ANS-C01 Tests Hybrid Routing and DNS Design Under Constraints — Not VPC Basics
ANS-C01 is retiring: the last test date is 31 December 2026, and no successor exam has been announced. It suits engineers who design multi-account, hybrid AWS networks and think in BGP, DNS and route tables.
Check Your Readiness →Most candidates understand AWS Certified Advanced Networking - Specialty (ANS-C01) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Long scenarios where several designs work; you rank them on latency, static IPs, transitive routing, resilience and cost. Expect multiple-response items asking for two parts of one design, and precise settings such as appliance mode, VIF types and route propagation.
Route 53 failover routing with health checks
Clients cache DNS answers for the TTL, so DNS failover lags. Global Accelerator gives two static anycast IPs, supports TCP and UDP, and shifts traffic to healthy endpoints within seconds. CloudFront serves HTTP and HTTPS only.
Put a Network Load Balancer in front of the appliance fleet
Gateway Load Balancer encapsulates traffic with GENEVE on port 6081, keeps each flow on the same appliance, and is reached through Gateway Load Balancer endpoints in route tables. An NLB cannot act as a transparent bump in the wire.
Move the instances to a larger instance type
Small packets passing while large ones stall points to an MTU mismatch with ICMP blocked, which breaks path MTU discovery. Align MTU end to end and allow the ICMP 'fragmentation needed' messages.
Peer the VPCs or attach both to a Transit Gateway
Peering and Transit Gateway cannot route between overlapping ranges. Publish the service behind a Network Load Balancer as an AWS PrivateLink endpoint service; consumers reach it through an interface endpoint, so the CIDRs never meet.
Open a support case for a faulty circuit
A private VIF accepts up to 100 prefixes from on premises; exceeding the quota idles the BGP session while the physical link stays up. Summarize the advertised routes back under the quota.
A Direct Connect gateway links on-premises networks to VPCs but never routes VPC to VPC. Associate it with a Transit Gateway over a transit VIF when many VPCs need both hybrid access and inter-VPC routing.
Without appliance mode, return traffic can land in a different Availability Zone than the request, and a stateful firewall drops it. Adding firewall capacity does not help; enable appliance mode on the inspection VPC attachment.
Direct Connect has no encryption by default. Use MACsec on supported dedicated connections for link-layer encryption, or run IPsec Site-to-Site VPN over the connection for end-to-end encryption, accepting lower throughput per tunnel.
Tag advertised prefixes with local preference communities: 7224:7300 is highest preference, 7224:7100 lowest. AWS evaluates local preference before AS_PATH length, so prepending alone loses when the question asks how AWS picks a Direct Connect link.
Resolver forwarding rules cover a domain and its subdomains. When the parent forwards to corporate DNS but one subdomain is a private hosted zone, add a system rule for it. Inbound endpoints serve on-premises clients; outbound endpoints forward from VPCs.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
ANS-C01 retires on 31 December 2026. Check your hybrid routing and DNS readiness before you book.