ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with multiple subnets. They deploy a Network Firewall to inspect traffic. The firewall is configured with a stateful rule that allows outbound HTTP traffic to any destination. However, traffic from an EC2 instance in a private subnet to an external web server fails. The route table for the private subnet has a default route pointing to the firewall endpoint. What is the likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall endpoint is in a different Availability Zone than the instance.
The firewall endpoint must be in the same Availability Zone as the subnet's route table target. If the endpoint is in a different AZ, traffic is not properly routed to it. The stateful rule allows HTTP, so A is incorrect. Security groups do not affect outbound traffic unless explicitly blocked, and default outbound is allow, so B is incorrect. A NAT gateway is not needed when using a firewall, so D is incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The stateful rule order is incorrect; a default deny rule is blocking traffic.
Why it's wrong here
The stateful rule allows HTTP, so traffic should be permitted.
- ✗
The EC2 instance security group does not allow outbound HTTP.
Why it's wrong here
The question states security group allows all outbound traffic.
- ✓
The firewall endpoint is in a different Availability Zone than the instance.
Why this is correct
Traffic must be sent to the firewall endpoint in the same AZ; otherwise routing may fail.
- ✗
The subnet does not have a route to a NAT gateway.
Why it's wrong here
Network Firewall can provide outbound internet access without a NAT gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.