AWS Certified Advanced Networking Specialty Course [ANS-CO1]

Create an AWS free tier account and configure security and account settings. Set up the tools used in the course to develop practical expertise for the exam.

Learn how to create and manage an AWS account using IAM for users, groups, and policies, avoid root access, and authenticate via console, CLI, or API.

Explore AWS account types, free plan vs paid plan, with $100 signup credits and $100 for actions, and learn how to set up a free tier account and cost controls.

Configure your AWS account by creating an account alias, enabling IAM billing access, and setting up a monthly budget with alerts to monitor spending and receive email notifications.

Install the required tools for this course. Download the code from GitHub, install Visual Studio Code and the AWS CLI, and configure credentials via an IAM user for CloudShell access.

Explore fundamental networking concepts such as bandwidth, latency, IP addressing, OSI model, routing, switching, NAT, and firewalls, with a preview of AWS topics like WAF and NAT gateways.

Connect to services by understanding client–server roles, networks, and dns translation from domain names to ip addresses, using http/https on ports 80 and 443.

Explore OSI model from physical to application, detailing layer 2 MAC, layer 3 IP routing, layer 4 TCP/UDP, and layer 7 HTTP; AWS focuses on layers 3, 4, and 7.

Differentiate layer 3 routing from layer 2 switching, and explore subnets, IP addressing, default gateways, plus VLAN tagging and WAN concepts that connect local networks across AWS.

Explore virtual private networks, a point-to-point encrypted tunnel connecting data centers and remote users over the internet, with authentication and IPSec protection.

Learn ipv4 and ipv6 addressing, dotted decimal notation, binary octets, and subnet masks, to identify network and host IDs. Explore RFC 1918 private ranges, NAT, and AWS VPC implications.

Explore IPv4 and IPv6 subnet calculators, learn network and broadcast addresses, usable hosts, and how subnet masks like 24 and 23 affect subnet size.

Learn how network address translation (NAT) extends IPv4 by mapping private internal addresses to a single public IP on the router, enabling many devices to reach the internet.

Analyze how bandwidth and latency measure network performance. Bandwidth is the data transfer rate in gigabits per second, while latency reflects distance-driven delays, including propagation, transmission, queuing, and processing.

Discover how firewalls protect web, application, and database layers, with stateful and stateless filtering, intrusion prevention, and TLS-based end-to-end encryption.

Explain how the domain name system resolves domain names to IP addresses, using recursive queries and root, TLD, and authoritative servers, with A, MX, CNAME, TXT, and SOA records.

Explore the core concepts of Amazon VPC fundamentals, including CIDR blocks, prefix lists, secondary CIDR blocks, routing, security groups, network ACLs, NAT gateways and NAT instances, and AWS Local Zones.

Explore creating a logically isolated VPC within a region, mapping subnets to availability zones, and configuring route tables and internet gateways with CIDR blocks to manage public and private spaces.

Master AWS VPC CIDR blocks and subnets by sizing and subdividing ranges, avoiding overlaps, and planning for public, private, and isolated subnets across multiple availability zones for fault tolerance.

Explore creating a virtual private cloud, using the wizard or manual steps, with public and private subnets across two availability zones, an internet gateway, and dns and route table configurations.

Create and manage secondary CIDR blocks for VPCs in the AWS console, test public and private CIDRs and IPAM CIDRs, and review AWS managed and custom prefix lists, including CloudFront.

Explore the differences between public and private subnets in a VPC, detailing public IP assignment, internet gateway routing, private subnet isolation, and how a NAT gateway enables outbound internet access.

Explore multiple ways to connect to Amazon EC2 instances in public and private subnets, including SSH with key pairs, Instance Connect, and Session Manager via VPC endpoints.

Learn to connect to EC2 instances using key pairs and SSH, deploy a custom VPC with public and private subnets, and access the private instance via a bastion host.

Learn to connect to an EC2 instance in a private subnet using a VPC instance connect endpoint for private SSH access.

Master VPC routing with longest prefix matches, choosing between NAT gateway and internet gateway, and managing static routes, propagated routes, and prefix lists.

Explain security groups and network ACLs in AWS, highlighting stateful versus stateless firewalls, instance versus subnet scope, and the allow/deny rule behavior controlling traffic.

Explore configuring security groups and network ACLs in AWS, including SG1 and SG2, inbound/outbound rules for SSH, HTTP, and ICMP, security group chaining, and stateless NACL behavior.

