ANS-C01 · Domain 3 of 4

ANS-C01 Domain 3: Network Management and Operation

Domain 3 covers running AWS networks after launch: maintaining BGP and route tables within quotas, troubleshooting with Flow Logs and Reachability Analyzer, fixing MTU problems and tuning for throughput, availability and cost.

Exam weight
20%
Official task statements
3
Estimated questions estimate
~10
Suggested study time estimate
15–20 hrs

About 11 min read Reviewed October 2026

Overview

Network Management and Operation is 20% of ANS-C01 and has three task statements. The first maintains routing and connectivity on AWS and hybrid networks, including quotas, propagation, summarization and private service access. The second monitors and analyzes traffic to troubleshoot problems with CloudWatch, Flow Logs, Traffic Mirroring, Reachability Analyzer and Transit Gateway Network Manager.

The third optimizes networks for performance, reliability and cost: interface types, jumbo frames, multicast, Route 53 health-checked routing, subnet growth, Global Accelerator and connectivity pricing. Items usually start from a symptom, a log excerpt or an operational goal rather than a blank design, so practice reading evidence before choosing a fix.

How it's tested

Domain 3 scenarios start with something observed: an alert, a log entry, a slow transfer or a cost spike. You choose the diagnostic tool, interpret the evidence or pick the change that fixes the problem with the least disruption and expense.

  • Symptom to cause

    You map evidence such as rejected returns or idle BGP to the misconfiguration or quota behind it.

  • Right tool first

    You choose among Reachability Analyzer, Flow Logs, Traffic Mirroring and Network Manager for a given question.

  • Tune for a metric

    You improve throughput, availability or cost with a targeted change rather than a redesign.

Reasoning it through

Flow Logs show outbound traffic from an instance accepted and the replies rejected on ports 49152 to 65535. Security groups are stateful, so an allowed request automatically permits its reply. That points to a network ACL on the subnet that lacks an inbound rule for ephemeral ports. Adding that rule fixes it without touching the security group or the route tables.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

3.1 Maintain routing and connectivity on AWS and hybrid networksKeeping BGP, route tables, quotas and private service access healthy over time.
What it means
This task statement covers day-to-day upkeep of routing in hybrid and multi-VPC networks. It includes BGP over Direct Connect, Direct Connect gateways, Transit Gateway and VIFs, the effect of quotas such as bandwidth and route limits, private and public access to custom services through PrivateLink or peering, intra-Region and inter-Region patterns, route propagation, route summarization and CIDR overlap.
What to understand
Route quotas are a common hidden cause of outages: a private or transit VIF accepts a limited number of prefixes from on premises (100 by default) and the BGP session goes idle if you exceed it, so summarize routes before advertising. Transit VIF advertisements from AWS to on premises are also limited per Direct Connect gateway association. VPC route tables have a default entry quota that can be raised at some performance cost. Customer-managed prefix lists keep route and security group entries consistent. When CIDRs grow, add secondary CIDRs and update advertisements.
How it shows up
Expect symptoms such as a BGP session flapping or routes disappearing, and pick the quota or summarization fix.
Common confusion
Assuming a dropped BGP session means a physical fault; exceeding the prefix limit also idles it.
3.2 Monitor and analyze network traffic to troubleshoot and optimize connectivity patternsUsing Flow Logs, Traffic Mirroring, Reachability Analyzer and Network Manager to find faults.
What it means
This task statement covers finding and fixing connectivity and performance problems. It includes performance metrics and reachability constraints such as routing and packet size, logs and metrics for packet loss, CloudWatch, VPC Flow Logs, VPC Traffic Mirroring, Reachability Analyzer and Transit Gateway Network Manager, and troubleshooting MTU mismatches inside a VPC.
What to understand
Start with Reachability Analyzer to test whether the configuration allows a path; it names the blocking component, such as a security group or missing route. Use Flow Logs to see whether packets arrived and were accepted or rejected, remembering that security groups are stateful and network ACLs are not. Network Access Analyzer finds unintended access paths across many resources. Traffic Mirroring captures packets for tools like Wireshark when you suspect fragmentation or shaping. MTU problems show up when large packets drop but small ones pass, often because ICMP fragmentation-needed messages are blocked.
How it shows up
Questions give symptoms and logs and ask which tool or log field identifies the cause fastest.
Common confusion
Reading a REJECT on return traffic as a security group fault; stateless network ACLs usually cause it.
3.3 Optimize AWS networks for performance, reliability, and cost-effectivenessThroughput, interface types, connectivity cost, Route 53 availability, multicast and frame size.
What it means
This task statement covers tuning a working network. It includes choosing peering or a transit gateway, reducing bandwidth with multicast or CloudFront, cost-effective hybrid data transfer, interface types such as ENI, ENA and EFA, Route 53 health-checked routing, subnet sizing and secondary CIDRs, jumbo frame support across connection types, and Global Accelerator for performance.
What to understand
Jumbo frames (9001 MTU) work within a VPC and over Direct Connect private VIFs, which support up to 9001 on a VGW and 8500 on transit VIFs; traffic over the internet, VPN and inter-Region peering uses 1500 or less. Cluster placement groups with ENA give the lowest latency, and EFA adds OS-bypass for HPC. Peering avoids the Transit Gateway processing charge for heavy pairs. Direct Connect data transfer out is cheaper than internet egress. Transit Gateway multicast supports IGMP or static groups. Secondary CIDRs fix subnet exhaustion.
How it shows up
You weigh cost, throughput and availability and choose the change that improves the stated metric.
Common confusion
Expecting jumbo frames to pass over a Site-to-Site VPN; tunnel overhead limits MTU well below that.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Direct Connect prefix limit

