Overview
Network Implementation carries 26% of ANS-C01 and has four task statements. The first configures routing and connectivity between on-premises networks and AWS. The second configures connectivity across multiple accounts, Regions and VPCs. The third builds complex hybrid and multi-account DNS, and the fourth automates network infrastructure with code and events.
Questions here are concrete. They show a network that is almost working and ask which route, attachment setting, DNS rule or template change completes it. You need to know the order of operations and the default behavior of each component, such as which routes propagate, which attachments support BGP and which settings are off until enabled.
How it's tested
Domain 2 questions describe a build in progress or a failed connection and ask what configuration step is missing or which sequence is correct. Expect specific settings, such as VIF types, propagation, appliance mode, forwarding rules and template functions, rather than broad architecture choices.
-
Find the missing setting
Routes or names fail to resolve, and you identify the absent association, propagation, rule or record.
-
Order the build
You pick the correct sequence for provisioning Direct Connect, VPN, DNS or shared resources across accounts.
-
Make it repeatable
A manual process must scale to many accounts, and you choose IaC, StackSets, IPAM or event-driven automation.
A spoke VPC attached to a shared transit gateway cannot reach a shared services VPC. The TGW route tables are correct. The next check is the spoke VPC's own route table: it needs a route sending the shared services CIDR to the transit gateway. Attachments do not add routes inside VPC route tables, so that entry must be created or managed by template.
Task statements 4
Official task statements from the Amazon Web Services outline, in outline order.
2.1 Implement routing and connectivity between on-premises networks and the AWS CloudBuilding Direct Connect, VPN, routing and name resolution for hybrid links.
- What it means
- This task statement covers configuring hybrid connectivity end to end. It includes static and dynamic routing, VPNs including accelerated VPN, Layer 1 work such as letters of authorization and colocation for Direct Connect, Layer 2 and 3 settings, SD-WAN, on-premises name resolution, load balancing, monitoring, AWS Organizations and AWS RAM, and connectivity testing.
- What to understand
- A dedicated Direct Connect order produces a LOA-CFA that the colocation provider uses to run the cross-connect; hosted connections come through partners. Each virtual interface needs a VLAN, BGP ASN, peer IPs and an MD5 key or default settings. A private VIF can end on a virtual private gateway or a Direct Connect gateway, while a transit VIF must use a Direct Connect gateway associated with transit gateways. Site-to-Site VPN gives two tunnels per connection with BGP or static routes, and route propagation must be enabled on VPC route tables when using a virtual private gateway.
- How it shows up
- Expect configuration steps for VIFs, VPN tunnels, route propagation and testing, often with a missing piece to identify.
- Common confusion
- Expecting a VPC route table to learn VGW routes automatically; route propagation must be turned on.
2.2 Implement routing and connectivity across multiple AWS accounts, Regions, and VPCs to support different connectivity patternsConfiguring hub-and-spoke, peering, PrivateLink, third-party SD-WAN and inter-boundary security.
- What it means
- This task statement covers putting multi-VPC and multi-account designs into service. It includes VPC peering, Transit Gateway, VPN and third-party or SD-WAN appliances, MPLS integration, PrivateLink, Organizations and RAM sharing, name resolution between accounts, authentication with SAML or Active Directory, security groups, network ACLs, AWS Network Firewall and connectivity testing.
- What to understand
- Transit gateways are shared to other accounts through RAM, and each VPC attachment needs a subnet per Availability Zone. Route tables in the VPC must point remote CIDRs at the transit gateway, and the TGW route table must hold an association and either propagated or static routes for each attachment. Inter-Region transit gateway peering uses static routes only. Appliance mode keeps flows symmetric through inspection VPCs. AWS Cloud WAN offers a policy-driven global core network as an alternative for many Regions. Interface endpoints and endpoint services need security groups and acceptance settings.
- How it shows up
- Questions present a partially built hub-and-spoke and ask what configuration completes routing or isolation.
