ANS-C01 · Domain 4 of 4

ANS-C01 Domain 4: Network Security, Compliance, and Governance

Domain 4 covers protecting AWS networks: filtering inbound, outbound and inter-VPC traffic, auditing controls with logs and Firewall Manager, and keeping data confidential with TLS, IPsec, MACsec and managed certificates.

Exam weight
24%
Official task statements
3
Estimated questions estimate
~12
Suggested study time estimate
18–24 hrs

About 12 min read Reviewed October 2026

Overview

Network Security, Compliance, and Governance accounts for 24% of ANS-C01 across three task statements. The first implements network features that meet security and compliance needs, from WAF and Shield at the edge to Network Firewall, proxies and Gateway Load Balancer for egress and inspection. The second validates and audits security using monitoring and logging services.

The third maintains confidentiality of data and communications through encryption options, VPN over Direct Connect, certificate management and secure DNS. Scenarios usually involve regulated workloads, many accounts or a specific threat, and the right answer places the right control at the right point in the network.

How it's tested

Domain 4 scenarios name a compliance rule, threat or audit need and describe the traffic. You pick the control, its placement and the evidence that proves it works. Distractors are usually real security services applied at the wrong layer or to an unsupported resource.

  • Control placement

    You choose which service filters a given flow and where in the routing path it sits.

  • Prove and detect

    You select logs, alarms or audit services that show a control is working or that something changed.

  • Encrypt the link

    A hybrid or service-to-service path must be encrypted, and you choose TLS, IPsec, MACsec or a certificate source.

Reasoning it through

An auditor requires that all traffic between a data center and AWS over a 10 Gbps dedicated Direct Connect connection be encrypted without losing much bandwidth. Standard IPsec VPN tunnels top out near 1.25 Gbps (5 Gbps for large-bandwidth tunnels), so they would need several tunnels with ECMP. MACsec on a supported dedicated port encrypts at Layer 2 at line rate, which makes it the better fit here.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

4.1 Implement and maintain network features to meet security and compliance needs and requirementsSecuring inbound, outbound and inter-VPC flows and building compliant architectures.
What it means
This task statement covers protecting traffic in every direction. It includes threat models built from application architecture, common threats, securing inbound flows with AWS WAF, AWS Shield and AWS Network Firewall, outbound flows with Network Firewall, proxies and Gateway Load Balancer, inter-VPC flows with security groups, network ACLs and endpoint policies, compliant architectures such as perimeter VPCs and three-tier designs, compliance testing and automated incident alerting.
What to understand
AWS WAF filters HTTP requests at CloudFront, ALB, API Gateway and AppSync; Shield Standard covers common DDoS for everyone, and Shield Advanced adds response team support and cost protection. Network Firewall is a stateful, managed Layer 3 to 7 firewall with Suricata-compatible rules and domain filtering, deployed in firewall subnets with route table changes. Centralized egress uses an inspection VPC with Transit Gateway appliance mode. VPC endpoint policies restrict which principals and resources can be used through an endpoint. Security groups can reference other groups, including across peered VPCs in the same Region.
How it shows up
Scenarios specify a traffic direction and a threat, and you choose the control placed at the right layer and point.
Common confusion
Using security groups to block specific IPs; they only allow, so use network ACLs or Network Firewall.
4.2 Validate and audit security by using network monitoring and logging servicesLogs, alarms, custom metrics and audits that prove controls work.
What it means
This task statement covers proving that network controls work and detecting when they do not. It includes CloudWatch, AWS CloudTrail, Traffic Mirroring, Flow Logs and Network Manager, CloudWatch alarms and custom metrics, log creation in load balancers and CloudFront, log delivery with Amazon Kinesis and CloudWatch, correlation across sources, and audits of security groups and policies with AWS Firewall Manager and AWS Trusted Advisor.
What to understand
CloudTrail records API calls, such as who changed a security group or route, while Flow Logs record traffic. Combining them answers both what changed and what traffic resulted. Metric filters on CloudWatch Logs turn log patterns into custom metrics with alarms that notify through Amazon SNS. Firewall Manager applies and audits WAF, Shield Advanced, security group and Network Firewall policies across an organization and flags noncompliant resources. AWS Config rules detect drift such as unrestricted SSH. Amazon GuardDuty analyzes Flow Logs, DNS logs and CloudTrail for threats without you enabling those logs yourself.
How it shows up
Expect questions on which log or service proves a control, detects a change or audits many accounts at once.
Common confusion
Expecting Flow Logs to show who changed a rule; CloudTrail records configuration changes.
4.3 Implement and maintain confidentiality of data and communications of the networkEncryption in transit, VPN over Direct Connect, certificates and secure DNS.
What it means
This task statement covers keeping network traffic confidential. It includes AWS encryption options, VPN over Direct Connect, IPsec and TLS, encryption under the shared responsibility model, DNSSEC, encryption across CloudFront, ALB, NLB, managed databases, Amazon S3, custom EC2 solutions and Transit Gateway, certificate management with ACM and AWS Private CA, and secure DNS communications.
What to understand
Direct Connect is not encrypted by default. Options are MACsec on supported dedicated 10 and 100 Gbps connections for Layer 2 encryption, or an IPsec VPN over a public or transit VIF for end-to-end encryption. Traffic between supported Nitro instances is encrypted automatically within and between peered VPCs. ACM issues and renews public certificates for integrated services but does not export them; AWS Private CA issues private certificates for internal endpoints and mutual TLS. TLS can terminate at ALB or pass through NLB to targets. DNSSEC protects answer integrity, not query privacy.
How it shows up
Questions combine a compliance requirement with a link type and ask which encryption method or certificate source fits.
Common confusion
Believing DNSSEC encrypts DNS queries; it only signs records so resolvers can verify them.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • AWS WAF

