AWS is retiring the Advanced Networking – Specialty certification and is not issuing a direct successor exam. ANS-C01 is still live and bookable until the retirement date, and certifications earned before then remain valid for the standard three-year period. If you want this credential, schedule and sit the exam before August 25, 2026. See the official AWS certification page for details.
AWS ANS-C01 Advanced Networking – Specialty Practice Exam
Prepare for the AWS Certified Advanced Networking – Specialty exam (ANS-C01) before it retires on August 25, 2026. Practice scenario-based, source-cited questions across all four domains — network design, implementation, management and operation, and security — covering VPC architecture, Direct Connect, Site-to-Site VPN, Transit Gateway, Route 53 and hybrid DNS, PrivateLink, edge services, and network security. Includes Learn mode and full timed Exam mode.
Start 24-hour free trial →ANS-C01 exam at a glance
- Vendor
- Amazon Web Services (AWS)
- Exam code
- ANS-C01
- Certification
- AWS Certified Advanced Networking – Specialty
- Status
- Retiring — last day to test is August 25, 2026 (no successor exam)
- Level
- Specialty
- Format
- 65 questions (50 scored + 15 unscored); multiple choice and multiple response
- Duration
- 170 minutes
- Scoring
- Scaled 100–1000; passing score 750
- Cost (USD)
- $300 (50% discount voucher available after any prior AWS certification)
- Delivery
- Pearson VUE test center or online proctored
- Prerequisites
- None required. AWS recommends ~5 years of networking experience with 2+ years of cloud/hybrid networking
- Validity
- 3 years (certifications earned before retirement stay valid the full 3 years)
Sources: AWS — Advanced Networking – Specialty certification (retirement notice) · AWS Certification exam guides. Confirm the retirement date and current details with AWS before scheduling.
About the ANS-C01 certification
AWS Certified Advanced Networking – Specialty (ANS-C01) is a specialty-level credential that validates the ability to design, implement, manage, and secure AWS and hybrid network architectures at scale. It is one of AWS’s deepest technical exams — closer to professional-level difficulty than most specialty exams — and targets network engineers and architects who solve enterprise connectivity problems spanning multiple accounts, multiple Regions, and on-premises data centers. The questions are scenario-based: you read a network architecture situation and choose the design or configuration that meets the stated requirements for connectivity, resilience, performance, and security.
Note that this exam is retiring on August 25, 2026, and AWS is not releasing a direct replacement. It remains fully valid to earn until then, and a certification earned before retirement stays active for the standard three-year term. The scope is broad: VPC design and IP addressing, hybrid connectivity with AWS Direct Connect and Site-to-Site VPN, Transit Gateway and large-scale routing, Route 53 and hybrid DNS, content delivery and Global Accelerator, PrivateLink and VPC endpoints, and network security with security groups, network ACLs, AWS WAF, and VPC Flow Logs. For the networking concepts behind these scenarios, see the AWS networking study guides in the Learning Hub.
ANS-C01 exam domains and weights
AWS publishes four scored content domains with the official weightings below (they sum to 100%). Network Design is the single heaviest domain, so plan your study time in proportion — but note that Implementation and Security together make up half the exam.
Designing scalable, highly available network architectures: VPC and subnet design, IP addressing, hybrid connectivity patterns (Direct Connect, VPN), multi-account and multi-Region routing with Transit Gateway, and DNS architecture with Route 53.
Implementing core AWS networking services to best practices: building VPCs, Direct Connect and VPN connections, Transit Gateway attachments and routing, load balancing, PrivateLink and VPC endpoints, and edge/content-delivery services.
Securing network architectures: security groups and network ACLs, AWS WAF and AWS Network Firewall, DDoS protection with AWS Shield, encryption in transit, and governance across accounts.
Operating and maintaining networks: monitoring with VPC Flow Logs and Amazon CloudWatch, troubleshooting connectivity and routing, and automating network tasks with infrastructure-as-code and AWS tooling.
Source: AWS Certified Advanced Networking – Specialty (ANS-C01) exam guide. Domains are displayed heaviest-first; AWS numbers them 1–4 (Management & Operation is Domain 3, Security is Domain 4).
Who ANS-C01 is for
This is an expert-level exam for professionals whose work centers on cloud and hybrid networking:
- Network engineers and network architects designing and implementing hybrid cloud connectivity between data centers and AWS.