Understand NAT gateways and NAT instances for internet connectivity from private subnets: NAT gateways in public subnets use elastic IPs with automatic high availability, unlike NAT instances.

Connect to a private subnet instance via a bastion, set up a NAT gateway in a public subnet with an elastic IP, and route 0.0.0.0/0 through it.

Explore AWS local zones, extensions of a region in major cities that bring local compute, storage, and networking closer to end users, reducing latency.

Explore Amazon VPC fundamentals, including VPC components, subnets across availability zones, route tables, internet gateways, CIDR blocks, and security with security groups and network ACL rules.

Explore compute options with Amazon EC2, elastic network interfaces, and IP addressing, then examine Application Load Balancer, Network Load Balancer, Gateway Load Balancer, ECS, EKS, and API Gateway deployments.

Compare ENI, ENA, and EFA network interfaces for EC2 in a VPC, covering general networking and high-performance computing.

Explore EC2 placement groups to optimize deployment: cluster placement groups deliver low latency and high throughput, partition groups isolate workloads across racks, and spread groups maximize hardware isolation for critical instances.

Explain public, private, and elastic IPs within VPCs and subnets, detailing ENIs, address mappings to public IPs, and how elastic IPs stay static and move across instances.

Learn how nat handles public addresses by using internet gateway to perform one-to-one translation between an EC2 private ip and a public (elastic) ip, with external translation outside the instance.

Launch and manage EC2 instances in a VPC, attach elastic network interfaces, and work with public and private IP addresses, including elastic IPs and DNS name.

Explore how Amazon elastic load balancing ensures high availability by distributing traffic across EC2, ECS, IP addresses, and Lambda; compare application, network, and gateway load balancers, health checks, and auto-scaling.

Create and test an auto scaling group for EC2 instances using a launch template and user data to install Apache, across two availability zones, and verify health checks and replacement.

Create an application load balancer in front of an auto scaling group, use a target group for dynamic instance registration, and verify HTTP health checks across two availability zones.

Create a dynamic scaling policy for an auto-scaling group, raise max capacity to four, distribute across availability zones, and use ALB request count per target with CloudWatch alarms to scale.

Design auto-scaled apps by externalizing session state to fast key-value stores like DynamoDB or ElastiCache, and consider sticky sessions with external storage to maintain seamless authentication during failures.

Secure listeners for elastic load balancers implement SSL TLS encryption by provisioning ACM certificates and attaching them to the load balancer and application instances, delivering encryption in transit.

Launch an application load balancer and secure it with a TLS certificate from AWS Certificate Manager, deploying across two availability zones with CloudFormation and Route 53 DNS validation.

Launch a network load balancer exposing a custom tcp port 8181, behind two EC2 instances in a target group, with elastic IPs and whitelisted IPs.

Deploy gateway load balancers to route traffic through security appliances at layer 3 via the Geneve protocol (port 6081) and examine endpoints and private link deployment models for inline inspection.

Explore how Amazon ECS runs containers with clusters, tasks, definitions, and images in ECR, and compare EC2 and Fargate launch types with service-based scaling and load balancing.

Explore Amazon elastic kubernis service (eks), a managed service for running Kuberites applications across aws or on-prem, with containerized workloads, autoscaling, load balancing, and EKS anywhere.

Discover how Amazon API gateway provides a single entry point for REST, HTTP, and WebSocket APIs, routing requests to backend services and managing resources, methods, stages, caching, and encryption.

Learn about edge-optimized, regional, and private rest api deployment types, including cloudfront-based global latency, regional latency benefits, and vpc endpoint private access.

Create a rest api with Amazon API Gateway and a Python 3.9 Lambda, exposing a hello resource with a get method via Lambda proxy integration and deploy to prod.

Explore compute and elastic load balancing in AWS, covering EC2 networking with ENIs, IP addressing, MTU, and ECS/EKS auto scaling and pod networking with ALB, NLB, and gateway load balancers.

Explore advanced Amazon VPC, DNS, edge computing, and Global Accelerator topics, including Route 53 Resolver, CloudFront, AWS Organizations, IPv6, with hands-on VPC peering, endpoints, and cross-account access.

Explore how AWS Organizations centralizes multiple accounts with consolidated billing under a management account and organizational units, applying service control policies and tag policies.