    Layer 7 web ACLs for HTTP requests.

    Remember
    Attaches to CloudFront, ALB, API Gateway and AppSync, not NLB.
    Tested as
    Inbound web protection.
    Trap
    Attaching WAF to an NLB.

  • Shield Standard vs. Advanced

    Automatic DDoS protection versus paid enhanced protection.

    Remember
    Advanced adds the Shield Response Team and cost protection.
    Tested as
    DDoS scenarios.
    Trap
    Paying for Advanced when only basic Layer 3/4 protection is needed.

  • AWS Network Firewall

    Managed stateful and stateless firewall for VPCs.

    Remember
    Needs dedicated firewall subnets and route changes.
    Tested as
    Inspection and egress filtering.
    Trap
    Expecting it to inspect traffic without routing through it.

  • Centralized inspection VPC

    Transit Gateway sends traffic through a firewall VPC.

    Remember
    Enable appliance mode on that attachment.
    Tested as
    Organization-wide inspection.
    Trap
    Forgetting symmetric routing.

  • Security groups vs. network ACLs

    Stateful allow-only instance rules versus stateless subnet rules.

    Remember
    Explicit deny needs a network ACL.
    Tested as
    Layered filtering.
    Trap
    Blocking an IP with a security group.

  • VPC endpoint policies

    Resource policies on gateway or interface endpoints.

    Remember
    Limit which buckets or actions are reachable.
    Tested as
    Data exfiltration controls.
    Trap
    Assuming they replace IAM policies.

  • AWS Firewall Manager

    Central policy manager across an AWS Organization.

    Remember
    Applies and audits WAF, security group and firewall rules.
    Tested as
    Multi-account governance.
    Trap
    Configuring rules account by account.

  • CloudTrail vs. Flow Logs

    API activity versus traffic metadata.

    Remember
    Use both to link a change to its traffic effect.
    Tested as
    Audit questions.
    Trap
    Looking for rule changes in Flow Logs.

  • MACsec on Direct Connect

    Layer 2 encryption on supported dedicated connections.

    Remember
    Available on selected 10 and 100 Gbps ports.
    Tested as
    Hybrid confidentiality.
    Trap
    Expecting it on hosted connections.

  • IPsec VPN over Direct Connect

    Encrypted tunnels across a public or transit VIF.

    Remember
    Gives end-to-end encryption with private connectivity.
    Tested as
    Compliance over DX.
    Trap
    Assuming DX alone meets encryption rules.

  • ACM vs. AWS Private CA

    Public managed certificates versus a private certificate authority.

    Remember
    Private CA serves internal names and mutual TLS.
    Tested as
    Certificate management.
    Trap
    Assuming a standard ACM public certificate can be exported to EC2.

  • DNSSEC

    Signed DNS records for integrity.

    Remember
    Does not hide query contents.
    Tested as
    Secure DNS.
    Trap
    Treating it as DNS encryption.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Traffic filtering controls

ConceptMeaningKey differenceCommon trap
Security group Stateful, ENI level Allow rules only, references other groups Trying to deny a single IP
Network ACL Stateless, subnet level Allow and deny, ordered rules Forgetting ephemeral return ports
AWS Network Firewall Managed stateful firewall Domain and IPS rules across Layers 3 to 7 Skipping route table changes
AWS WAF HTTP request filtering SQL injection, XSS, rate limits Using it for non-HTTP traffic

Encrypting hybrid traffic

ConceptMeaningKey differenceCommon trap
Direct Connect alone Private circuit Not encrypted by default Assuming private means encrypted
MACsec Layer 2 link encryption Dedicated supported ports only Planning it on hosted connections
IPsec over DX VPN across a VIF End-to-end encryption, lower throughput per tunnel Using a private VIF for a public VPN endpoint

Audit and detection services

ConceptMeaningKey differenceCommon trap
CloudTrail Records API calls Who changed what and when Expecting traffic data
AWS Config Tracks resource configuration and rules Detects noncompliant settings Expecting threat detection
GuardDuty Threat detection from logs Finds suspicious traffic patterns Expecting it to block traffic
Firewall Manager Org-wide security policy Enforces and audits rules centrally Treating it as a firewall itself

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Encrypt Direct Connect

    What candidates pick
    Rely on the private nature of the circuit
    Why it looks right
    Traffic does not cross the internet.
    Why it's wrong
    Direct Connect has no default encryption; compliance requires MACsec or an IPsec VPN over the connection.

