monitoring, and Audit
2. 4.3 Confidentiality of Network Data and Communications

Fast routing inside this chapter

Control chooser

Evidence chooser

Security validation should not stop at “logs are enabled.” A strong answer includes delivery, retention, correlation, alarm or finding generation, and ownership of response.

What strong ANS-C01 answers usually do

• define trust boundaries and traffic direction before choosing tools
• match enforcement to the correct layer: inbound, outbound, east-west, or private endpoint boundary
• use logging and monitoring to validate the security design instead of assuming the policy is enough
• separate confidentiality controls from broader inspection or segmentation controls
• test whether the implemented network still meets the original compliance and resiliency requirements
• include route steering when an inspection service must actually see the traffic
• include certificate and key lifecycle when the requirement depends on TLS or private trust
• preserve availability while adding controls, especially in centralized inspection paths

Common security traps

• choosing a familiar security service without checking whether the flow is inbound, outbound, or east-west
• auditing only one log source when the path crosses multiple control points
• answering a confidentiality question with only segmentation or firewall logic
• assuming encryption, monitoring, and policy enforcement are interchangeable
• placing Network Firewall or a Gateway Load Balancer appliance in the design without routing traffic through it
• using Traffic Mirroring when flow logs, service logs, or CloudTrail would prove the requirement with less operational weight
• terminating TLS at the edge but forgetting the prompt requires encryption from edge to origin or load balancer to target
• centralizing inspection without accounting for failover, scaling, route symmetry, or cross-AZ cost

In this section

• ANS-C01 Network Security Features and Architecture Guide
  Study ANS-C01 network security architecture for WAF, Shield, Network Firewall, Gateway Load Balancer, security groups, NACLs, endpoint policies, perimeter VPCs, and trust boundaries.
• ANS-C01 Security Validation, Monitoring, and Audit Guide
  Study ANS-C01 security validation with VPC Flow Logs, Traffic Mirroring, CloudWatch alarms, CloudTrail, load balancer logs, CloudFront logs, Firewall Manager, and multi-account audit strategy.
• ANS-C01 Confidentiality of Network Data and Communications Guide
  Study ANS-C01 confidentiality controls for TLS, IPsec, VPN over Direct Connect, MACsec, ACM, ACM PCA, CloudFront, load balancers, S3, Transit Gateway, and DNSSEC.