Exam Overview
Exam Details
- Duration: 170 minutes
- Questions: 65
- Passing Score: 750/1000
- Format: Multiple choice & multiple response
- Cost: ~$150-300 USD
- Validity: 3 years
Exam Domains
| Domain | Weight |
|---|---|
| Network Design | 30% |
| Network Implementation | 26% |
| Network Management & Operations | 20% |
| Network Security & Governance | 24% |
Advanced VPC Design
- Use /16 VPCs — 65,536 IPs; /24 subnets — 251 usable IPs (AWS reserves 5)
- Non-overlapping CIDRs across all VPCs required for peering/TGW
- Secondary CIDRs — add up to 5 CIDR blocks to a VPC (e.g., EKS pods)
- VPC Sharing (RAM) — share subnets from central VPC to multiple accounts
VPC Endpoints Deep Dive
| Type | Services | Cost |
|---|---|---|
| Gateway Endpoint | S3, DynamoDB only | Free |
| Interface Endpoint (PrivateLink) | 150+ AWS services | $0.01/hr + data |
| GWLB Endpoint | Third-party appliances | $0.01/hr + data |
Route 53 Routing Policies
| Policy | Use Case | Key Detail |
|---|---|---|
| Simple | Single resource | Can return multiple values; client picks |
| Weighted | A/B testing, gradual migration | Assign weights 0-255; 0 = stop traffic |
| Latency | Route to lowest-latency region | Based on AWS latency data |
| Failover | Active-passive DR | Primary/Secondary; health check required |
| Geolocation | Route by user's geography | Country/continent; default for unmatched |
| Geoproximity | Route by proximity with bias | Traffic Flow only; bias expands/shrinks regions |
| Multi-Value | Simple load balancing | Up to 8 records; health checked |
| IP-Based | Route by client CIDR | Map IP ranges to endpoints |
CloudFront Advanced
- OAC (Origin Access Control) — restricts S3 to CloudFront only (replaces OAI)
- Lambda@Edge — all 4 request/response phases; 5-30s timeout; Node.js/Python
- CloudFront Functions — viewer req/res only; sub-millisecond; JavaScript; cheapest
- Signed URLs — single file access; Signed Cookies — multiple files (video streaming)
- Origin Groups — primary + failover origin; auto-failover
📋 Study Checklist
Progress0%
- Design multi-VPC architectures with non-overlapping CIDRs
- Know all 3 VPC Endpoint types and when to use each
- Design DX with primary + backup VPN
- Understand BGP: AS_PATH prepending, Local Preference, MED
- Design TGW with route table segmentation and Appliance Mode
- Know all 8 Route 53 routing policies and use cases
- Design hybrid DNS with Route 53 Resolver endpoints
- Configure CloudFront with OAC, Lambda@Edge, signed URLs
- Know Network Firewall stateful vs stateless rule groups
- Design IPv6 dual-stack VPCs with Egress-Only IGW
- Know VPC Flow Log format and Athena analysis
- Design multi-region active-active with Route 53 + health checks
- Understand AWS Global Accelerator for TCP/UDP workloads
- Know PrivateLink and VPC Endpoint Services
- Understand prefix lists for CIDR management
- Know ELB cross-zone load balancing behavior
- Design AWS Global Network vs public internet routing
- Understand BGP communities for DX routing
- Configure Transit Gateway Connect with GRE tunnels
- Know Direct Connect Gateway for multi-region VPC access