AWS is retiring ANS-C01. December 31, 2026 is the last day to sit it, and no replacement exam has been announced. Certifications earned before then stay valid for the usual three years.
See the full timelineValidate your ability to design, implement, manage, and secure AWS and hybrid network architectures at scale. This exam covers network design, implementation, management, operations, and network security, compliance, and governance.
No sign-up — instant feedback after every question
Get instant feedback after each question. See explanations and track your progress as you learn.
Timed session with no feedback until the end. Experience real exam conditions and test your knowledge.
10 questions · pick a topic · 5 minutes · shareable
Every in-scope networking service, hybrid connectivity pattern, and routing decision the ANS-C01 exam actually tests — organised by the four exam domains with reference architectures and troubleshooting playbooks
The AWS Certified Advanced Networking - Specialty (ANS-C01) validates deep expertise in designing, implementing, managing, and securing AWS and hybrid network architectures at scale. It covers VPC design, Direct Connect, Transit Gateway, Route 53, load balancing, VPN, BGP routing, and network security services like Network Firewall, WAF, and Shield.
This exam is for network engineers and architects with 5+ years of networking experience, including 2+ years working with AWS and hybrid cloud networks. You should be comfortable with BGP, IPsec, DNS, VLAN configuration, Direct Connect setup, Transit Gateway design, and AWS security constructs. It's the hardest AWS certification for anyone without deep networking experience.
Read the full AWS Advanced Networking Specialty certification guide
The ANS-C01 exam has 65 questions (50 scored, 15 unscored) in multiple-choice and multiple-response format. You have 170 minutes and need a scaled score of 750 out of 1000 (approximately 75%) to pass. The exam is available at Pearson VUE and online. The cost is $300 USD.
Recommended experience: 5+ years of networking experience with 2+ years of cloud and hybrid networking. Deep understanding of BGP, DNS, IPsec, VLANs, and AWS networking services.
Written in the style of the real exam. Answer each one, then open the answer to check.
Question 1 · Network Design
A company is redesigning communication between 120 HTTP-based microservices that run on Amazon ECS, AWS Lambda, and Amazon EC2 across 25 AWS accounts in one AWS Region. Many of the VPCs use overlapping CIDR blocks. Services must call each other by name, and the security team wants service-to-service access to be controlled with IAM-based authorization policies instead of IP-based rules. The company wants to minimize the number of network components it must manage. Which combination of steps will meet these requirements? (Select TWO.)
Answers: A, D
Options A and D are correct: VPC Lattice connects services across accounts and VPCs through a service network shared with AWS RAM, works with overlapping CIDR blocks, gives each service a DNS name, supports ECS, Lambda, and EC2 targets, and evaluates IAM auth policies on each request. Option B adds transit gateway routing and NAT layers to manage and still relies on IP-based controls. Option C works with overlapping CIDR blocks, but hundreds of load balancers and endpoints create far more components. Option E is not possible because VPC peering does not support overlapping CIDR blocks.
Sources: AWS documentation 1, AWS documentation 2, AWS documentation 3
Question 2 · Network Implementation
A company connects its data center to AWS through a 1 Gbps AWS Direct Connect hosted connection. A transit virtual interface (VIF) connects to a Direct Connect gateway that is associated with a transit gateway. A new compliance rule requires all traffic between the data center and the VPCs to be encrypted in transit. The traffic must not cross the public internet, and the encryption endpoints must not use public IP addresses. Which solution will meet these requirements?
Answer: C
Option C is correct: a private IP Site-to-Site VPN runs IPsec tunnels over the Direct Connect transit VIF to the transit gateway by using private IP addresses, so traffic is encrypted, stays off the internet, and uses no public endpoints. Option A fails because MACsec is not supported on hosted connections and is offered only on dedicated connections of 10 Gbps and above. Option B encrypts the traffic but the VPN endpoints use public IP addresses. Option D sends encrypted traffic over the public internet.
Sources: AWS documentation 1, AWS documentation 2
Question 3 · Network Security, Compliance, and Governance
A company's security team wants to reduce the risk of data exfiltration from a VPC. Amazon EC2 instances in private subnets access Amazon S3 through an S3 gateway VPC endpoint and have no other route out of the VPC. The team must ensure that data from this VPC can be written only to S3 buckets owned by accounts in the company's organization, even if a user on an instance supplies access keys for an AWS account outside the organization. Which solution will meet these requirements?
Answer: B
Option B is correct: a VPC endpoint policy applies to every request that passes through the endpoint, whatever credentials are used, and the aws:ResourceOrgID condition limits those requests to buckets owned by accounts in the organization. Option A fails because SCPs apply only to principals in the organization, so credentials from an outside account are not affected. Option C allows traffic to every S3 bucket in the Region, including buckets owned by others. Option D protects the company's own buckets but does nothing to stop writes to buckets outside the organization.
Sources: AWS documentation 1, AWS documentation 2, AWS documentation 3
These sample questions are not part of the ANS-C01 practice exam, so you won't meet them again when you take it.
This practice exam has 65 questions, and exam mode gives you 170 minutes to answer them. The real ANS-C01 exam has 65 questions (50 scored and 15 unscored) in 170 minutes, so a full attempt here is the same length. Practice mode has no timer.
In format, yes: questions are multiple choice (one correct answer) or multiple response (two or more), spread across the 4 exam domains in close to the weights the official exam guide gives them. Scoring differs: AWS reports a scaled score from 100 to 1,000 and you pass at 750, while this practice exam shows the raw percentage you got right. For how hard the exam is, whether it is worth it and how long to study, read our AWS Advanced Networking Specialty certification guide.
Aim for 80% or more, consistently, on full-length attempts in exam mode, not just once. That leaves a margin over the 750 out of 1,000 you need on the real ANS-C01 exam, whose questions will all be new to you. Repeat attempts here show the same questions, so judge yourself by first attempts and by whether you can explain each answer. No practice score guarantees a pass.
No. The ANS-C01 practice exam is free and needs no account. Your progress and score history are saved in this browser, so they stay on this device and are lost if you clear your browser data.
Start in practice mode, which tells you after each question whether you were right and explains the answer. When you score well there, switch to exam mode: 170 minutes and no feedback until the end, like test day. Your results break the score down by domain, so you can see which domains to study before your next attempt.
Studying for more than one certification? All our practice tests are free.