    On-premises advertisements over a private or transit VIF are capped (100 by default).

    Remember
    Exceeding it idles the BGP session.
    Tested as
    Route maintenance.
    Trap
    Advertising every /24 instead of summarizing.

  • Customer-managed prefix lists

    Named sets of CIDRs referenced in routes and security groups.

    Remember
    Shareable through RAM; each entry counts toward quotas.
    Tested as
    Consistent route upkeep.
    Trap
    Ignoring the max entries weight on quotas.

  • Reachability Analyzer

    Static analysis of a path between two resources.

    Remember
    Names the blocking component without sending packets.
    Tested as
    First troubleshooting step.
    Trap
    Expecting it to measure latency.

  • Network Access Analyzer

    Finds network paths that match defined access scopes.

    Remember
    Identifies unintended internet or cross-segment access.
    Tested as
    Audit and troubleshooting.
    Trap
    Confusing it with Reachability Analyzer's single-path test.

  • Flow Log record fields

    Default and custom fields such as action, tcp-flags, pkt-srcaddr and flow-direction.

    Remember
    Custom fields reveal NAT and TGW details.
    Tested as
    Log analysis.
    Trap
    Using default fields to find original source behind NAT.

  • Path MTU discovery

    Senders learn the smallest MTU from ICMP messages.

    Remember
    Blocked ICMP breaks it and drops large packets.
    Tested as
    Packet size troubleshooting.
    Trap
    Opening only TCP ports in network ACLs.

  • Jumbo frames on AWS

    9001 MTU inside a VPC and on supported Direct Connect paths.

    Remember
    Internet, VPN and inter-Region traffic use smaller MTUs.
    Tested as
    Throughput optimization.
    Trap
    Enabling 9001 end to end over VPN.

  • ENA vs. EFA

    Enhanced networking adapter versus Elastic Fabric Adapter.

    Remember
    EFA adds OS-bypass for tightly coupled HPC and ML.
    Tested as
    Interface selection.
    Trap
    Choosing EFA for a web tier.

  • Transit Gateway multicast

    Multicast domains on a transit gateway with IGMP or static members.

    Remember
    Native VPC routing has no multicast otherwise.
    Tested as
    Bandwidth reduction.
    Trap
    Assuming VPCs support multicast without TGW.

  • Secondary CIDR blocks

    Additional ranges added to a VPC.

    Remember
    Relieve IP exhaustion without rebuilding.
    Tested as
    Subnet optimization.
    Trap
    Recreating the VPC to grow it.

  • Route 53 health-checked routing

    Weighted, latency and failover records tied to health checks.

    Remember
    Unhealthy endpoints are removed from answers.
    Tested as
    Availability tuning.
    Trap
    Forgetting Evaluate Target Health on alias records.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Troubleshooting tools

ConceptMeaningKey differenceCommon trap
Reachability Analyzer Configuration path check between two endpoints No traffic sent; names blocker Using it for packet loss
VPC Flow Logs Flow metadata with ACCEPT or REJECT Shows what happened to real traffic Expecting payload or DNS content
Traffic Mirroring Copies packets to an analysis target Full packet detail Leaving it on everywhere at high cost
Network Manager Global topology, events and route analysis Spans Regions and on-premises sites Using it for single-ENI detail

Connectivity cost and performance

ConceptMeaningKey differenceCommon trap
VPC peering Direct path No hourly or processing fee; same-AZ traffic free Ignoring management overhead at scale
Transit Gateway Central hub Hourly per attachment plus per-GB processing Routing heavy flows through it unnecessarily
Direct Connect Private circuit Lower data transfer out rates Choosing VPN for steady large transfers
Site-to-Site VPN Internet IPsec Cheap to start, variable latency Expecting jumbo frames or fixed latency

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. BGP session goes idle

    What candidates pick
    Open a support case for a circuit fault
    Why it looks right
    Session state looks like a link problem.
    Why it's wrong
    Exceeding the VIF prefix quota idles BGP; the physical connection stays up.

