AWS ANS-C01 Advanced Networking: Exam Scope and 2026 Retirement

The AWS Certified Advanced Networking – Specialty examination (ANS-C01) tests the architecture and operation of substantial AWS and hybrid networks. It goes beyond knowing which VPC component connects two subnets. Candidates need to reason about route selection across accounts and Regions, Border Gateway Protocol (BGP), high-availability interconnects, DNS boundaries, private application connectivity, operational telemetry and security segmentation. A plausible design can still fail because a return route is missing, a transit gateway attachment is associated with the wrong route table or a firewall path becomes asymmetric.

Current status as of October 9, 2026: AWS has announced that the ANS-C01 examination is retiring, with December 31, 2026 as its final testing date. It has not yet retired at the date of this article. AWS states that certifications earned before retirement remain active for the normal three-year period; it has not announced a direct replacement ANS exam in the referenced retirement notice. Candidates weighing whether to schedule should base their decision on remaining preparation time and their actual experience, not an unsupported promise that a new version will automatically follow.

The examination belongs to AWS Certification, a program associated with Amazon. Amazon is the vendor; AWS is the certification and cloud-program designation. AWS recommends a strong networking background for this specialist role, and the official guide is built around design, implementation, management and secure operation of network architectures at scale.

ANS-C01 format and weighted domains

AWS currently lists 65 questions and 170 minutes for ANS-C01. The exam guide describes 50 scored and 15 unscored questions, with the latter not identified to candidates. The scaled passing standard is 700 out of 1,000. The scored content is divided into four domains: Network Design (30%), Network Implementation (26%), Network Management and Operation (20%), and Network Security, Compliance, and Governance (24%). The percentages describe how scored content is weighted, not the exact number of questions from every possible technology service.

These domains overlap in practical scenarios. Designing a multi-Region topology requires knowing how it will be deployed, how failures will be detected and whether security boundaries remain valid after routing changes. A design answer that mentions the correct service but ignores routing, cost, availability or operational ownership can be wrong. Candidates should study services as components of end-to-end packet paths rather than independent product cards.

AWS' official target-candidate guidance points to substantial hands-on networking experience, including cloud and hybrid networking. A professional who already works across enterprise routing and cloud security is better positioned to evaluate architectural trade-offs than a candidate relying only on service-definition flashcards. Foundational VPC and high-availability concepts associated with AWS Solutions Architect – Associate (SAA-C03) can help establish the baseline, but ANS-C01 demands deeper path analysis and troubleshooting.

VPC design begins with address and failure-domain planning

An AWS VPC provides a network boundary with its own address ranges, subnets, routing tables and connectivity mechanisms. Choosing a CIDR block affects more than the number of IP addresses available today. Overlapping ranges can complicate peering, Transit Gateway routes and hybrid integration; poor allocation leaves little room for additional environments, Regions or acquisitions. A strong architecture distinguishes a logical account boundary from a routing boundary and decides which networks should communicate, with what inspection requirements and through which connectivity service.

For a multi-tier workload, public and private subnet placement should follow exposure and operational need rather than a naming convention. A private subnet may still have outbound access through NAT, access to AWS services through VPC endpoints or connectivity to other networks. Whether a server has a public IP is only one dimension of security. Consider routing, security groups, network ACLs, DNS resolution and the location of shared services. A substantive VPC design for multi-tier applications must account for the entire route, including the return path.

IPv4 and IPv6 planning should be explicit from the beginning. Dual-stack VPCs can carry both address families, but the required routing and egress controls are not interchangeable. An egress-only internet gateway can allow outbound-initiated IPv6 connectivity without the general inbound reachability of a standard internet gateway; IPv4 NAT patterns do not simply translate to IPv6. Security-group rules, DNS AAAA records, hybrid links and service support also need to be reviewed for the address family actually used. A design that works over IPv4 but silently fails over IPv6 can generate intermittent problems that resemble application errors. IPv6 architecture in VPCs therefore belongs in the same planning conversation as CIDR allocation and subnet design.