- Solutions architects with a networking specialization who design large-scale, multi-account, multi-Region AWS environments.
- Senior cloud and DevOps engineers responsible for the connectivity, security, and performance of cloud infrastructure.
- Infrastructure specialists making strategic decisions about VPC design, Direct Connect, VPNs, routing, and network security.
There are no mandatory prerequisites, but AWS recommends around five years of networking experience with at least two in cloud and hybrid networking; many candidates take this after the Solutions Architect Associate or alongside the Security – Specialty. For where advanced AWS networking skills lead, see the cloud engineering career paths in the Career Hub.
What this ANS-C01 practice exam delivers
Learn mode
Get the correct answer, the architecture reasoning, why each distractor fails, and a link to the relevant AWS documentation right after each question — built for the scenario-heavy way ANS-C01 tests.
Exam mode
Rehearse on a 170-minute timer against 65-question sets that mirror the real ANS-C01 format, so you build the pacing to work through dense networking scenarios under time.
Source-linked explanations
Every answer cites official AWS documentation — VPC, Direct Connect, Transit Gateway, Route 53, and more — so you study from AWS’s own material, not a mystery answer key.
Score by domain
Results break down across the four ANS-C01 domains, so practice tells you exactly which area — design, implementation, management, or security — to sharpen next.
Sample ANS-C01 practice questions
Ten free questions across the four ANS-C01 domains, with full explanations and links to the relevant AWS documentation. The complete bank is available with the 24-hour trial.
A company needs private, dedicated, consistent-bandwidth connectivity between its on-premises data center and AWS that does not traverse the public internet. Which AWS service should form the basis of this design?
- A Site-to-Site VPN over the public internet
- AWS Direct Connect
- An internet gateway with public subnets
- A NAT gateway
Show answer & explanation
Correct: B — AWS Direct Connect. Direct Connect provides a private, dedicated network connection from on-premises to AWS with consistent bandwidth that bypasses the public internet.
Why not the others: a Site-to-Site VPN (A) rides the public internet, so bandwidth and latency are variable; an internet gateway (C) provides public internet access, not private connectivity; and a NAT gateway (D) provides outbound internet access for private subnets — none is dedicated private on-prem connectivity.
Source: AWS — Direct Connect User Guide →An organization is connecting hundreds of VPCs across multiple accounts and needs a scalable hub for transitive routing between them and to on-premises. Which service is designed for this?
- VPC peering between every pair of VPCs
- AWS Transit Gateway
- An internet gateway per VPC
- A separate NAT gateway per VPC
Show answer & explanation
Correct: B — AWS Transit Gateway. Transit Gateway acts as a central hub for transitive routing among many VPCs and on-premises networks, scaling far better than a full mesh.
Why not the others: VPC peering (A) is non-transitive and becomes an unmanageable mesh at scale; an internet gateway (C) and NAT gateways (D) provide internet access, not inter-VPC routing.
Source: AWS — What is Transit Gateway? →A team needs redundant, encrypted connectivity to AWS quickly while a Direct Connect circuit is being provisioned. Which approach provides encrypted connectivity over the internet in the interim?
- An AWS Site-to-Site VPN with two tunnels
- A single unencrypted Direct Connect connection
- A public S3 bucket
- An internet gateway with a public IP
Show answer & explanation
Correct: A — AWS Site-to-Site VPN with two tunnels. A Site-to-Site VPN provides IPsec-encrypted connectivity over the internet and provisions two tunnels for redundancy, making it a fast interim (and later backup) path.
Why not the others: Direct Connect alone (B) is not encrypted by default and takes time to provision; an S3 bucket (C) is object storage, not connectivity; and an internet gateway (D) provides unencrypted public access.
Source: AWS — Site-to-Site VPN → Further reading: PowerKram — VPN & Direct Connect resilience →A hybrid workload needs on-premises systems to resolve private Route 53 hosted-zone records in a VPC, and AWS resources to resolve on-premises DNS names. Which capability enables this bidirectional hybrid DNS resolution?
- A public hosted zone only
- An Elastic IP address
- Route 53 Resolver inbound and outbound endpoints
- A CloudFront distribution
Show answer & explanation
Correct: C — Route 53 Resolver inbound and outbound endpoints. Inbound endpoints let on-premises resolvers query Route 53 private zones; outbound endpoints (with resolver rules) forward AWS queries to on-premises DNS — together they provide bidirectional hybrid resolution.
