ANS-C01 Network Security Features and Architecture Guide

Network security architecture questions on ANS-C01 start with the traffic path. AWS is not only testing whether you recognize WAF, Shield, Network Firewall, security groups, or endpoint policies. It is testing whether you place the right control on the right boundary without breaking routing, availability, or compliance intent.

The current AWS task statement is to implement and maintain network security features. The official scope includes threat models, common networking threats, inbound and outbound controls, inter-VPC and multi-account controls, perimeter VPCs, untrusted network zones, three-tier architectures, compliance testing, and automated incident reporting or alerting.

What the exam is really testing

The strongest answers usually combine a control with the architecture that makes that control see the traffic.

Threat-boundary flow

Use this mental model before choosing a service.

    flowchart LR
	  U["Untrusted user or network"] --> E["Edge controls: Route 53, CloudFront, WAF, Shield"]
	  E --> P["Perimeter or ingress VPC"]
	  P --> I["Inspection path: Network Firewall, GWLB appliance, proxy"]
	  I --> A["Application tier: ALB, security groups, workload identity"]
	  A --> D["Data and service tier: security groups, endpoint policies, KMS"]
	  D --> L["Detection and audit: logs, metrics, Security Hub, alerts"]

If an answer adds a firewall but does not steer traffic through it, it is usually weaker than an answer that explicitly designs the route and inspection boundary.

Control placement chooser

Do not choose a control because it sounds more secure. Choose it because it can observe and enforce the relevant traffic.

Inbound security patterns

Inbound traffic usually crosses the most obvious trust boundary: public or partner traffic entering AWS.

Exam traps often put WAF, Shield, and Network Firewall in the same answer set. WAF is best for HTTP(S) application-layer filtering. Network Firewall is best for network-flow inspection and filtering. Shield is about DDoS protection for supported resources.

Outbound security patterns

Outbound control is about what workloads can reach and how that access is monitored.

Do not treat NAT gateway as a security control by itself. NAT changes the path to the internet, but it does not inspect application intent or enforce least privilege.

Inter-VPC and multi-account controls

ANS-C01 expects security architecture to work across accounts and VPCs, not just inside one subnet.

The key exam distinction is routing versus service exposure. Transit Gateway gives routable network domains. PrivateLink exposes a service endpoint without giving consumers broad access to the provider VPC.

Three-tier and perimeter architectures

A professional AWS network security design usually separates tiers and trust zones.

Three-tier architecture is not just “public, private, database.” For ANS-C01, it means controlled trust transitions and route-aware inspection between tiers.

Security groups, NACLs, and endpoint policies

These controls are often confused in answer choices.

Strong answers often combine these layers. For example, a private S3 access pattern may use a gateway endpoint, route table entry, bucket policy, IAM policy, and logging.

Inspection architecture pitfalls

If the prompt includes “centralized inspection,” look for Transit Gateway route tables, Gateway Load Balancer, Network Firewall, route propagation control, and return-path symmetry.

Compliance and automated alerting

Task 4.1 includes compliance testing and automated incident reporting or alerting. The exam usually wants security controls to produce evidence and response, not just enforcement.

Do not over-index on the monitoring service in this page. The architectural point is that security controls need observable outputs and a defined response path.

Common exam traps

Sample exam question

A company has many workload VPCs connected to a Transit Gateway. Security requires all outbound internet traffic from the workload VPCs to pass through a centrally managed inspection layer before reaching NAT gateways. The current design deploys firewall appliances in an inspection VPC, but some workload traffic still exits directly through local NAT gateways. Which change most directly addresses the architecture problem?

• Attach AWS WAF to the workload subnets.
• Update Transit Gateway route tables and VPC subnet route tables so outbound traffic is steered through the inspection VPC before internet egress.
• Replace all security groups with stateless network ACLs.
• Create a public hosted zone for every workload VPC.

Answer: Update the Transit Gateway and VPC route tables so traffic is actually steered through the inspection VPC.

Why: The problem is not the absence of a named firewall service; the problem is traffic bypassing the inspection boundary. Centralized inspection only works when route tables force the intended flows through the inspection path and the return path is compatible with the inspection design.

Fast decision rule

For ANS-C01 security architecture, identify flow direction, trust boundary, enforcement layer, and routing path before choosing a service. WAF protects HTTP(S) application entry points, Shield supports DDoS resilience, Network Firewall and GWLB appliance patterns inspect routed flows, security groups protect workload boundaries, NACLs provide stateless subnet guardrails, and endpoint policies restrict private AWS service access.

Quiz

Continue with 4.2 Security Validation, Monitoring, and Audit to connect these controls to evidence, logging, and compliance validation.