I recently passed the AWS Certified Advanced Networking – Specialty exam and want to share my experiences with those of you working toward the certification.

Summary

The exam is 170 minutes with 65 questions and compared to the professional level exams, this felt like ample time leaving more than 45 minutes to review my (many) marked questions. The question length was manageable and felt less than the pro exams, which made it easier to consume the content and move through the exam at a good pace. The questions are a mix of scenario and Q&A with scenarios making up the larger proportion.

Going in with a good understanding of networking such as TCP/IP, subnetting, routing and data center structure will help a lot. I don’t have a ‘networking’ background so I took more time to prepare and students with little or no networking experience should consider spending some extra time studying network fundamentals.

In terms of the technology specifics, I have included a list of top topics the exam focuses on along with some tips and key information. The section is limited to the top 6 +/- areas to keep this article a consumable size.

Study Resources

1. The AWS Certified Advanced Networking Study Guide

You will not often find me recommending the official text books as a number one study resource simply because I often find them hard to consume and remember. I prefer consolidated information that I can remember on test day. This study guide is specifically focused on test takers and the authors have done a great job of structuring the information in to easily consumable sections, each with its own assessment test.

I recommend taking the video courses mentioned below first while having this book on hand as a reference. Once the video courses are completed, take the assessment test in the book’s introduction to give you an idea of your strengths and weaknesses. Use the output as a guide to further research. The practice exams included in the online study tools will also help highlight areas you need to brush up and these exams are by far the closest practice exams to the real test that I found – offering much more of a read world experience than the exams included with the video courses, for example.

The 138 flash cards included with the online content are also really useful – these are not the usual ways that I choose to study but I would not have passed without this resource so it is cash well spent.

2. Video courses from acloud.guru and Linux Academy

Both of these courses are highly valuable. For those of you that have read my previous article, you know that I’m a huge advocate of both training providers and they both deliver for this certification.

Derek Morgan’s course does a great job of breaking down the concepts – everything from the basics of IPv4 and subnetting through to BGP and MPLS specifics and processes. I found the breakdown between fundamentals and deep dive really helpful. The course really helped me understand the specifics and helped me understanding the ‘right’ choice on questions where you need to reason the answer.

Ryan Kroonenburg’s course is also outstanding. The course helped me ‘get it’ and fit everything together. I loved the flow and structure and focus on flow of each of the subject areas as this is something the exam really focuses on, BGP path selection and how to influence it etc.

3. Blogs and Articles

Yujun Liang’s article on LinkedIn: https://www.linkedin.com/pulse/how-did-i-prepare-aws-advanced-networking-specialty-yujun-liang-/
Jady Liu’s article on LinkedIn: https://www.linkedin.com/pulse/most-efficient-way-study-aws-certifications-specialty-jady-liu/
Michael Kelly’s blog: https://blog.ashiny.cloud/2018/07/29/aws-certified-advanced-networking-specialty/#vpn

4. AWS Re:Invent Videos

Jady Liu’s list is all you need: https://www.youtube.com/playlist?list=PLlkukGgpsXyvUbJ85RVD7qNJ1mcGKO4_w)

In summary, get the book to maximise your chances of passing with the best score.

Top Topics, Tips and Key Information

Notes covering what I feel are the top 6 focus areas for the exam.

Direct Connect (DX) and Border Gateway Protocol (BGP)

• By far the most focused topic of the exam
• DX allows you to connect your AWS resources to your on-premises resources privately
• DX is typically more consistent and reliable than a normal internet connection
• AWS provides 1Gbps or 10 Gbps Ethernet single mode fiber-optic
  • Sub 1Gbps connections can be ordered by a partner (min 50 Mbps)
• Direct Connect locations allow you to connect to that specific region
• Supports both IPv4 and IPv6
• Reduced data-out rates. Data in to AWS is free (in almost all cases)
• Virtual interface (VIF) needed for each VPC. Connected to Direct Connect
  • Public VIF: Used to connect to AWS resources not in a VPC
    • Used for a VPN to a VGW
  • Private VIF: Used to connect to resources within a VPC
• One LOA-CFA per connection per data centre
  • LOA-CFA = Letter of Authorization Customer Facility Access
• LAGs = Link Aggregation Groups
• 100 BGP prefixs can be announced over a single private VIF (hard limit)
• S3 endpoint cannot be accessed over DX
  • Public VIF used to access S3 over a direct connect (but not the endpoint)