Why not the others: a public hosted zone (A) does not resolve private records; an Elastic IP (B) is a static public address, not a DNS mechanism; and CloudFront (D) is a CDN, not a DNS resolver.
Source: AWS — Route 53 Developer Guide →A security team wants stateful, instance-level control over inbound and outbound traffic to EC2 instances. Which AWS construct provides stateful filtering at the instance level?
- Network ACLs
- Security groups
- An S3 bucket policy
- An IAM role
Show answer & explanation
Correct: B — Security groups. Security groups are stateful firewalls attached at the instance (ENI) level: return traffic for an allowed connection is automatically permitted.
Why not the others: network ACLs (A) are stateless and operate at the subnet level; an S3 bucket policy (C) controls access to S3 objects, not instance traffic; and an IAM role (D) grants API permissions, not packet filtering.
Source: AWS — Amazon VPC (security groups & ACLs) → Further reading: PowerKram — AWS Security Specialty (SCS-C02) →A company wants to expose an internal service to other VPCs privately, without going over the internet or requiring VPC peering. Which AWS feature is designed for this?
- An internet-facing Application Load Balancer only
- AWS PrivateLink with an interface VPC endpoint and endpoint service
- A public NAT gateway
- An egress-only internet gateway
Show answer & explanation
Correct: B — AWS PrivateLink with an interface endpoint and endpoint service. PrivateLink exposes a service through an interface VPC endpoint so consumers reach it privately over the AWS network, without peering or internet exposure.
Why not the others: an internet-facing ALB (A) exposes the service publicly; a NAT gateway (C) and an egress-only internet gateway (D) handle outbound internet access, not private service sharing.
Source: AWS — What is AWS PrivateLink? → Further reading: PowerKram — PrivateLink & VPC endpoints →A global application needs to route user traffic to the nearest healthy Regional endpoint over the AWS backbone, with fast failover and static anycast IPs. Which service fits?
- Amazon CloudFront
- A single Elastic IP
- AWS Global Accelerator
- An internet gateway
Show answer & explanation
Correct: C — AWS Global Accelerator. Global Accelerator provides static anycast IP addresses and routes traffic over the AWS global network to the nearest healthy endpoint with fast Regional failover.
Why not the others: CloudFront (A) is a CDN optimized for cacheable content rather than TCP/UDP endpoint routing; a single Elastic IP (B) has no global routing or failover; and an internet gateway (D) is not a traffic-routing service.
Source: AWS — What is Global Accelerator? →A network engineer must troubleshoot why traffic between two instances is being dropped and wants a record of accepted and rejected IP traffic at the ENI, subnet, or VPC level. Which tool provides this?
- VPC Flow Logs
- AWS Cost Explorer
- Amazon S3 access points
- AWS Trusted Advisor billing checks
Show answer & explanation
Correct: A — VPC Flow Logs. Flow Logs capture metadata about accepted and rejected IP traffic at the ENI, subnet, or VPC level — the primary data source for diagnosing dropped traffic and security-group/ACL issues.
Why not the others: Cost Explorer (B) and Trusted Advisor billing checks (D) address spend, not packet flow; and S3 access points (C) manage access to S3 data, not VPC traffic.
Source: AWS — VPC Flow Logs → Further reading: PowerKram — network monitoring & troubleshooting →A web application behind an Application Load Balancer needs protection against common web exploits such as SQL injection and cross-site scripting. Which AWS service applies these Layer 7 protections?
- A network ACL
- A security group
- An Elastic IP
- AWS WAF
Show answer & explanation
Correct: D — AWS WAF. AWS WAF inspects HTTP/HTTPS requests at Layer 7 and blocks common exploits (SQL injection, cross-site scripting) via managed and custom rules on an ALB, CloudFront, or API Gateway.
Why not the others: network ACLs (A) and security groups (B) filter by IP, port, and protocol, not application-layer request content; and an Elastic IP (C) is an addressing construct, not a security control.
Source: AWS — What is AWS WAF? → Further reading: PowerKram — AWS Security Specialty (SCS-C02) →An application needs to distribute TCP traffic at ultra-low latency to targets while preserving the client source IP and handling millions of requests per second. Which load balancer type fits?
- Application Load Balancer
- Classic Load Balancer only
- A NAT gateway
- Network Load Balancer
Show answer & explanation
Correct: D — Network Load Balancer. The NLB operates at Layer 4, handles millions of requests per second at very low latency, and can preserve the client source IP — the right fit for high-performance TCP/UDP traffic.