Availability Zone design also matters. A route that traverses a centralized network appliance in another Zone can increase cost, latency and failure coupling. Regional services and per-zone components do not share identical availability characteristics. Candidates should draw the packet's path from source to target, identify every stateful component and ask what changes during the loss of an Availability Zone or interconnect. The same topology can be highly available for one flow and fragile for another if traffic direction or health checking is overlooked.

Transit Gateway routing and segmentation

AWS Transit Gateway acts as a regional hub for VPC, VPN and other supported attachments. Its routing model has two moving parts that candidates frequently confuse: an attachment is associated with one transit gateway route table, while its reachable routes may be propagated into multiple route tables, subject to service behavior. A route table determines where traffic arriving from associated attachments goes. The VPC subnet route tables must also point traffic to the transit gateway where required. Attachment creation by itself does not guarantee packet delivery.

This distinction is decisive in network segmentation. A company may place production, development and shared services attachments in separate association groups, while selectively propagating routes to allow access to centralized DNS or inspection. A default route visible in a VPC is not proof that the corresponding transit gateway route table can forward the traffic. Nor does a propagated destination prove that the other side has a valid return route. A sound solution tests both directions and reviews the route-table association of the source attachment.

The site's treatment of Transit Gateway routing at scale complements the related multi-VPC Transit Gateway design. At specialist level, examine propagation control, static and blackhole routes, cross-account sharing, appliance mode for stateful inspection and limitations of peering. Route policy is a security-control surface as well as an availability concern: an overly broad route can connect environments that were intended to remain isolated.

Direct Connect, VPN and BGP as one hybrid system

Hybrid architectures may combine AWS Direct Connect, AWS Site-to-Site VPN, private or transit virtual interfaces, Direct Connect gateways and customer routing infrastructure. Direct Connect supplies dedicated connectivity, but it is not equivalent to encryption and should not be assumed to provide resilience through a single physical circuit. Site-to-Site VPN uses encrypted tunnels over IP networks, with its own performance and routing characteristics. Architectural decisions depend on traffic sensitivity, throughput, latency, geographic diversity, failover behavior, management capability and budget.

BGP is the control protocol through which dynamic routes may be exchanged across these boundaries. Candidates need to understand advertised prefixes, route preferences, AS paths, route propagation, asymmetric routing and how device or circuit failure affects convergence. The right exam answer may require a specific BGP policy, a second independent Direct Connect connection, a backup VPN path or a correction to a route advertisement—not simply adding another AWS resource. BGP design for Direct Connect is particularly relevant when analyzing how on-premises routes and AWS prefixes are learned and preferred.

Hybrid resilience should be tested under failures that matter: a router loss, a fiber cut, a configuration error, a Regional event or a provider outage. Nominally redundant circuits located at the same physical failure point may not provide the independence the business expects. Route failover must also preserve acceptable performance and security. Direct Connect and VPN resilience patterns connect the connectivity design to actual recovery behavior rather than merely labeling one path “primary” and another “backup.”

DNS architecture across public, private and hybrid boundaries

DNS can break an otherwise healthy network. Amazon Route 53 provides public and private hosted-zone capabilities, while Route 53 Resolver handles VPC DNS resolution and can connect on-premises and cloud namespaces through inbound and outbound endpoints with forwarding rules. Designers must determine which resolver is authoritative or recursive for each name, whether the application uses public or private resolution, and how forwarding behaves across accounts and network boundaries.

Imagine an on-premises service that must reach a private application endpoint in AWS. Network connectivity may work by IP, yet its hostname may fail because the on-premises DNS system cannot resolve a private hosted zone. The solution involves a well-designed conditional forwarding or resolver endpoint arrangement, not adding another route to a reachable network. The reverse situation—AWS clients resolving corporate names hosted on premises—may need an outbound Resolver endpoint and rule associated with the appropriate VPCs. Hybrid DNS using Route 53 Resolver provides natural background for these problems.

Route 53 routing policies also influence public application availability. Weighted, latency-based, failover and other supported policies use different selection logic; DNS caching and health checks affect the observed time to recovery. A client retaining a cached response can continue using an address after a policy changes. The exam expects candidates to distinguish DNS steering from application-layer load balancing or network routing. Route 53 routing policies and failover is relevant when a requirement concerns how clients discover healthy destinations, not simply whether packets can reach those destinations.