- Common confusion
- Expecting transit gateway peering to propagate routes dynamically; peering attachments need static routes.
2.3 Implement complex hybrid and multi-account DNS architecturesZones, forwarding rules, DNSSEC, record types and Resolver endpoints in practice.
- What it means
- This task statement covers configuring Route 53 for hybrid and multi-account estates. It includes choosing public or private hosted zones, traffic management by latency, geography or weight, delegation and conditional forwarding, record types such as A, AAAA, TXT, PTR and alias, DNSSEC signing, sharing DNS through RAM, inbound and outbound Resolver endpoints, and DNS monitoring and logging.
- What to understand
- A centralized pattern puts Resolver endpoints in a shared services VPC and shares forwarding rules with spoke accounts through RAM, or bundles zones and rules into a Route 53 Profile. Forwarding rules send matching domains to target IPs; system rules override forwarding for subdomains that should resolve locally. DNSSEC signing in Route 53 uses a KMS asymmetric key in us-east-1 as the key-signing key, and you must add the DS record at the parent. Resolver query logging writes to CloudWatch Logs, S3 or Firehose. Delegating a subdomain requires NS records in the parent zone.
- How it shows up
- You get a resolution failure or a new account to onboard and choose the rule, association or record that fixes it.
- Common confusion
- Thinking DNSSEC signing works without placing the DS record in the parent zone.
2.4 Automate and configure network infrastructureInfrastructure as code and event-driven automation for networks.
- What it means
- This task statement covers building network resources repeatably with AWS CloudFormation, AWS CDK, the AWS CLI, SDKs and APIs. It also covers event-driven network functions, integrating hybrid automation with native IaC, and avoiding problems caused by hardcoded values when provisioning networking resources.
- What to understand
- Hardcoded CIDRs, AMI IDs, account IDs and Availability Zone names break templates when they are reused across Regions or accounts. Use parameters, mappings, SSM Parameter Store references, Fn::GetAZs and Fn::Cidr instead, and use Amazon VPC IP Address Manager pools to allocate non-overlapping CIDRs automatically. StackSets deploy baselines across an organization. Event-driven automation uses EventBridge rules on events such as a new transit gateway attachment or a Network Firewall alert to invoke Lambda or Systems Manager Automation. Custom resources let CloudFormation call APIs it does not support natively.
- How it shows up
- Expect questions about making templates portable, deploying across accounts or reacting to network events automatically.
- Common confusion
- Treating StackSets as a way to share one VPC; they deploy copies of resources into each target.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
LOA-CFA
Letter of Authorization and Connecting Facility Assignment for a dedicated Direct Connect port.
- Remember
- Given to the colocation provider to run the cross-connect.
- Tested as
- Physical setup steps.
- Trap
- Expecting AWS to install the cross-connect.
-
Route propagation
Lets a VPC route table learn routes from a virtual private gateway.
- Remember
- Must be enabled per route table.
- Tested as
- Missing route troubleshooting.
- Trap
- Assuming propagation is on by default.
-
Direct Connect gateway
Global object that links VIFs to VGWs or TGWs in many Regions.
- Remember
- Does not route traffic between attached VPCs.
- Tested as
- Multi-Region hybrid builds.
- Trap
- Using it as a transit hub between VPCs.
-
Transit gateway association vs. propagation
Association picks the table an attachment uses; propagation adds its routes to tables.
- Remember
- One association per attachment, many propagations.
- Tested as
- Segmentation configuration.
- Trap
- Confusing which table controls return traffic.
-
Appliance mode
Transit gateway attachment setting that keeps both flow directions in one AZ.
- Remember
- Required for stateful inspection VPCs.
- Tested as
- Centralized firewall builds.
- Trap
- Leaving it off and seeing asymmetric drops.
-
Inter-Region TGW peering
Connects transit gateways across Regions.
- Remember
- Static routes only, encrypted on the backbone.
- Tested as
- Global hub designs.
