Overview
Network Design is the biggest domain on ANS-C01 at 30%, with six task statements. They span edge services for global users, public, private and hybrid DNS, load balancing for availability and security, logging and monitoring requirements, hybrid routing between on-premises networks and AWS, and connectivity across many accounts, Regions and VPCs. Questions are long architecture scenarios with several valid-looking designs.
Exam status: AWS is retiring the Advanced Networking Specialty exam, and December 31, 2026 is the last day to sit it. No ANS-C02 or direct successor has been announced. Certifications earned before then stay valid for the standard three years. Candidates who plan to test should book before the cutoff.
How it's tested
Domain 1 items are long scenarios describing an organization, its traffic and its constraints. Several options are technically possible, so you rank them against requirements such as latency, static addressing, transitive routing, resilience and cost. Multiple-response questions often ask for two components of one design.
-
Constraint matching
The scenario hides one deciding requirement, such as UDP, overlapping CIDRs or fixed IPs, that rules out most options.
-
Resiliency design
You choose a Direct Connect, VPN and BGP combination that survives a device, location or Region failure.
-
Scale pattern choice
Account and VPC counts grow, and you pick peering, Transit Gateway, PrivateLink or VPC sharing.
A company has two Direct Connect connections at different locations and wants the first used for all traffic in both directions. For traffic from AWS, it tags routes advertised on the first link with community 7224:7300 and on the second with 7224:7100, which AWS evaluates before AS_PATH length. For traffic toward AWS, it raises local preference on its own routers for routes learned over the first link.
Task statements 6
Official task statements from the Amazon Web Services outline, in outline order.
1.1 Design a solution that incorporates edge network services to optimize user performance and traffic management for global architecturesCloudFront, Global Accelerator and their integration with ELB and API Gateway.
- What it means
- This task statement covers how AWS edge services carry traffic for users spread across the world. You evaluate inbound and outbound internet traffic requirements, then choose CDN patterns with Amazon CloudFront, global traffic management with AWS Global Accelerator, and the way both front Elastic Load Balancing and Amazon API Gateway origins.
- What to understand
- CloudFront caches HTTP and HTTPS content at edge locations and can also accelerate dynamic requests, add Lambda@Edge or CloudFront Functions logic, and restrict origins with origin access control. Global Accelerator gives two static anycast IP addresses, carries TCP or UDP traffic over the AWS backbone, and fails over between Regional endpoints in seconds without DNS caching delays. Choose CloudFront for cacheable web content and HTTP features; choose Global Accelerator for non-HTTP protocols, fixed IP allow lists or fast Regional failover.
- How it shows up
- Scenarios list protocol, need for static IPs, caching potential and failover speed, and ask which edge service fits.
- Common confusion
- Assuming Global Accelerator caches content; it only routes traffic over the AWS network to endpoints.
1.2 Design DNS solutions that meet public, private, and hybrid requirementsRoute 53 hosted zones, routing policies, Resolver endpoints, DNSSEC and domain registration.
- What it means
- This task statement asks you to design name resolution for internet-facing, VPC-internal and hybrid environments. It includes DNS protocol basics such as record types, TTL, delegation and DNSSEC, Route 53 alias records, traffic policies, health checks, Route 53 Resolver, DNS logging, multi-account and multi-Region integration, and domain registration.
- What to understand
- Public hosted zones answer internet queries, while private hosted zones answer only for VPCs associated with them, including VPCs in other accounts through authorization. Resolver inbound endpoints let on-premises servers query Route 53 private zones; outbound endpoints with forwarding rules send VPC queries for corporate domains to on-premises DNS. Rules can be shared through AWS RAM. Alias records point at AWS resources at the zone apex and incur no query charge. Routing policies (latency, weighted, geolocation, geoproximity, failover, multivalue) combine with health checks to steer users.
- How it shows up
- Expect hybrid resolution scenarios where you must pick inbound or outbound endpoints, or choose the right routing policy.
- Common confusion
- Mixing up endpoint direction; inbound endpoints serve queries coming from on premises into AWS.
1.3 Design solutions that integrate load balancing to meet high availability, scalability, and security requirementsChoosing ALB, NLB or Gateway Load Balancer and their integrations and options.
- What it means
- This task statement covers load balancing at Layers 3, 4 and 7, the trade-offs between load balancer types, internal and external patterns, scaling, and integration with Global Accelerator, CloudFront, AWS WAF, Route 53, Amazon EKS and AWS Certificate Manager. It also covers proxy protocol, cross-zone load balancing, sticky sessions, routing algorithms, target group types and TLS termination or passthrough.
