Skip to main content
CloudCertPrep
Start Practicing

ANS-C01 Exam Guide: Format, Cost, Domains, and How to Prepare

8 min read · Updated 2026-10-27

The AWS Certified Advanced Networking – Specialty (ANS-C01) validates deep networking expertise — hybrid connectivity, large-scale VPC design, DNS, and network security. It's the most specialized associate-adjacent AWS exam and pairs naturally with Solutions Architect Professional knowledge.

Note: AWS has announced ANS-C01 retires on December 31, 2026 — if you're planning to take it, schedule accordingly.

Exam format at a glance

  • 65 questions — scenario-heavy multiple choice and multiple response
  • 170 minutes — about 2.6 minutes per question
  • $300 USD
  • Passing score: 750 on a scaled range of 100–1000
  • Pearson VUE testing center or online proctored exam

The four domains

  • Domain 1: Network Design — 30% (the largest — VPC design, hybrid architectures, edge/global design)
  • Domain 2: Network Implementation — 26% (routing, Transit Gateway, Direct Connect, VPN, DNS)
  • Domain 3: Network Management and Operations — 20% (monitoring, troubleshooting, automation)
  • Domain 4: Network Security, Compliance, and Governance — 24% (firewalls, inspection, PrivateLink, TLS)

What the exam actually tests

ANS-C01 is unforgiving about connectivity details: Transit Gateway routing tables and attachments, Direct Connect (dedicated vs hosted, public vs private VIF, BGP), Site-to-Site VPN redundancy, Route 53 Resolver inbound/outbound endpoints for hybrid DNS, and when PrivateLink beats peering (overlapping CIDRs, unidirectional exposure).

Operations questions focus on diagnosis: Reachability Analyzer, VPC Flow Logs analysis, and Network Firewall vs security groups vs NACLs for layered defense.

A realistic prep plan

Budget 8–10 weeks. Hybrid connectivity (DX + VPN + TGW interactions) is where most candidates lose points — lab it if possible: build two VPCs, a TGW, resolver endpoints, and break the routing on purpose.

  • Weeks 1–2: Domain 1 — VPC design at scale, multi-account networking, global/edge architecture
  • Weeks 3–4: Domain 2 — TGW routing, DX VIFs/LAG, VPN, BGP, Route 53 resolver endpoints, PrivateLink
  • Week 5: Domain 3 — Reachability Analyzer, Flow Logs, CloudWatch network metrics, automation
  • Week 6: Domain 4 — Network Firewall, TLS inspection, WAF at the edge, governance
  • Final weeks: timed scenario sets — practice tracing traffic hop by hop

Official references