Create an AWS organization with a management account, add production accounts, and attach a service control policy to the production OU; switch roles to administer accounts with full permissions.

Learn how VPC peering creates a private network connection between two VPCs, enabling private, low-latency, high-bandwidth communication within AWS with non-overlapping CIDR blocks.

Configure cross-account VPC peering between two VPCs, update route tables, and set security group rules to enable private IP connectivity and test with ICMP ping and SSH.

Explore how VPC endpoints provide private connectivity to AWS services like S3 and DynamoDB, avoiding internet exposure. Compare interface and gateway endpoints and their routing and policies.

Configure a VPC endpoint gateway for Amazon S3, applying endpoint and bucket policies to control access from EC2 instance. Verify routing and access through the endpoint by running S3 commands.

Discover how DNS maps domain names to IP addresses via zone files and records, and how Route 53 handles domain registration, hosted zones, health checks, and routing policies.

Explore dns name resolution using aws route 53 hosted zones, a records, and cnames, with a practical look at propagation to authoritative name servers and mx records.

learn to register a domain with Route 53, review domain options, auto renew settings, and hosted zone creation, while understanding potential AWS support steps for registration issues.

Learn to work with Route 53 hosted zones and records, create public and private zones, add TXT and A records, and verify DNS with nslookup in CloudShell.

Enable DNSSEC signing in Route 53, create a key signing key in KMS, and publish a DS record at your registrar to establish a chain of trust for hosted zones.

Configure dhcp option sets to auto-assign ip addresses and domain name servers in a vpc, enabling dns hostnames and route 53 resolver.

Learn how to create and apply DHCP option sets to VPCs, customize domain naming such as example.com and DNS servers, and understand how DHCP affects instance hostnames and DNS resolution.

Explore how Route 53 Resolver enables DNS resolution between a VPC and on-premises networks using inbound and outbound endpoints and conditional forwarding rules.

Learn how CloudFront signed URLs and signed cookies control access with expiration and IP restrictions. Explore origin access identity and origin access control for securing S3 buckets via bucket policies.

Deploy a CloudFront distribution with an S3 origin hosting index.html, configure origin access control, and provision a TLS certificate via certificate manager while routing DNS through Route 53.

Explore how CloudFront SSL/TLS, ACM certificates, and SNI enable secure, scalable delivery for S3 and custom origins, including domain name mappings and certificate management.

Discover how AWS Global Accelerator uses edge locations and static anycast IPs to route users to the optimal endpoint across the AWS global network, lowering latency for TCP and UDP.

Launch a global accelerator in two regions with network load balancers behind cloud formation templates, running a custom TCP Python app on port 8181, and validate regional failover.

Bring your own IP addresses to AWS, creating provider independent address space assignable to EC2, load balancers, and NAT gateways, with five IPv4 and IPv6 ranges per region.

Learn how IPv6 works in a VPC, including 128-bit addresses, AWS's 56 IPv6 address range, 64-address subnets, and using an egress-only internet gateway for outbound traffic.

Configure IPv6 in a VPC using the AWS console, including an IPv6 cidr block, subnets, routes, security groups, and ICMPv6, then launch EC2 instances and connect via IPv6.

Explore advanced VPC peering and edge-to-edge routing limits. Learn about VPC endpoints, S3 and DynamoDB gateway endpoints, Route 53 DNS, CloudFront security features, and BYOIP address ranges.

Explore an introduction to BGP for hybrid cloud networking on AWS, and learn VPC routing, VPN options, Direct Connect, Transit Gateway, VPC sharing, Outposts, and CloudFormation.

Explore border gateway protocol (BGP), the exterior routing protocol that exchanges routes between autonomous systems, and learn how it integrates with AWS direct connect, site-to-site VPNs, and transit gateway.

Discover how route priority in a VPC works by analyzing overlapping routes, longest prefix match, and the choice between local, propagated, and static routes, including prefix lists.

Use AWS VPC Reachability Analyzer to validate connectivity paths, Network Access Analyzer to reveal risky access, Inspector for vulnerability checks, and Verified Access for private app access without VPN.

Explore how AWS client vpn provides a fully managed, openvpn-based ssl tls connection for remote users to access vpc resources, with flexible authentication options and scalable cross-platform support.

Create secure site-to-site vpn connections using a virtual private gateway and customer gateway, with ipsec tunnels and redundancy through two tunnels; configure static or bgp dynamic routing for vpc access.