DX Requirements

• BGP
• BGP MD5 auth
• Single mode fibre 1000BASE-LX and 10GBASE- with 802.1q VLANs
• Auto-negotiation for the port for direct connect needs to be disabled
• You cannot change the port speed of an existing connection
• Limit on BGP (dynamic) advertised routes per route table is 100
  • Static route limit is 50 (convert to dynamic/BGP to increase amount of possible routes)
• Lowest bandwidth on DX partners is 50 Mbps

Elastic Load Balancers

• Allows you to distribute application traffic across multiple EC2 instances
• Can distribute traffic over multiple availability zones
  • Cross-zone load balancing MUST be enabled
• Two network configurations of ELBs:
  • External: Routes traffic from the internet to EC2 instances
  • Internal: Routes traffic from internal resources to EC2 instances
• Minimum IPv4 subnet size of /27, which differs from the VPC
• Cannot use AWAS WAF with ELB classic
• Terminate SSL on ELB for performance – be aware of requirements for end-to-end encryption
• x-forwarded-for header needed to see client in access logs – ALB
• Proxy protocol to enable connection information (including client IP) when using TCP or SSL for both front and back end on ELB Classic
• Use alias Route53 record

Virtual Private Networks (VPN)

• Site-to-site only using AWS VPN
• Client-to-site would be third party software running on EC2 in a VPC
• IPSec and Encapsulating Security Protocol
• IP protocol 50, port 500 UDP for IPSec
• Benefits:
  • Data encryption in transit across the internet and direct connect
  • Used to encrypt direct connect (use Public VIF for VPN termination)
• Use monitoring software (keep alive) to keep tunnel up
• Routing hard limit of 50 for static routes and 100 for dynamic routes (BGP)
• VPN connection consists of two tunnels (configure to a single customer router for HA on the AWS end)
• HA on the customer end requires two VPN connection (each provides two tunnels for mesh HA)

Route53

• Route 53 is Amazon’s DNS service
• Allows registration of domain names or use of domain names you own
• Utilises health checks to monitor health of your instances
• Public or private hosted zones
  • A public hosted zone is accessible from the internet
  • A hosted zone is named after a domain name that you own
  • A private hosted zone can be any domain you wish as it does not traverse the public internet
• A reusable delegation set can be used to create a set of name servers to use for multiple domains
• Record specific information:
  • CNAME: Not free for queries, points to records hosted anywhere
  • ALIAS: Not charge for queries, AWS resources online
• To ensure name servers remain consistent across domains create a Reusable Delegation Set (through the CLI or API)

Elastic Network Interfaces (ENI)

• You can associate multiple IPs to each network interface
  • Beware of instance specific limitations
• An ENI can have IPv6 addresses if the VPC has IPv6 enabled
• ENI can be moved between subnets but not AZs
  • Can be a good way of migrating network configurations where required
• Attaching two ENIs to the same instance in the same subnet can cause networking issues
  • Use multiple IPs on the primary NIC, if required

Conclusion

The exam has a reputation for being the most difficult of the AWS certifications and it necessitates a good understanding of general networking with specific focuses on connectivity, routing, performance and troubleshooting. I managed to pass on first attempt with a score of 75%, which is not my highest score and demonstrates the challenge especially considering I spent more time preparing than I did for each of the SA and DevOps certifications.

I personally really enjoyed the experience and have learned a lot of practical and usable skills and experience that will help me succeed professionally. I hope this article has been useful, good luck with the exam!