    Clue to watch for Regulations require all traffic in transit to be encrypted.

  2. WAF on NLB

    What candidates pick
    Attach a web ACL to the Network Load Balancer
    Why it looks right
    WAF is the standard web protection.
    Why it's wrong
    WAF does not integrate with NLB; use ALB, CloudFront or Network Firewall for that traffic.

    Clue to watch for Application uses TCP pass-through on an NLB.

  3. Egress domain filtering

    What candidates pick
    Security group outbound rules
    Why it looks right
    They control outbound traffic.
    Why it's wrong
    Security groups match IP ranges, not domain names; Network Firewall or a proxy can filter by domain.

    Clue to watch for Allow outbound only to approved domains.

  4. Organization-wide audit

    What candidates pick
    AWS Config in each account manually
    Why it looks right
    Config detects drift.
    Why it's wrong
    Firewall Manager applies and audits rules across all accounts centrally and remediates new accounts automatically.

    Clue to watch for Hundreds of accounts need the same WAF and security group baseline.

  5. Exportable certificates

    What candidates pick
    Request a standard public certificate in ACM for EC2 web servers
    Why it looks right
    ACM is the managed certificate service.
    Why it's wrong
    Standard ACM public certificates cannot be exported; request an exportable ACM public certificate (paid option since 2025), use AWS Private CA, or use a third-party certificate.

    Clue to watch for TLS must terminate on self-managed EC2 instances.

  6. Private DNS lookups

    What candidates pick
    Enable DNSSEC to keep queries confidential
    Why it looks right
    It sounds like secure DNS.
    Why it's wrong
    DNSSEC adds signatures for integrity only, so query names remain visible.

    Clue to watch for Requirement mentions spoofing versus privacy.

Answer framework

Use these steps to choose a control for a Domain 4 security or compliance scenario.

  1. Identify the flow and direction: inbound from the internet, outbound to the internet, between VPCs or across hybrid links.
  2. Match the threat to the layer, using WAF for web exploits, Shield for DDoS, Network Firewall or a proxy for domains and intrusion signatures, and security groups or ACLs for addresses.
  3. Decide whether the requirement is prevention, detection or proof, then add logging, alarms or audit services as needed.
  4. For confidentiality, check whether the link is encrypted by default and add TLS, IPsec or MACsec where it is not.
  5. Scale the answer with Firewall Manager, RAM-shared rules or centralized inspection when many accounts are involved.

Practice question

A financial firm must inspect all outbound internet traffic from 60 VPCs in several accounts, allowing only approved domain names. The solution must be managed and centrally governed. Which approach meets these requirements?

Want more like this? The ANS-C01 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Network Security, Compliance, and Governance is 24% of ANS-C01, and its questions mix security with the routing knowledge from earlier domains. Start by building a control matrix: rows for inbound, outbound, inter-VPC and hybrid flows, columns for prevention, detection and encryption. Fill each cell with the AWS service and the deciding requirement, such as domain filtering, explicit deny or Layer 2 encryption.

Then work through the centralized inspection pattern in detail, because it combines Transit Gateway routing, appliance mode, Network Firewall routing and Firewall Manager governance. Draw the route tables for spoke, transit and firewall subnets until you can explain each hop.

For audit, practice in a lab: change a security group, find the event in CloudTrail, generate rejected traffic and find it in Flow Logs, then build a metric filter and alarm. For confidentiality, memorize where encryption is automatic and where it is not, including Direct Connect, Nitro instance traffic and inter-Region peering. Close with mixed practice sets.

FAQ

What portion of ANS-C01 is Network Security, Compliance, and Governance?

Network Security, Compliance, and Governance, Domain 4, is 24% of scored content with three task statements, about 12 of the 50 scored questions.

Is Direct Connect encrypted?

Not by default. Use MACsec on supported dedicated connections or an IPsec VPN over a public or transit VIF when encryption in transit is required.

When should I choose Network Firewall over WAF?

Choose WAF for HTTP request inspection on CloudFront, ALB or API Gateway. Choose Network Firewall for VPC-level stateful filtering, intrusion prevention and outbound domain filtering on any protocol.

What does Firewall Manager add?

Central creation, enforcement and auditing of WAF, Shield Advanced, security group and Network Firewall policies across an AWS Organization, including new accounts.

Which logs prove a security control works?

Flow Logs show accepted and rejected traffic, Network Firewall logs show alerts and flows, WAF logs show request decisions, and CloudTrail shows who changed the controls.

How much certificate knowledge is needed?

Know when to use ACM public certificates, AWS Private CA for internal names and mutual TLS, and where TLS terminates on each load balancer type.

Other Networking certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have reviewed traffic filtering, centralized inspection, audit logging, encryption and certificates. Test whether you can place each control correctly in a scenario.

Take the ANS-C01 practice test Check your ANS-C01 readiness

Keep going