- What to understand
- Application Load Balancer works at Layer 7 with path, host and header rules, WAF integration and TLS termination. Network Load Balancer works at Layer 4, preserves client IPs, supports static or Elastic IPs per zone, handles TLS passthrough and suits PrivateLink services. Gateway Load Balancer operates at Layer 3 and uses GENEVE to insert fleets of firewalls or inspection appliances transparently. The AWS Load Balancer Controller provisions ALBs for Kubernetes ingress and NLBs for services in EKS. Proxy protocol v2 passes client details through an NLB when targets cannot see the source address.
- How it shows up
- Questions describe protocol, client IP needs, inspection appliances or certificate handling and ask which balancer and setting apply.
- Common confusion
- Choosing ALB for end-to-end encryption to targets that must see the client certificate; NLB TLS passthrough fits that.
1.4 Define logging and monitoring requirements across AWS and hybrid networksDeciding which metrics, logs and tools show network health and baselines.
- What it means
- This task statement covers selecting the telemetry a network design needs before anything breaks. It includes Amazon CloudWatch metrics, agents, logs, alarms, dashboards and Logs Insights, Transit Gateway Network Manager, VPC Reachability Analyzer, VPC Flow Logs, Traffic Mirroring, and access logs for load balancers and CloudFront.
- What to understand
- Flow Logs record accepted and rejected IP flow metadata at VPC, subnet or interface level but never packet payloads. Traffic Mirroring copies full packets from an ENI to an inspection target for deep analysis. Reachability Analyzer checks configuration paths between two resources without sending traffic. Network Manager gives a global view of transit gateways, Cloud WAN and on-premises sites, including events and route analysis. Direct Connect and VPN publish CloudWatch metrics such as connection state, tunnel state and bit rates, which you baseline and alarm on.
- How it shows up
- You are given a visibility goal, such as payload inspection or path verification, and pick the matching tool.
- Common confusion
- Expecting Flow Logs to show packet contents; payload analysis requires Traffic Mirroring.
1.5 Design a routing strategy and connectivity architecture between on-premises networks and the AWS CloudDirect Connect, Site-to-Site VPN, BGP traffic engineering and SD-WAN integration.
- What it means
- This task statement covers hybrid connectivity design: static versus dynamic routing, BGP, Layer 1 and 2 details such as VLANs, link aggregation groups, optics and jumbo frames, GRE and IPsec, overlay networks and cross-account resource sharing. You design redundant links with AWS Direct Connect and Site-to-Site VPN and integrate SD-WAN through Transit Gateway Connect.
- What to understand
- Direct Connect offers private, public and transit virtual interfaces; a Direct Connect gateway reaches VPCs or transit gateways in many Regions. Maximum resiliency uses separate connections at separate locations. AWS picks its path toward your network by longest prefix first, then local preference communities (7224:7100, 7200, 7300), then AS_PATH length; your own routers choose the path toward AWS, usually with local preference. VPN can serve as a backup over the internet, and accelerated VPN uses Global Accelerator. Transit Gateway Connect uses GRE tunnels with BGP for SD-WAN appliances.
- How it shows up
- Expect active/passive or load-sharing designs where you choose the BGP attribute, VIF type or redundancy model.
- Common confusion
- Thinking prepending on routes sent to AWS changes the path your routers use toward AWS; it only shapes return traffic.
1.6 Design a routing strategy and connectivity architecture that include multiple AWS accounts, Regions, and VPCs to support different connectivity patternsVPC peering, Transit Gateway, PrivateLink, VPC sharing and overlapping CIDRs.
- What it means
- This task statement covers connecting many VPCs across accounts and Regions with the most suitable service. It includes VPC peering, AWS Transit Gateway, AWS PrivateLink, VPC sharing through AWS Resource Access Manager, IP subnetting, and techniques for dealing with overlapping address ranges.
- What to understand
- VPC peering is non-transitive and has no bandwidth bottleneck, which suits a few high-throughput pairs. Transit Gateway gives a hub with route tables for segmentation, inter-Region peering and attachment of VPN and Direct Connect, at a per-attachment and per-GB cost. PrivateLink exposes a single service through an NLB or interface endpoint and works even when CIDRs overlap. VPC sharing lets several accounts place resources in subnets owned by a central account, cutting the number of VPCs. Private NAT gateways can translate overlapping ranges toward routable space.
- How it shows up
- Scenarios give account counts, overlap, transitive routing needs and cost limits, and ask which pattern scales.
- Common confusion
- Thinking peering supports transit through a middle VPC; peering never routes traffic onward.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
CloudFront vs. Global Accelerator
Edge caching CDN versus anycast routing over the AWS backbone.
- Remember
- Only CloudFront caches; Global Accelerator gives two static IPs.
- Tested as
- Edge service selection in 1.1.
- Trap
- Picking CloudFront for a UDP gaming workload.
-
Route 53 Resolver endpoints
Inbound and outbound ENIs that bridge VPC DNS and on-premises DNS.