- Trap
- Expecting BGP propagation over peering.
-
AWS Cloud WAN
Managed global network built from a core network policy.
- Remember
- Segments and attachments defined in policy.
- Tested as
- Large multi-Region estates.
- Trap
- Assuming it removes the need for attachments.
-
Route 53 Profiles
Bundle of private zones, Resolver rules and DNS Firewall settings shared through RAM.
- Remember
- Applies DNS configuration to many VPCs at once.
- Tested as
- Multi-account DNS operations.
- Trap
- Associating zones one VPC at a time at scale.
-
DNSSEC signing
Route 53 signs zones using a KMS-backed key-signing key.
- Remember
- KMS key must be in us-east-1; DS record goes in parent.
- Tested as
- Secure DNS setup.
- Trap
- Forgetting the chain of trust step.
-
VPC IPAM
Plans, allocates and audits IP addresses across accounts and Regions.
- Remember
- Pools prevent overlapping CIDR allocation.
- Tested as
- Automation at scale.
- Trap
- Tracking CIDRs in spreadsheets.
-
Fn::Cidr and Fn::GetAZs
CloudFormation functions that compute subnets and list zones.
- Remember
- Remove hardcoded addresses and zone names.
- Tested as
- Portable templates.
- Trap
- Hardcoding us-east-1a in shared templates.
-
EventBridge network automation
Rules react to network events and trigger Lambda or SSM.
- Remember
- Supports auto-remediation and approvals.
- Tested as
- Event-driven tasks.
- Trap
- Polling APIs on a schedule instead.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Direct Connect termination points
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Virtual private gateway | Private VIF to one VPC | Simple, one VPC per VIF | Planning for dozens of VPCs this way |
| Direct Connect gateway with VGWs | Private VIF to many VPCs across Regions | No transitive routing between VPCs | Expecting VPC-to-VPC traffic through it |
| Direct Connect gateway with TGW | Transit VIF to transit gateways | Scales to many VPCs with TGW routing | Using a private VIF for this |
Automation tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| CloudFormation | Declarative templates and stacks | Native, drift detection | Hardcoding Region values |
| AWS CDK | Code that synthesizes CloudFormation | Loops and abstractions in a language | Thinking it bypasses CloudFormation |
| StackSets | Deploy stacks to many accounts and Regions | Organization-wide baselines | Expecting shared single resources |
| EventBridge with Lambda | Event-driven actions | Reacts to changes as they happen | Using it for initial provisioning |
DNS sharing methods
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Cross-account PHZ association | Authorize then associate a VPC | Per VPC, CLI or API only | Expecting console-only setup |
| RAM-shared Resolver rules | Forwarding rules used by other accounts | Centralized endpoints | Forgetting to associate rules to VPCs |
| Route 53 Profiles | Shared bundle of DNS settings | One association per VPC | Thinking it replaces Resolver endpoints |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
VPC-to-VPC via DX gateway
- What candidates pick
- Route VPC traffic through the Direct Connect gateway
- Why it looks right
- It already connects all the VPCs.
- Why it's wrong
- A Direct Connect gateway does not forward traffic between associated VPCs or between VGWs; use Transit Gateway or peering.
Clue to watch for Two VPCs on the same DX gateway cannot reach each other.
-
Peering propagation
- What candidates pick
- Enable propagation on the TGW peering attachment
- Why it looks right
- Propagation works for VPC and VPN attachments.
- Why it's wrong
- Transit gateway peering attachments support only static routes in TGW route tables.
Clue to watch for Inter-Region hub with routes missing on one side.
-
Asymmetric inspection
- What candidates pick
- Add more firewall capacity
- Why it looks right
- Drops look like overload.
- Why it's wrong
- Without appliance mode, return traffic can enter a different AZ's firewall, which drops it as an unknown flow.
Clue to watch for Stateful firewall in a centralized inspection VPC drops some return packets.
