Study guide · Exam overview
The format, passing score, and four content domains of the AWS Certified Advanced Networking – Specialty exam, plus the edge, DNS, and hybrid choices worth practicing before you book ANS-C01.
Exam version notice: This overview follows the AWS Certified Advanced Networking – Specialty Exam Guide (ANS-C01) on the AWS documentation site, and the AWS certification page, both reviewed in October 2026. ANS-C01 replaced ANS-C00. There is no ANS-C02. Domain weights are 30%, 26%, 20%, and 24%. AWS says the last day to take the exam is December 31, 2026. Pricing, languages, and delivery options can change. Confirm them on the AWS certification site before you register. Items tagged Extra are useful context the guide places out of scope. Identity and incident response that are not a network control sit on the Security Specialty overview.
ANS-C01 checks whether you can design, implement, operate, and secure AWS and hybrid networks at scale. The exam guide describes the target candidate as someone with five or more years of networking experience and two or more years of cloud and hybrid networking. The AWS certification page describes five years of hands-on experience architecting AWS network solutions. The work is to pick the edge service, the DNS design, the load balancer, the hybrid path, and the multi-account pattern, then build it, keep it up, and prove the traffic is allowed and encrypted where the requirement says so.
A question usually gives a constraint: cacheable HTTP, two static IPs for a UDP service, a name that must resolve on-premises, a circuit that must fail over, two VPCs whose CIDR ranges overlap, or a path that must be inspected before it reaches a spoke. Two options often both exist as real services. The better answer is the one that meets the constraint with the service the stem named.
The in-scope service list is non-exhaustive. The guide's out-of-scope appendix names analytics services such as Amazon EMR and Amazon Redshift, plus AWS X-Ray, AWS Ground Station, and unrelated offerings. Overall application architecture belongs on the Solutions Architect path and the Professional path.
Figures below come from the AWS certification page and the ANS-C01 exam guide, reviewed in October 2026.
| Specification | ANS-C01 |
|---|---|
| Level | Specialty. There is no required prerequisite certification. Candidates commonly earn an Associate or Professional certification first. |
| Number of questions | 65. Fifty affect your score. Fifteen are unscored and are not identified on the exam. |
| Question types | The certification page lists multiple choice and multiple response. The exam guide also describes matching: 3–7 prompts, and credit only when every pair is correct. Multiple response has two or more correct answers out of five or more options. |
| Length of test | 170 minutes. AWS offers an additional 30 minutes for eligible non-native English speakers who request the ESL accommodation before they register. |
| Passing score | 750 on a scaled range of 100–1,000. Scoring is compensatory: you pass the exam as a whole, not each domain. |
| Recommended experience | Five or more years of networking experience, including two or more years of cloud and hybrid networking. |
| Exam price | Specialty exams are listed at 300 USD. Taxes and local-currency prices can differ. Confirm the current fee before you book. |
| Delivery | Pearson VUE, at a test center or with online proctoring. Languages listed by AWS include English, Japanese, Korean, and Simplified Chinese. |
| Validity and retirement | Three years if you earn it in time. The last day to take the exam is December 31, 2026. A certification earned before retirement stays active for three years. No replacement exam is announced. |
Unanswered questions are scored as incorrect. There is no penalty for guessing, so answer every question. A scaled score of 750 is not the same thing as 75 percent of the questions. Matching awards credit only when every pair is correct. The exam uses official short names, and the in-exam Help lists the matching full service names.
These percentages are the share of scored content in the ANS-C01 exam guide. The 200 practice questions on this site follow the same weights.
The largest domain. Choose the edge, the name service, the load balancer, and the path between networks.
Build the design: virtual interfaces, transit attachments, resolver endpoints, and repeatable templates.
Keep the routes, explain the failure, and spend less where the design allows it.
Filter the right layer, keep the evidence, and encrypt the path the policy named.
Learn the in-scope services from the ANS-C01 exam guide. The same map is in the core notes and flashcards.