- Remember
- Inbound answers on-premises queries; outbound forwards VPC queries.
- Tested as
- Hybrid DNS design.
- Trap
- Reversing the direction of the endpoints.
-
Private hosted zone association
Links a private zone to VPCs, including across accounts.
- Remember
- Cross-account association needs owner authorization, or a Route 53 Profile shared through RAM.
- Tested as
- Multi-account DNS.
- Trap
- Expecting a zone to answer before any VPC is associated.
-
Gateway Load Balancer
Layer 3 load balancer that sends traffic to appliances using GENEVE.
- Remember
- Paired with GWLB endpoints in route tables.
- Tested as
- Inline inspection designs.
- Trap
- Choosing NLB to insert third-party firewalls.
-
NLB TLS passthrough
TCP listener that forwards encrypted traffic unchanged to targets.
- Remember
- Targets terminate TLS and keep end-to-end encryption.
- Tested as
- Compliance-driven load balancing.
- Trap
- Assuming ALB can pass TLS through.
-
Direct Connect virtual interfaces
Private VIF to a VPC or DX gateway, public VIF to AWS public endpoints, transit VIF to a transit gateway.
- Remember
- Transit VIFs connect through a Direct Connect gateway to transit gateways.
- Tested as
- Hybrid architecture choices.
- Trap
- Using a public VIF to reach private VPC addresses.
-
BGP local preference communities
Tags 7224:7100, 7224:7200 and 7224:7300 set AWS outbound preference.
- Remember
- Higher number means higher preference.
- Tested as
- Active/passive Direct Connect.
- Trap
- Using prepending for traffic leaving AWS.
-
Direct Connect resiliency models
Development, high and maximum resiliency recommendations.
- Remember
- Maximum resiliency uses two devices at each of two locations.
- Tested as
- Redundancy design.
- Trap
- Treating a second VIF on one connection as redundancy.
-
Transit Gateway route tables
Separate tables with associations and propagations segment attachments.
- Remember
- Segmentation is done with association and propagation choices.
- Tested as
- Multi-VPC isolation.
- Trap
- Expecting security groups to segment TGW routing.
-
VPC peering limits
One-to-one, non-transitive, no overlapping CIDRs.
- Remember
- Edge-to-edge routing through a peer is not supported.
- Tested as
- Pattern selection.
- Trap
- Designing a hub VPC that forwards peered traffic.
-
PrivateLink
Interface endpoint that exposes one NLB-fronted service to consumers.
- Remember
- Works across accounts with overlapping CIDRs.
- Tested as
- Service-specific connectivity.
- Trap
- Using it for full network-level routing.
-
Transit Gateway Connect
GRE plus BGP attachment for SD-WAN appliances.
- Remember
- Built over a VPC or Direct Connect transport attachment.
- Tested as
- SD-WAN integration.
- Trap
- Assuming it replaces the transport attachment.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Edge and load balancing services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| CloudFront | Global CDN with edge caching | HTTP/HTTPS, caching and edge logic | Expecting static IPs |
| Global Accelerator | Anycast entry over the AWS backbone | Two static IPs, TCP/UDP, fast failover | Assuming it caches |
| Application Load Balancer | Layer 7 Regional balancer | Content-based routing, WAF | Expecting client IP preservation at Layer 4 |
| Network Load Balancer | Layer 4 Regional balancer | Static IPs per zone, TLS passthrough | Expecting path-based rules |
| Gateway Load Balancer | Layer 3 appliance balancer | GENEVE to inspection fleets | Using it for web traffic routing |
Multi-VPC connectivity
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| VPC peering | Direct one-to-one VPC link | Non-transitive, no data processing charge within an AZ | Building transit through it |
| Transit Gateway | Regional routing hub | Transitive with route table segmentation | Ignoring per-GB processing cost |
| PrivateLink | Service endpoint exposure | Overlapping CIDRs allowed, one service only | Using it for bidirectional networks |
| VPC sharing | Subnets shared across accounts through RAM | Fewer VPCs, central network ownership | Thinking participants can modify the VPC |
Hybrid connectivity
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Direct Connect | Dedicated or hosted private circuit | Consistent latency, no encryption by default | Assuming built-in encryption |
| Site-to-Site VPN | IPsec tunnels over the internet | Quick to deploy, encrypted | Expecting more than about 1.25 Gbps per standard tunnel |
| Transit Gateway Connect | GRE and BGP for SD-WAN | Higher bandwidth per Connect peer | Skipping the transport attachment |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Fast Regional failover
- What candidates pick
- Route 53 failover routing
- Why it looks right
- It is the familiar failover mechanism.
- Why it's wrong
- DNS answers are cached by clients for the TTL, so failover can lag; Global Accelerator shifts traffic to healthy endpoints within seconds behind fixed IPs.
Clue to watch for Static IPs or sub-minute failover are required.
