ANS-C01 Network Security, Compliance and Governance Practice Question

A company has a VPC with multiple subnets and uses AWS Network Firewall to inspect traffic. The security team notices that traffic to a specific IP (10.0.0.10) is being dropped unexpectedly. The firewall policy has a stateful rule group that allows all traffic. What is the MOST likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The stateless default action is set to drop

Network Firewall evaluates stateless rules first, and a stateless default drop action would drop traffic before stateful rules are considered. Option A is wrong because stateful rules allow all. Option B is wrong because route table directs traffic to firewall. Option D is wrong because AWS Shield is for DDoS protection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The stateful rule group has an implicit deny for that IP
Why it's wrong here
Stateful rule groups allow all traffic if configured to allow all.
✗
AWS Shield Advanced is blocking the traffic
Why it's wrong here
Shield blocks DDoS attacks, not specific IP traffic without configuration.
✓
The stateless default action is set to drop
Why this is correct
Stateless rules are evaluated first; if default action is drop, traffic is dropped regardless of stateful rules.
✗
The subnet's route table does not have a route to the firewall endpoint
Why it's wrong here
If route were missing, traffic would not reach the firewall; the issue is traffic being dropped.

Visual reference

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question