ANS-C01 now has a hard planning constraint: AWS will retire the exam on December 31, 2026. A late-2026 study plan should therefore prioritize the current blueprint, practical troubleshooting, and exam scheduling rather than endlessly expanding into adjacent AWS services. The current ANS-C01 weights are 30% Design, 26% Implementation, 20% Operations, and 24% Security.
Phase one: rebuild core IP, routing, and DNS fundamentals
Review IPv4/IPv6 addressing, subnetting, routing, BGP, DNS records/TTL/delegation, TLS/IPsec, and high-availability concepts. Advanced cloud networking becomes much easier when the underlying protocols are automatic.
Do not begin by memorizing AWS console locations.
Phase two: master VPC routing and endpoints
Build a reference environment with public/private subnets, route tables, internet gateway, NAT, endpoints, security groups and NACLs. Add a VPC design and one NAT Gateway path.
Then break one route or security rule and diagnose from effective behavior.
Phase three: add multi-VPC and multi-account connectivity
Compare VPC peering, Transit Gateway and centralized network patterns. Practice route-table segmentation and propagation rather than attaching everything to one flat hub.
A peering lab is useful precisely because it shows the nontransitive limitation.
Phase four: build hybrid networking
Study Site-to-Site VPN, Direct Connect, BGP route exchange, redundancy, active/standby paths and failover. Diagram customer gateway, AWS gateway or Transit Gateway, route propagation and return traffic.
Always include DNS and security dependencies; hybrid failures are rarely “the circuit only.”
Phase five: learn Route 53 and hybrid DNS deeply
Practice public/private hosted zones, alias records, health checks, routing policies, Resolver endpoints and resolver rules. Build one split-horizon or hybrid-resolution scenario.
A Route 53 model should let you explain why a name resolves differently inside and outside the VPC.
Phase six: add edge and load-balancing services
Compare CloudFront, Global Accelerator and ELB based on protocol, caching, global path, failover and backend requirements. Use one global application and design several alternatives.
Then explain which health check or routing policy controls failover in each design.
Phase seven: automate the network
Use CloudFormation, CDK, Terraform-style concepts or AWS APIs to create repeatable networking. Version route tables, security policies and DNS rules where practical.
Staged deployment and validation matter because an automated network error can affect many accounts or Regions quickly.
Phase eight: make operations evidence-driven
Practice VPC Flow Logs, CloudWatch metrics/logs, route inspection, load-balancer health, Direct Connect/VPN status and connectivity analysis. Establish known-good baselines before introducing failures.
The operations domain should feel like a troubleshooting workflow, not a list of monitoring services.
Phase nine: integrate security and governance
Review security groups, NACLs, AWS Network Firewall, WAF, Shield, IAM, encryption and network segmentation. Add centralized inspection and logging to the multi-account architecture.
Security controls should preserve required traffic paths while reducing unnecessary trust.
Finish with scheduling-aware mixed scenarios
Use current AWS exam-guide scenarios that combine DNS, routing, hybrid connectivity, security and operations. Time full sessions and schedule the actual exam early enough to leave a realistic buffer before December 31.
Keep one reference architecture throughout the plan: two accounts, three VPCs, two Regions, one on-premises network, shared DNS, central inspection, and one public application. Every new topic should attach to this environment so the study sequence grows in complexity without losing context.
During IP planning, allocate non-overlapping CIDR ranges with room for growth. Add IPv6 at the design stage rather than after every IPv4 route is fixed. Hybrid networking becomes dramatically harder when on-premises and cloud ranges overlap.
During VPC routing, capture the route table and security state for a known-good path. Then add one VPC endpoint and compare where traffic goes. This makes private service access more concrete than reading endpoint definitions.
During Transit Gateway study, create separate route tables for shared services and isolated workloads. Associate/propagate VPCs intentionally and verify that one prohibited path stays unreachable. The lab should demonstrate segmentation, not only connectivity.
During hybrid study, draw two independent Direct Connect paths or one Direct Connect plus VPN backup. Decide which BGP route should win and what evidence indicates failover. Resiliency should be designed before a circuit fails.
During BGP study, practice route selection with prefix length and policy rather than memorizing AWS service diagrams. Create a scenario where a more-specific VPN route unexpectedly beats a Direct Connect route and explain how to restore the intended path.
During DNS study, build a split-horizon case where public users resolve an internet endpoint and internal users resolve a private endpoint. Add a resolver rule for on-premises names and verify that no forwarding loop exists.
During edge-service study, use one global application and compare CloudFront, Global Accelerator, Route 53 latency/failover policies, and regional load balancers. Identify which layer makes each decision and what health signal it uses.
During load-balancer study, create one unhealthy target and inspect the effect. Then change only the health probe/check so the target returns. This reinforces that a reachable instance can still be excluded from traffic because the load balancer evaluates application health.