| Network need | Prefer | Remember |
|---|---|---|
| Cacheable HTTP close to users | Amazon CloudFront | AWS Global Accelerator does not cache. It is the static-IP and TCP/UDP path. |
| Two static IPs for a non-HTTP service | AWS Global Accelerator | An Application Load Balancer DNS name changes targets behind it. It is not a pair of anycast addresses. |
| A name only inside the VPC | A Route 53 private hosted zone | A public hosted zone answers on the internet. On-premises resolvers need an inbound endpoint to see the private zone. |
| HTTP path and host routing | An Application Load Balancer | A Network Load Balancer is layer 4. A Gateway Load Balancer inserts an appliance. It does not route by URL. |
| Many VPCs and a hybrid hub | AWS Transit Gateway | VPC peering is a pair and is not transitive. Overlapping CIDRs cannot attach to the same transit gateway. |
| A private service across overlapping CIDRs | AWS PrivateLink | Peering requires non-overlapping CIDRs and a route. PrivateLink uses an endpoint address in the consumer VPC. |
| A dedicated circuit to on-premises | AWS Direct Connect | The circuit is not encrypted until you add MACsec or a VPN. A Site-to-Site VPN over the internet is the encrypted alternative you can stand up first. |
| SD-WAN into a transit gateway | Transit Gateway Connect | Connect uses GRE and BGP. It is not IPsec by itself. Site-to-Site VPN is the IPsec attachment. |
| Accepted and rejected flows | VPC Flow Logs | They do not contain the payload. VPC Traffic Mirroring copies packets. Reachability Analyzer does not send them. |
| An HTTP request pattern | AWS WAF on CloudFront or an Application Load Balancer | AWS Shield is DDoS protection. You do not attach WAF directly to a Network Load Balancer. |
| A domain-name egress filter | AWS Network Firewall, or Route 53 Resolver DNS Firewall | A security group cannot match a domain name. A NAT gateway forwards. It does not filter names. |
| Encryption on Direct Connect | MACsec on a supported dedicated connection, or a VPN | A private virtual interface is private addressing. Privacy is not encryption. |
| Extra Analytics and tracing products | Leave them outside this exam | The guide lists Amazon EMR, Amazon Redshift, Amazon OpenSearch Service, and AWS X-Ray as out of scope. |
| Extra Packet-craft attacks | Leave exploit steps off the study list | These notes name the control that sees or stops traffic. They are not instructions for attacking a network. |
Multiple choice has one correct response and three distractors. Multiple response has two or more correct responses out of five or more options. The stem tells you how many to choose. Select every response that completes the statement, and nothing extra. Matching asks you to pair every prompt. The exam guide says you receive credit for a matching task only when every pair is correct.
Distractors are real services that solve a nearby problem. If the need is “cache the images,” Global Accelerator is the nearby wrong answer because it steers packets and does not store them. If the need is “resolve a private name from the office,” a public hosted zone is the nearby wrong answer because the office resolver never sees it without an inbound endpoint and a private zone. If the need is “connect two VPCs that both use 10.0.0.0/16,” peering is the nearby wrong answer because the ranges overlap.
Words such as MOST, BEST, and LEAST are the constraint. MOST cost-effective still has to meet the connectivity requirement in the stem. LEAST operational overhead usually means a managed attachment instead of an appliance you patch. There is no published penalty for a wrong guess. A blank answer is incorrect.
A practical sequence once you can already name a VPC route table, a security group, and BGP.
Say whether you need a cache, two static IPs, HTTP routing, or an appliance in the middle. The edge service follows that sentence.
A public zone answers the internet. A private zone answers associated VPCs. On-premises reaches it through an inbound resolver endpoint. The VPC reaches on-premises through an outbound endpoint and a forwarding rule.
Private VIF for a virtual private gateway. Transit VIF for a transit gateway. Public VIF for public AWS addresses. VPN when you need IPsec now. MACsec or a VPN when the circuit itself must be encrypted.
Peering is a non-transitive pair. Transit Gateway is the hub and the segmentation point. PrivateLink is the answer when the CIDRs overlap or the consumer should not receive the provider's routes.
Flow logs for accept and reject. Traffic Mirroring for the payload. Reachability Analyzer for the configured path. A ping that works and a transfer that fails is an MTU problem until you prove otherwise.
Use the four flashcard decks, then the original questions at about two and a half minutes each. Review every explanation and return to domains below 75 percent. Aim for a steady 85 percent before you book. Book before December 31, 2026 if you still want this certification.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 750 passing score, domain weights, and a study plan.
Reference notes for the edge, DNS, hybrid routing, operations, and network security.
50 recall cards in four decks, plus memory notes for paths, VIFs, and encryption.
200 original questions with custom exams, explanations, and a score report by domain.
The current exam is ANS-C01, AWS Certified Advanced Networking – Specialty. It replaced ANS-C00. AWS has not published a newer code. The exam guide reviewed for these pages is the ANS-C01 guide on the AWS documentation site in October 2026. Confirm the code on the AWS certification page before you book.
Yes. AWS says the last day to take the exam is December 31, 2026. Certifications earned before that date remain active for the standard three-year period. New Advanced Networking – Specialty certifications will not be issued after the exam retires. AWS has not announced a replacement exam.
Results use a scaled score from 100 to 1,000. The minimum passing score is 750. You do not need a passing score in every domain. A scaled score is not the percentage of questions you answered correctly.
The exam has 65 questions and a 170-minute time limit. Fifty questions affect your score. Fifteen are unscored and are not labeled. The certification page lists multiple choice and multiple response. The exam guide also describes matching.
There is no required prerequisite certification. The exam guide describes five or more years of networking experience and two or more years of cloud and hybrid networking. Candidates often earn an Associate or Professional certification first.
This certification is valid for three years. Recertify by passing the latest version of this exam before it retires. Confirm the current policy with AWS before your expiration date.
No. The practice questions on this site are original. They are not AWS exam items, and a practice score does not predict a result.
Service names and prices change. Use the current AWS exam guide and the AWS certification site as the authority when they differ from these notes.
Useful companions while you study.
Convert structured data between JSON and YAML with formatting and validation.
Compare two text blocks and highlight added, removed, and changed content.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Convert text between uppercase, lowercase, title case, sentence case, camelCase, and snake_case.
Exam versions, objectives, prices, languages, and retirement dates can change. Verify the details on the AWS certification page before you register.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.
Certi