    Clue to watch for Problem began after on-premises routes were added.

  2. Large transfers stall

    What candidates pick
    Increase instance size
    Why it looks right
    Throughput problems suggest capacity.
    Why it's wrong
    When small packets pass but large ones hang, an MTU mismatch with blocked ICMP is the likely cause.

    Clue to watch for SSH works but file copies hang over a hybrid link.

  3. Return traffic rejected

    What candidates pick
    Edit the security group
    Why it looks right
    Security groups are the usual filter.
    Why it's wrong
    Security groups track state, so returns pass; a stateless network ACL missing ephemeral ports is the usual culprit.

    Clue to watch for Flow Logs show outbound ACCEPT and inbound REJECT on high ports.

  4. Proving a path is allowed

    What candidates pick
    Turn on Traffic Mirroring
    Why it looks right
    Packet capture feels definitive.
    Why it's wrong
    Reachability Analyzer checks configuration directly and names the blocking hop, faster and cheaper.

    Clue to watch for A new route or rule must be verified before go-live.

  5. Cheaper heavy inter-VPC traffic

    What candidates pick
    Keep everything on Transit Gateway
    Why it looks right
    One hub simplifies routing.
    Why it's wrong
    Per-GB processing on high-volume pairs adds up; peering those VPCs directly lowers cost.

    Clue to watch for Two VPCs exchange most of the organization's traffic.

Answer framework

Use these steps for Domain 3 scenarios about something that used to work or now costs or performs poorly.

  1. Define the symptom precisely: no connectivity at all, intermittent loss, failures with large packets only, slow throughput or a rising monthly bill.
  2. Test configuration first with Reachability Analyzer or route table checks before collecting traffic data, since a static check is faster and costs nothing extra.
  3. Use Flow Logs with custom fields to see accepted and rejected traffic, then add Traffic Mirroring only for packet-level questions.
  4. Check quotas and MTU limits for each connection type, including VIF prefix counts, route table sizes and jumbo frame support.
  5. Choose the optimization that targets the stated metric, such as peering for cost, ENA or EFA for throughput, or health checks for availability.

Practice question

An application in a VPC copies large files to an on-premises server over a Site-to-Site VPN. SSH sessions work, but file transfers hang soon after starting. Instances use a 9001 MTU. The on-premises firewall blocks all ICMP. What is the most likely fix?

Want more like this? The ANS-C01 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Network Management and Operation is the smallest domain at 20%, but its questions are precise and symptom-driven. Build a troubleshooting habit rather than memorizing lists. For each symptom, such as idle BGP, rejected returns or stalled large transfers, write the first tool you would use, the evidence you expect and the fix.

In a lab, break things on purpose. Remove a network ACL ephemeral port rule and read the Flow Log REJECT entries. Block ICMP and send large pings with the do-not-fragment bit set. Run Reachability Analyzer against a missing route and note how it names the component. Enable custom Flow Log fields behind a NAT gateway and compare pkt-srcaddr with srcaddr.

Then memorize the numbers that change answers: MTU per connection type, VIF prefix limits, VPN tunnel throughput and the main Transit Gateway and peering cost drivers. Finish with mixed scenario sets, because Domain 3 items often blend a routing symptom with a cost or performance requirement.

FAQ

How heavily is Network Management and Operation weighted on ANS-C01?

Network Management and Operation is Domain 3, worth 20% of scored content across three task statements, about 10 of the 50 scored questions.

Which troubleshooting tool should I reach for first?

For a suspected configuration block, Reachability Analyzer is fastest because it names the component. For what actually happened to traffic, use Flow Logs. Use Traffic Mirroring only when packet contents matter.

Do I need exact quota numbers?

Know the ones that drive scenarios: VIF prefix limits, jumbo frame MTUs per connection type and VPN tunnel throughput. Quotas change, so learn the behavior when a limit is hit as well.

Is multicast really tested?

The guide lists implementing multicast within a VPC and to on premises. Know that it requires Transit Gateway multicast domains, with IGMP or static group membership.

How does this domain differ from Domain 1 monitoring?

Domain 1 defines which logs and metrics a design needs. Domain 3 uses them to find and fix real faults and to tune performance and cost.

What cost topics come up?

Transit Gateway processing versus peering, Direct Connect versus internet data transfer, and using CloudFront or multicast to cut bandwidth.

Other Networking certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have reviewed routing upkeep, quotas, troubleshooting tools, MTU behavior and cost tuning. Check whether you can find root causes quickly from symptoms and logs.

Take the ANS-C01 practice test Check your ANS-C01 readiness

Keep going