During automation study, deploy one network stack repeatedly in two accounts or Regions with parameters. Validate CIDR, tags, route ownership, and security before promotion. A working template is not enough if it can accidentally connect environments that should remain isolated.
During monitoring study, enable VPC Flow Logs and one service-specific log source. Generate allowed and denied traffic and compare what each log can prove. Learn the difference between “packet never routed,” “security denied,” and “target unhealthy.”
During security study, trace one internet request through Route 53, edge service, load balancer, security group, network firewall/WAF if present, and target. Then mark the place where TLS terminates and which component logs the request.
Add a centralized-egress cost exercise. Route several VPCs through a shared NAT/inspection path and estimate where Transit Gateway, NAT, inter-AZ, and data-transfer charges can appear. Then compare with distributed egress and VPC endpoints.
Add one multi-Region DR networking scenario. Decide how Route 53 or Global Accelerator changes traffic, how DNS TTL/health affects failover, how data/service state is replicated, and which routes/security policies already exist in the recovery Region.
Use the last study block for failure injection: delete or change a route, break DNS forwarding, withdraw a BGP prefix, deny a security rule, fail a health check, or mis-associate a Transit Gateway route table. Diagnose from evidence before looking at the change history.
Schedule the real exam with buffer. Because December 31 is the retirement date, aim early enough that unexpected illness, test-center issues, or a first failed attempt do not remove every recovery option. Credential timing is now part of the study strategy.
Before exam day, rebuild the 30/26/20/24 weights and the four domains from memory. Then name one reference-architecture component and one failure mode for each domain. If a domain is represented only by service names, return to a troubleshooting or design scenario.
Add one MTU and packet-size exercise during hybrid networking. Send controlled traffic with different packet sizes and reason about fragmentation or path MTU discovery across VPN or other links. Large-packet failures can be intermittent and are easy to misdiagnose as application instability.
Add one Route 53 failover exercise where the DNS record changes but a stale resolver cache delays client movement. This demonstrates why TTL, health checks, and application recovery time all contribute to observed failover.
Add one PrivateLink exercise after Transit Gateway. Publish or consume a simple service through an interface endpoint and compare the trust model with full VPC connectivity. Private service access is easier to understand once you have seen broader routing first.
Add one Gateway Endpoint exercise for an AWS service and inspect the route-table entry or policy. Compare the behavior with NAT-based internet access and interface endpoints. This creates a clearer mental model of how service traffic can stay on AWS private networking.
Add one centralized-firewall design with separate ingress, egress, and east-west requirements. Decide which flows truly need inspection and where route symmetry matters. Over-centralizing every packet can increase cost and complexity without proportional security benefit.
Add one Cloud WAN or global transit review if your environment is enterprise-scale. Compare policy-driven global networking with per-Region Transit Gateway designs. The exam can test architecture beyond a single Region, so your study model should scale conceptually even if the lab does not.
Add one DNS ownership/governance exercise across accounts. Decide who owns public zones, private zones, resolver rules, and forwarding endpoints, and how changes are reviewed. Shared DNS is a high-blast-radius service and deserves stronger operational discipline than an application-specific record.
Add one change-attribution incident using CloudTrail. Change a route or security group in a lab, then find the API event and principal. This makes “who changed the network?” a standard troubleshooting question rather than a last resort.
Add one cost-driven redesign. Take a path with NAT plus Transit Gateway plus inter-AZ traffic and calculate conceptually where processing/transfer costs arise. Then redesign using endpoints, distributed egress, or placement changes without violating security or resilience.
Add one application-path exercise from a global user to a private backend: Route 53 or Global Accelerator, CloudFront/ALB where relevant, VPC routing, security, target health, and return path. End-to-end tracing is the fastest way to integrate all four domains.
Use the final days to review AWS service quotas and feature limitations that can change a design. Route counts, attachment limits, prefix sizes, resolver capacity, load-balancer behavior, or Direct Connect capabilities can matter in scale scenarios. Learn the architectural consequences rather than memorizing every numeric quota.
Retirement should also shape resource choice. Avoid investing weeks in stale third-party materials that predate current services or exam-guide updates. Prefer the live AWS documentation, current AWS Skill Builder material, and focused labs that directly map to the current four domains.
Your final readiness test should be a whiteboard network with two Regions, three accounts, hybrid connectivity, centralized DNS/security, a global application, and clear failure paths. If you can explain packet flow, route selection, DNS, cost, security, and telemetry without looking up the basics, you are operating at specialty depth.
The Advanced Networking scope is deep enough that last-minute memorization is a poor strategy. Even if certification retirement changes the credential roadmap, the hands-on network design and troubleshooting skills remain valuable.