Application paths, endpoints and edge services

AWS offers several ways to expose and connect applications, and each operates at a different level. Application Load Balancer (ALB) can make application-layer routing decisions; Network Load Balancer (NLB) addresses high-performance transport-level use cases; other options serve specialized requirements. A network design question should specify the relevant protocol, routing behavior, client-IP and TLS needs, health model and failover objectives before naming a load balancer. Increasing backend capacity does not solve a missing DNS record or an incorrect listener rule.

VPC endpoints can provide private paths to AWS services or endpoint services without relying on general internet egress. Interface endpoints use AWS PrivateLink, while gateway endpoints serve particular supported services through route-table integration. Endpoint policies, security groups, DNS names and service availability constrain actual use. For workloads handling sensitive data, PrivateLink and VPC endpoints can reduce exposure, but they do not replace identity policies or application authorization.

AWS VPC Lattice addresses connectivity, discovery and policy concerns for applications distributed across VPCs and accounts. It can be useful where application services need consistent service-to-service communication without creating broad network reachability. A candidate should distinguish that problem from basic VPC routing: a VPC Lattice application network is organized around application service relationships and policies, not simply exchanging additional CIDR routes. Meanwhile, CloudFront and edge services affect content delivery, caching, origin access and global performance. Choosing them requires understanding the application traffic rather than treating all global services as substitutes.

Network security and operations must be part of design

Security groups, network ACLs, AWS Network Firewall and centralized inspection, routing segmentation, AWS WAF and monitoring services protect different layers. A security group governs allowed instance or interface traffic according to its stateful rules; a network ACL is a stateless subnet-boundary control; a network firewall may inspect and filter routed traffic subject to deployment design. Placing a stateful appliance in an asymmetric path can cause connections to fail even when every visible route looks plausible. The question is not only whether inspection exists, but whether traffic traverses the right control in both directions.

Operations depend on visibility into data paths. VPC Flow Logs, CloudWatch metrics, load balancer logs, Reachability Analyzer, routing tables and on-premises telemetry answer different questions. Flow Logs provide observations about network traffic but not a packet capture of every application exchange. Reachability analysis can reveal configuration-level path barriers, yet runtime application failures may involve DNS, certificates, authentication or the remote service. A disciplined hybrid connectivity troubleshooting sequence isolates DNS, routing, reachability, transport and application behavior instead of changing several controls simultaneously.

Network automation is similarly about predictable state. Infrastructure as code can reproduce routing and security configuration, but a pipeline that rapidly distributes an incorrect shared-route policy magnifies mistakes. Guardrails, review, testing, drift detection and rollback planning are as important as the automation language. The current ANS-C01 Network Management and Operation domain asks candidates to connect observable outcomes with maintainable processes rather than memorize isolated console steps.

Preparing for a retirement-bound specialty examination

Given the December 31, 2026 last testing date, candidates need a realistic decision about readiness. Someone with years of hands-on BGP, Direct Connect and Transit Gateway experience may use the remaining window for structured revision and failure testing. Someone starting from basic VPC vocabulary may be better served by deeper operational learning and the currently available broader AWS credential paths. AWS has not described a direct ANS-C01 successor in its published retirement announcement, so no candidate should base plans on a speculative new exam.

Work through network diagrams under changing conditions. For each scenario, draw source and destination, name the DNS resolver, mark every subnet route table and transit gateway association, annotate propagated and static routes, and identify stateful inspection points. Then remove a circuit, Availability Zone or resolver endpoint and trace the new flow. This method reveals whether a proposed architecture is resilient rather than merely redundant on paper.

Related architecture reasoning appears in AWS Solutions Architect – Professional (SAP-C02), but it is not a replacement for the depth of ANS-C01's BGP and network-operations questions. For candidates taking the specialist examination before retirement, the right final resource remains the official ANS-C01 guide and AWS certification notice. The lasting value of its syllabus is expertise in network paths, boundaries and failure modes—knowledge that continues to matter after the exam itself closes.