AWS Networking Specialty study plan
AWS Networking Specialty · Give each week a clear focus.
8 weeks · About 6 hours per week
Network Design
Map every VPC design decision (CIDR sizing, subnet tiering, route table structure) to the failure modes each one prevents
Compare Transit Gateway hub-and-spoke against full-mesh VPC peering on cost, blast radius, and route scale, and write the decision criteria you would defend to an architect
Sketch three reference topologies (single-account, multi-account with shared services, hybrid with Direct Connect) and annotate where traffic inspection sits in each
Identify which Domain 1 objectives you can already reason about cold versus which need lab time
Your checkpoint
A one-page design decision matrix covering peering vs Transit Gateway vs Direct Connect, with cost and operational trade-offs per row
Network Design
Design a multi-VPC address plan that survives an acquisition, including overlap remediation options and their downtime implications
Derive route propagation behavior for Transit Gateway route tables, attachments, and associations by predicting outcomes before testing
Explain when to choose PrivateLink over peering and construct a scenario where peering would fail the requirement
Practice justifying a hybrid routing design under a latency and compliance constraint
Your checkpoint
A written architecture proposal for a three-account, two-Region, one-on-premises environment with a defended routing choice and a stated failure domain
Network Implementation
Build a working VPC from scratch using console and then repeat it in infrastructure-as-code, noting every setting that differs from the default
Configure site-to-site VPN with BGP and deliberately break the tunnel to observe failover timing
Implement Transit Gateway attachments and route table segmentation for a prod/non-prod split
Capture packet-level evidence with VPC Flow Logs and Reachability Analyzer for each build
Your checkpoint
A reproducible lab repository containing VPC, VPN, and Transit Gateway definitions plus a troubleshooting log of every misconfiguration you hit and how you diagnosed it
Network Implementation & Network Management and Operation
Extend the lab with Route 53 private hosted zones and resolver endpoints, then verify resolution paths from each subnet type
Configure Direct Connect gateway concepts in a simulated design and document the association limits and failover model
Instrument the environment with CloudWatch metrics and alarms that would catch a silent blackhole route
Run a timed troubleshooting drill: given a broken topology description, isolate the fault in under ten minutes
Your checkpoint
A monitoring and observability checklist mapped to specific CloudWatch metrics, log fields, and alarm thresholds for hybrid and intra-VPC traffic
Network Management and Operation
Diagnose five injected faults (asymmetric routing, MTU mismatch, security group drift, overlapping CIDR, stale BGP advertisement) and record the discriminating symptom for each
Automate a configuration drift check that flags route table and security group deviation from a baseline
Define an escalation runbook for hybrid connectivity incidents including what to check first and in what order
Review cost and performance telemetry to identify an over-provisioned or misconfigured network path
Your checkpoint
A fault-isolation playbook with a symptom-to-root-cause lookup table covering at least five failure classes
Network Security, Compliance, and Governance
Layer defense in depth across security groups, network ACLs, and a centralized inspection VPC, and articulate why each control exists at its layer
Design egress control using NAT gateways, firewall endpoints, and route table steering, and test what leaks when one layer is removed
Apply least-privilege IAM and SCP boundaries that constrain network changes without blocking operations
Evaluate encryption in transit options for each hop in a hybrid path
Your checkpoint
A security control matrix mapping each traffic path to the enforcing control, the failure mode if removed, and the audit evidence it produces
Network Security, Compliance, and Governance & Network Management and Operation
Configure logging and audit trails (Flow Logs, CloudTrail, Config rules) sufficient to reconstruct who changed a route table and when
Write Config rules and guardrails that detect non-compliant network configurations automatically
Perform a compliance-oriented review of a design against a stated regulatory constraint such as data residency
Document a break-glass procedure for emergency network changes with post-hoc review
Your checkpoint
A governance package containing three Config rules, one SCP, and a written audit reconstruction walkthrough
Network Design & Network Implementation & Network Management and Operation & Network Security, Compliance, and Governance
Re-derive the weakest objectives from weeks 1 through 7 and rebuild the two labs you understood least
Complete timed practice sets and classify every miss by domain and by reasoning error type
Explain aloud, without notes, the trade-off behind five common architecture decisions
Consolidate personal notes into a single pre-exam reference sheet limited to what you actually got wrong
Your checkpoint
A scored practice-exam log with every incorrect item categorized by domain and root cause, plus a remediation note per item
Milestones
Week 2: You can defend a multi-VPC routing design on cost, scale, and failure-domain grounds without consulting notes, and your decision matrix has been stress-tested against an overlapping-CIDR scenario
Week 4: Your lab repository rebuilds the full topology from code with zero manual steps, and you resolve a described fault in a timed drill within ten minutes
Week 6: You can trace any given traffic path and name the enforcing control at each layer, plus the observable symptom if that control is removed
Week 8: Practice scores are stable above your target threshold across two consecutive timed sets, and every logged miss has a written remediation note