ESEN

← Fine print by exam

Amazon Web Services · Specialty

ANS-C01 · AWS Certified Advanced Networking - Specialty (ANS-C01)

AWS Certified Advanced Networking - Specialty

Current↗ Official guide🃏 Practice these gotchas

Hybrid private DNS (on-premises ↔ cloud)

Cost● verified 34 days ago◌ no external reviewer

Each endpoint IP is an ENI billed hourly, and the minimum is two per endpoint

Route 53 Resolver charges per ENI per hour, plus queries, and each endpoint needs at least two IPs in different AZs. Inbound plus outbound is four ENIs billing around the clock even with zero queries. In GCP the inbound policy and forwarding zones have no hourly charge. With several accounts, centralize the endpoints in the hub and share the rules with RAM instead of repeating them.

Helps with:ANS-C01SAA-C03
⚑ Report outdated

See it in the pattern →

See it in the pattern →

See it in the pattern →

Networking● verified 34 days ago◌ no external reviewer

A forward rule beats a private hosted zone with the same name

If a VPC has a FORWARD rule for corp.example.com and also a corp.example.com private hosted zone, the rule wins. Among rules the most specific wins, and a SYSTEM rule excludes a subdomain from forwarding.

Helps with:ANS-C01
⚑ Report outdated

See it in the pattern →

Reliability● verified 34 days ago◌ no external reviewer

It's 10,000 QPS per IP, but with connection tracking it can drop to 1,500

Each endpoint IP handles up to 10,000 UDP queries per second. If restrictive security group rules force connection tracking (or queries go through an NLB), the inbound endpoint can drop to 1,500 QPS per IP. This module restricts the source to on-premises ranges, so plan for the low number: monitor the per-ENI metric and add IPs once it passes 50%.

Helps with:ANS-C01
⚑ Report outdated

See it in the pattern →

Private object ingestion with expiration (TTL)

Networking● verified 34 days ago◌ no external reviewer

The Gateway Endpoint is free, but only works within the VPC and region

It's a route table entry with no hourly or per-GB charge, which is why it's the default for S3. But it's not reachable from on-premises (VPN/Direct Connect) or from another region. For those cases you need an Interface Endpoint, which is billed hourly per AZ and is the real equivalent of Azure Private Endpoint.

Helps with:SAA-C03ANS-C01
⚑ Report outdated

See it in the pattern →

Zero Trust private web API with passwordless PostgreSQL

Cost● verified 34 days ago◌ no external reviewer

Fargate in a private subnet without NAT needs several paid VPC endpoints

To pull the image without internet egress, the task needs ECR (api and dkr) interface endpoints, plus the S3 gateway endpoint (where ECR stores layers). If it uses the awslogs log driver, it also needs the CloudWatch Logs interface endpoint. Each interface endpoint is billed hourly per AZ. The alternative (NAT Gateway) is also billed hourly and per GB.

Helps with:SAA-C03ANS-C01
⚑ Report outdated

See it in the pattern →