AWS Advanced Networking Specialty Course

The AWS Certified Advanced Networking Specialty exam validates designing, implementing, and operating complex AWS network architectures. Network design starts with a clear topology. AWS Transit Gateway acts as a hub that interconnects VPCs and on-premises networks, reducing complex peering. VPC sharing lets multiple accounts use shared subnets, and AWS PrivateLink exposes services privately through endpoints. Gateway Load Balancer routes traffic through virtual appliances, and Amazon VPC Lattice manages service-to-service connectivity with routing and policy controls. Route 53 Resolver connects VPC DNS to on-premises DNS, while AWS Outposts extends AWS infrastructure to customer sites. Architects choose these building blocks based on scale, security, cost, and operational boundaries.

VPC routing and segmentation control how traffic moves and where boundaries exist. Route tables define the path for each subnet, and associations bind subnets to the correct table. Internet gateways provide public connectivity, NAT gateways give private instances outbound access, and egress-only internet gateways handle IPv6 outbound traffic. VPC peering connects VPCs directly without transitive routing, while prefix lists simplify security and route rules by grouping CIDRs. Network ACLs filter traffic at the subnet boundary and are stateless, so both inbound and outbound rules must be planned. Segmentation separates workloads into private and public tiers, uses multiple subnets and route tables, and isolates environments for security and compliance.

Hybrid connectivity links on-premises networks to AWS. AWS Direct Connect provides private physical connections with predictable performance, and Direct Connect Gateways connect those links to VPCs across accounts and Regions. Site-to-Site VPN creates encrypted IPsec tunnels over the internet, virtual private gateways terminate VPN connections, and BGP exchanges routes with on-premises routers. AWS Client VPN connects individual remote users, and VPN CloudHub links branch offices through one hub. Transit Gateway VPN attachments centralize connectivity at the hub. For DNS, Route 53 Resolver forwards queries between VPCs and on-premises, and private hosted zones resolve internal names. Engineers select connectivity based on latency, bandwidth, cost, security, and reliability requirements.

Edge services improve performance, availability, and security for global users. Amazon CloudFront caches content at edge locations, and origins hold the original content. Signed URLs and signed cookies restrict access to private content. Origin failover uses origin groups and health checks to switch to a backup origin. Route 53 offers routing policies such as latency routing, weighted routing, geolocation routing, and failover routing. AWS Global Accelerator uses edge locations and the AWS backbone to route TCP and UDP traffic to healthy endpoints, improving latency and availability. AWS WAF protects applications at the edge by filtering HTTP requests. Engineers combine CloudFront, Route 53, Global Accelerator, and WAF to deliver fast, resilient, and secure experiences worldwide.

Network security and operations complete the lifecycle. Security groups act as stateful resource firewalls, network ACLs filter subnet traffic, and AWS Network Firewall inspects VPC traffic with rule groups. AWS WAF protects web applications, and AWS Shield Advanced defends against DDoS attacks. Traffic Mirroring copies packets for inspection, while VPC Flow Logs record traffic metadata. AWS Firewall Manager centralizes firewall policies across accounts. For operations, Reachability Analyzer tests network paths, Network Access Analyzer finds unintended access, and Transit Gateway Network Manager visualizes global networks. VPC IPAM plans addresses, CloudWatch Internet Monitor tracks user-to-AWS performance, and AWS Config and CloudTrail record configuration and API activity. Teams combine layered controls, monitoring, and automated response.