Why not the others: the ALB (A) is a Layer 7 HTTP/HTTPS balancer; the Classic Load Balancer (B) is a legacy option AWS steers away from for new designs; and a NAT gateway (C) is not a load balancer.
Source: AWS — Elastic Load Balancing →Keep going: Learning & Career resources
Advanced networking skills carry across the AWS certification track, even as this specialty exam retires. Both PowerKram hubs back your next step.
Deep dive: retirement, exam format, study path, and where to go next
Retirement — what it means for you
AWS is retiring the Advanced Networking – Specialty certification; the last day to take ANS-C01 is August 25, 2026, and there is no direct successor exam. If you already hold the certification, or earn it before the deadline, it stays valid for the standard three-year period from your exam date. After retirement AWS will not issue new Advanced Networking – Specialty certifications and points learners to networking content on AWS Skill Builder. If the credential matters for your role or employer, schedule before the deadline. AWS retirement notice →
Exam format and scoring
ANS-C01 has 65 questions in 170 minutes: 50 are scored and 15 are unscored pretest items that do not affect your result (you cannot tell which are which). Questions are multiple choice (one correct answer) and multiple response (two or more). Scoring is scaled from 100 to 1000, and 750 is the minimum passing score. There is no penalty for guessing, so answer every question. Read the ANS-C01 format guide →
Realistic study path
This exam rewards hands-on depth. A typical plan runs three to six months after an associate-level certification: work the official exam guide domain by domain, then build real architectures — a multi-VPC design with Transit Gateway, a Direct Connect plus VPN hybrid with BGP routing, Route 53 Resolver for hybrid DNS, PrivateLink for private service access, and network security with security groups, NACLs, and AWS WAF. Then rehearse scenario reasoning in Learn mode and run full 65-question, 170-minute simulations in Exam mode. Read the ANS-C01 study plan →
Where to go next as the exam sunsets
Because there is no direct replacement, most networking specialists channel the same knowledge into adjacent AWS credentials. The Solutions Architect – Professional (SAP-C02) covers large-scale network design within a broader architecture remit, and the Security – Specialty (SCS-C02) goes deep on the network-security and governance material that overlaps Domain 4. Both remain active and are natural next steps. See more AWS exams →
Cost, scheduling, and retakes
The exam costs $300 USD and is delivered at a Pearson VUE test center or online with a proctor. If you have earned any prior AWS certification, a 50% discount voucher is available in your AWS Certification account. If you do not pass, AWS requires a 14-day wait before retaking, with no cap other than the retirement deadline. Verify current fees and policies with AWS before scheduling. Career Hub — cloud & network engineering →
Frequently asked questions
Is the ANS-C01 exam being retired?
Yes. AWS is retiring the Advanced Networking – Specialty certification, and the last day to take ANS-C01 is August 25, 2026. There is no direct successor exam. The exam is still live and bookable until that date, and certifications earned before retirement stay valid for the standard three-year period.
What format is the ANS-C01 exam?
65 questions in 170 minutes — 50 scored and 15 unscored pretest items. Questions are multiple choice and multiple response. Scoring is scaled from 100 to 1000, and the minimum passing score is 750. There is no penalty for guessing.
What does ANS-C01 cover?
Four domains: Network Design (30%), Network Implementation (26%), Network Security, Compliance and Governance (24%), and Network Management and Operation (20%). Topics include VPC design, Direct Connect, Site-to-Site VPN, Transit Gateway, Route 53 and hybrid DNS, PrivateLink, load balancing, edge services, and network security.
Are there prerequisites for ANS-C01?
No mandatory prerequisites. AWS recommends around five years of networking experience with at least two years of cloud and hybrid networking. It is one of AWS's most difficult exams, so hands-on experience is important.
What should I pursue after ANS-C01 retires?
Because there is no direct replacement, most networking specialists move to adjacent active AWS credentials: the Solutions Architect – Professional (SAP-C02) for large-scale network and architecture design, or the Security – Specialty (SCS-C02) for the network-security and governance material that overlaps Domain 4.
Practice for ANS-C01 before it retires on August 25, 2026
Full access to the question bank, both study modes, source-linked explanations, and score-by-domain. No credit card required. Earn the credential while you still can.
Start free trial →