Explore AWS VPN CloudHub, a hub-and-spoke topology that connects branch offices to a VPC via site-to-site VPNs, using a VGW, unique BGP ASNs, and route tables to control IPsec traffic.

Explore AWS Direct Connect architecture, including private and public virtual interfaces, hosted vs dedicated connections, encryption options, and high-availability strategies for linking data centers to AWS.

Learn how AWS Direct Connect gateway connects VPCs across regions as a globally available resource, using private virtual interfaces and virtual private gateways, with transit gateway options and key limitations.

Explore AWS transit gateway as a central hub that simplifies connectivity among VPCs and on-prem networks, enabling transitive routing, VPN and Direct Connect integration, and scalable, efficient routing.

Explore AWS resource access manager (RAM) to share resources like subnets and databases across accounts and OUs within an AWS organization, using RAM console, API, CLI, or SDK.

Share a subnet across accounts using AWS RAM, configure security group rules for ICMP, launch EC2 instances in a shared VPC, and verify connectivity via private IP addresses.

Explore AWS outposts for hybrid cloud, with on-premises servers and racks delivering local AWS services at the edge, VPC extension, and low-latency connectivity to regions via VPN or Direct Connect.

Define infrastructure as code with AWS CloudFormation templates in JSON or YAML, and deploy via stacks that create and update resources; use change sets to preview changes.

Deploy a VPC with public and private subnets across two availability zones using CloudFormation, including an internet gateway, route tables, and parameters for environment name and subnet cidr blocks.

Explore border gateway protocol concepts, autonomous systems, and key BGP attributes like local preference, AS path length, and MED for routing decisions.

Explore AWS network security, including VPC flow logs, traffic mirroring, encryption in transit with SSL/TLS and KMS, and monitoring with CloudWatch and CloudTrail.

Configure traffic mirroring in a vpc to copy traffic from an elastic network interface. Route to a network load balancer with filters, udp 4789, and vxlan IDs.

Learn how AWS config uses rules to define the desired state of resources and continuously evaluate compliance, with managed and custom rules, notifications, and automated remediation.

Create an AWS config rule to detect security groups allowing access from any source to ports other than 80, and remediate with SSM automation using an IAM role.

Explore AWS network firewall and DNS firewall to protect VPCs with stateful and stateless controls, intrusion prevention, web filtering, and centralized policy management via AWS firewall Manager.

Explore how AWS firewall manager centrally manages WAF, SHIELD, network firewall, and Route 53 resolver DNS firewall across your organization, with policy tools and auto remediation.

Discover how AWS web application firewall (WAF) uses web ACLs and rules to filter traffic, block SQL injection and cross-site scripting, and protect resources behind CloudFront, ALB, or API Gateway.

Discover how AWS Shield provides managed DDoS protection with always-on detection and automatic inline mitigations, integrates with CloudFront, and compare standard and advanced tiers for uptime and latency.

Explore the differences between encryption in transit and at rest, and between symmetric and asymmetric encryption, including SSL/TLS, data encryption keys, and AWS storage and network protections.

Explore network encryption in transit across AWS services like VPC, EC2, and EBS, including cross‑region, AZ, and direct connect traffic, with TLS/SSL, TLS 1.2, and MacSec options.

Explore how the AWS Key Management Service creates and manages symmetric and asymmetric KMS keys, protected by hardware security modules, and integrates with many AWS services.

Use AWS Certificate Manager to issue, store, and renew SSL TLS x.509 certificates for encryption in transit, including single-domain, multi-domain, and wildcard options, private certificate authorities, and third-party imports.

Create an ACM certificate via dns validation, attach it to a CloudFront distribution serving an S3-hosted static site, and enforce http to https with a Route 53 domain.

Explore Amazon CloudWatch as a performance monitoring service with metrics, alarms, and logs, using the unified CloudWatch agent to collect memory and disk usage for EC2 resource optimization.

Explore how AWS CloudTrail records API calls—who, what, resources, and when—and how to centralize logs with trails, CloudTrail Lake, and cross-account storage for auditing and compliance.

Record network activity events in CloudTrail for a VPC with S3 gateway endpoints and EC2 instance connect endpoints, and view logs from S3 via a VPC endpoint policy.

Explore traffic mirroring and flow logs to inspect traffic and monitor threats, and implement DNS firewall, WAF, Shield, and encryption to protect resources.