CLF-C02 Security and Compliance Practice Question
Which AWS service acts as a centralized firewall for traffic inspection between VPCs, between VPCs and on-premises networks, and for internet traffic?
⚠ Common exam trap
Test-takers frequently confuse AWS Network Firewall with Security Groups or NACLs, thinking those can provide centralized traffic inspection across VPCs and hybrid networks, but they are limited to instance-level or subnet-level filtering and lack the centralized, stateful inspection capabilities required for this use case.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Network Firewall
AWS Network Firewall is a managed service that provides a centralized firewall to inspect and filter traffic across VPCs, between VPCs and on-premises networks (via AWS Transit Gateway or VPN/Direct Connect), and for internet-bound traffic. It supports stateful and stateless rules, intrusion prevention (IPS), and domain filtering, making it the correct choice for a unified traffic inspection solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Groups
Why it's wrong here
Security groups are stateful firewalls that attach to elastic network interfaces (ENIs), filtering traffic only for individual EC2 instances, Lambda targets, or other resources that explicitly reference them. They cannot be placed centrally at a VPC peering connection, transit gateway, or VPN attachment, so they cannot inspect traffic flowing between VPCs or from on-premises networks. Additionally, being stateful, they automatically allow return traffic, but they provide no centralized policy engine or cross-account management for network-wide inspection.
- ✗
Network Access Control Lists (NACLs)
Why it's wrong here
Network Access Control Lists (NACLs) are stateless and apply only at the subnet boundary within a single VPC, requiring explicit inbound and outbound rules for every direction of traffic. They cannot be attached to VPC peering connections, transit gateways, or VPN tunnels, so they are unable to provide a central inspection point for traffic between VPCs or between on-premises and VPC. NACLs also lack protocol-aware and application-layer inspection, such as domain-based filtering or intrusion prevention, limiting their usefulness for traffic from outside the subnet.
- ✓
AWS Network Firewall
Why this is correct
AWS Network Firewall is a managed, stateful network firewall that you deploy inline at the VPC edge by attaching firewall endpoints to the VPC and updating route tables to direct traffic through them. It performs deep packet inspection, supports stateful rule groups with protocol-awareness, domain-based filtering, and Suricata-compatible intrusion detection and prevention, making it suitable for inspecting VPC-to-VPC, VPC-to-internet, and on-premises-to-VPC traffic. It integrates with AWS Firewall Manager, allowing you to centrally apply and manage firewall policies across multiple accounts and VPCs from a single governance point.
- ✗
AWS WAF
Why it's wrong here
AWS WAF inspects HTTP/HTTPS traffic at Layer 7 and is designed to protect web applications by filtering requests to destinations like Application Load Balancers, CloudFront, or API Gateway. It has no capability to inspect non-HTTP protocols, raw TCP/UDP packets, or traffic exchanged between VPCs at the network layer, and it is not placed along VPC boundaries or transit routes. Therefore, while WAF can block common web exploits such as SQL injection or cross-site scripting, it cannot act as a centralized network firewall for VPC-to-VPC or VPN traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.