-
Subdomain resolves wrongly
- What candidates pick
- Add another forwarding rule
- Why it looks right
- Forwarding rules control most hybrid resolution.
- Why it's wrong
- A system rule is needed to keep a subdomain resolving inside AWS when a parent domain forwards to on premises.
Clue to watch for Parent domain forwards on premises but one subdomain is hosted in Route 53.
-
Portable templates
- What candidates pick
- Copy the template and edit values per account
- Why it looks right
- It is fast for one or two accounts.
- Why it's wrong
- Manual edits create drift and errors; parameters, mappings, IPAM and StackSets keep deployments consistent.
Clue to watch for Dozens of accounts need the same network baseline.
-
VPN throughput
- What candidates pick
- Add a second VPN connection on a virtual private gateway
- Why it looks right
- More tunnels sound like more bandwidth.
- Why it's wrong
- VGW does not support ECMP across VPN connections; Transit Gateway with ECMP aggregates tunnel bandwidth.
Clue to watch for Need more than one tunnel's throughput over VPN.
Answer framework
Apply these steps when a Domain 2 question shows a partly configured network that does not yet work.
- Trace the path hop by hop from source to destination in both directions, naming each gateway, attachment, VIF and route table involved along the way.
- Check that every route table on the path has a route for the remote prefix, through propagation, static entry or BGP advertisement.
- Confirm attachment settings such as TGW associations, appliance mode, VIF type and the Direct Connect gateway allowed prefixes.
- Verify name resolution: zone associations, Resolver rules, endpoint direction and security groups that allow DNS on port 53.
- Prefer the fix that is repeatable, such as a template parameter, IPAM pool or EventBridge rule, over a one-off console change.
Practice question
Want more like this? The ANS-C01 practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Network Implementation rewards hands-on practice more than any other domain. Set up a lab with two accounts in an organization, share a transit gateway through RAM, attach VPCs from both accounts and build separate route tables for production and development. Add a Site-to-Site VPN to a software router in another VPC to simulate on premises, run BGP and watch propagated routes appear.
Next, practice the DNS side: create inbound and outbound Resolver endpoints, a forwarding rule for a test corporate domain and a system rule for one subdomain, then share them with the second account. Enable query logging and confirm which queries take which path. Turn on DNSSEC signing for a test public zone if you own a domain.
Finally, rebuild the same lab from CloudFormation or CDK with no hardcoded addresses, using an IPAM pool, and add one EventBridge rule that reacts to a new attachment. Direct Connect cannot be practiced cheaply, so study the ordering, LOA-CFA and VIF steps from documentation and walk through them in writing.
FAQ
What share of ANS-C01 does Network Implementation cover?
Network Implementation is Domain 2 and carries 26% of scored content across four task statements, about 13 of the 50 scored questions.
Can I practice Direct Connect without a physical circuit?
Not fully. You can study the ordering flow, LOA-CFA, VIF parameters and Direct Connect gateway associations in documentation, and simulate BGP behavior with a Site-to-Site VPN to a software router.
Which IaC tools are named in the guide?
CloudFormation, AWS CDK, the AWS CLI, SDKs and APIs. Expect questions on portable templates and event-driven automation rather than syntax details.
Does Domain 2 cover AWS Cloud WAN?
The guide lists Transit Gateway, VPN, SD-WAN and third-party solutions for multi-account connectivity. Cloud WAN is a current AWS service in that space, so know when its policy-based core network fits.
Why do so many questions involve route propagation?
Missing routes are the most common reason a newly built hybrid or multi-VPC network fails, so implementation questions often ask which table, attachment or advertisement is missing.
How is DNS different here from Domain 1?
Domain 1 asks which DNS design fits. Domain 2 asks how to configure it: rules, associations, record types, DNSSEC signing, sharing and query logging.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have reviewed hybrid builds, multi-account routing, DNS configuration and network automation. See whether you can spot the missing configuration step under time pressure.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the ANS-C01 AI tutor Get any concept explained your way