-
Inline firewall fleet
- What candidates pick
- Network Load Balancer in front of appliances
- Why it looks right
- NLB handles Layer 4 at high scale.
- Why it's wrong
- NLB changes the destination and cannot transparently return flows symmetrically through appliances; Gateway Load Balancer with GENEVE keeps flow symmetry.
Clue to watch for Third-party virtual appliances must inspect all traffic.
-
Return path preference
- What candidates pick
- AS_PATH prepending on the backup link
- Why it looks right
- Prepending is the standard BGP lever.
- Why it's wrong
- Prepending influences how AWS reaches your prefixes only when communities are absent; local preference communities override it for traffic leaving AWS.
Clue to watch for The question asks how AWS chooses between two Direct Connect links.
-
Overlapping CIDRs
- What candidates pick
- VPC peering or Transit Gateway
- Why it looks right
- They connect VPCs directly.
- Why it's wrong
- Neither routes between identical address ranges; PrivateLink or private NAT translation is needed.
Clue to watch for Acquired company VPCs use the same 10.0.0.0/16.
-
Payload visibility
- What candidates pick
- VPC Flow Logs
- Why it looks right
- They are the default network log.
- Why it's wrong
- Flow Logs capture metadata only, never packet contents.
Clue to watch for Security team needs full packet capture for IDS.
-
Hybrid DNS for on premises
- What candidates pick
- Outbound Resolver endpoint
- Why it looks right
- Outbound sounds like reaching on premises.
- Why it's wrong
- On-premises clients resolving private zones need an inbound endpoint as the forwarding target.
Clue to watch for Corporate DNS servers must resolve names in a private hosted zone.
Answer framework
Use these steps to pick a design when a Domain 1 scenario lists traffic, scale and resiliency requirements.
- Identify who generates the traffic and where: global internet users, on-premises sites, or workloads in other VPCs, accounts or Regions.
- Classify the protocol and layer, because HTTP features point to CloudFront or ALB while TCP, UDP or static IP needs point to NLB or Global Accelerator.
- Count VPCs and check for overlapping CIDRs and transitive routing needs before choosing peering, Transit Gateway, PrivateLink or VPC sharing.
- For hybrid links, size bandwidth, decide on encryption and set the resiliency model, then choose BGP attributes for active/passive or load sharing.
- Finish by naming the DNS design and the logs and metrics that will prove the network works, including baselines and alarms.
Practice question
Want more like this? The ANS-C01 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Network Design is the largest share of ANS-C01, so give it the most time and study it first. Draw each pattern instead of only reading about it: a Direct Connect layout with two locations, a hub-and-spoke Transit Gateway with separate route tables, and a hybrid DNS flow showing which Resolver endpoint handles which query. Label every hop with the service, the route table entry and the BGP attribute that applies.
Next, build comparison tables for the edge and load balancing services and for the multi-VPC options. For each row, write the deciding requirement, such as static IPs, UDP, client IP preservation, overlapping CIDRs or transitive routing. Most Domain 1 items turn on one of those requirements hidden in a long scenario.
Use a lab account to create a private hosted zone shared with a second VPC, an NLB with TLS passthrough and a Reachability Analyzer path. Then read the Direct Connect resiliency recommendations and the BGP community documentation closely, because traffic engineering questions punish vague recall. Close with timed scenario sets and review every wrong answer against your diagrams.
FAQ
How much of ANS-C01 is Network Design?
Domain 1, Network Design, is 30% of scored content, the largest of the four domains, and it has six task statements. That is roughly 15 of the 50 scored questions.
Is the ANS-C01 exam still available?
AWS has announced that the exam is being retired. The last day to take it is December 31, 2026, and no new Advanced Networking Specialty certifications will be issued afterward. No ANS-C02 has been announced.
How deep does Domain 1 go on BGP?
Deep enough to choose attributes. Know how AS_PATH prepending, more specific prefixes, MED and the AWS local preference communities shape inbound and outbound paths on Direct Connect and VPN.
Do I need to memorize CloudFront features?
Know the design-level features: caching behaviors, origin access control, origin failover, edge functions, field-level encryption and integration with WAF and ACM. Console steps are not the focus.
Which multi-VPC topics come up most?
Choosing among VPC peering, Transit Gateway, PrivateLink and VPC sharing, plus handling overlapping CIDRs. Scenarios usually hinge on scale, transitive routing, cost or address overlap.
Why is logging part of a design domain?
Task statement 1.4 expects you to plan telemetry up front: which metrics prove health, which logs support troubleshooting, and how to capture a performance baseline before production traffic arrives.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have reviewed edge services, DNS design, load balancing, monitoring requirements, hybrid routing and multi-VPC patterns. Check how quickly you can pick the design that meets every constraint.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the ANS-C01 AI tutor Get any concept explained your way