ANS-C01 Cheat Sheet: Advanced Networking Specialty Quick Reference

ANS-C01 is the hardest associate-adjacent exam: it tests routing tables, BGP, and when each connectivity construct applies. This sheet compresses the highest-frequency patterns.

Hybrid connectivity

• Direct Connect — private dedicated circuit: consistent latency/bandwidth, no internet; private VIF→VPC VGW, transit VIF→TGW, public VIF→AWS public endpoints
• Site-to-Site VPN — encrypted over internet, fast to stand up, cheaper; static or BGP routing
• DX + VPN backup — classic resilience pair; MACsec for DX encryption
• Client VPN — end-user remote access

Transit Gateway

• TGW = regional hub; peering links TGWs across regions; route tables control segmentation (hub-spoke)
• TGW + DX gateway via transit VIF — many VPCs, segmentation, multi-region over one link
• Shared TGW via RAM for multi-account; appliance mode for symmetric stateful inspection
• Connect/peer attachments: VPC, VPN, DX (via DXGW), peering, connect (SD-WAN/GRE)

DNS & Route 53

• Routing policies: simple, weighted, latency, failover, geolocation, geoproximity, multivalue, IP-based
• Private resources health checks → CloudWatch alarm-based checks (checkers live outside VPC)
• Resolver endpoints: inbound (on-prem→VPC DNS), outbound (VPC→on-prem); Resolver rules forward domains
• Public vs private hosted zones; split-view DNS with same-name PHZ

Load balancing & edge

• ALB — L7 host/path routing, auth offload; NLB — L4, static IP, preserve source IP, TLS passthrough; GWLB — L3 appliance insertion
• CloudFront — CDN, OAC for S3, signed URLs/cookies, field-level encryption, functions vs Lambda@Edge
• Global Accelerator — anycast static IPs, TCP/UDP, near-source failover — vs CloudFront (caching CDN)
• PrivateLink/endpoint services — expose service via NLB, no routing/peering needed

VPC internals

• CIDR planning is irreversible — non-overlapping ranges before peering/TGW/hybrid
• Egress-only IGW for IPv6 outbound-only; NAT gateway for IPv4 (per-AZ for HA)
• VPC endpoints: interface (PrivateLink, per-AZ ENI) vs gateway (S3/DynamoDB, route-table entry)
• Flow Logs (metadata), Traffic Mirroring (full packets), Reachability Analyzer (path testing)

Network security & operations

• SGs stateful vs NACLs stateless; ephemeral ports 1024–65535 in NACL returns
• Network Firewall — managed stateful L3–L7 at VPC boundary; DNS Firewall for domain control
• Cloud WAN / Network Manager — global topology, monitoring, segmentation
• BGP: local-pref controls outbound, AS-path prepending/med influence inbound