ANS-C01 AWS Network Firewall Practice Question
A company has a VPC with multiple subnets. They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all outbound traffic from the VPC to the internet. Currently, the VPC route table has a default route (0.0.0.0/0) pointing to an internet gateway. What routing change is required to route outbound traffic through the firewall?
⚠ Common exam trap
A common pitfall is assuming you need a NAT gateway or a transit gateway to integrate with Network Firewall. The correct approach is a simple route table update pointing to the firewall endpoint's ENI.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the Network Firewall endpoint's elastic network interface.
To route traffic through AWS Network Firewall, you must add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the firewall endpoint's elastic network interface (ENI). This forces outbound traffic to be inspected by the firewall before reaching the internet gateway. Option A is incorrect because a VPC Gateway Endpoint is used for private access to AWS services, not for routing traffic through a firewall. Option B is incorrect because a NAT gateway provides outbound connectivity but does not inspect traffic; adding another hop to the firewall would be redundant and not supported. Option D is incorrect because a transit gateway is used to connect multiple VPCs or on-premises networks, not to route traffic through a single firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VPC Gateway Endpoint for the firewall service.
Why it's wrong here
A VPC Gateway Endpoint provides private access to AWS services like S3 or DynamoDB, not routing through a firewall.
- ✗
Add a NAT gateway in a public subnet and route 0.0.0.0/0 to the NAT gateway, then point the NAT gateway to the firewall.
Why it's wrong here
A NAT gateway enables outbound traffic but does not inspect it; routing to a NAT gateway then to the firewall is unnecessary and not supported.
- ✓
Add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the Network Firewall endpoint's elastic network interface.
Why this is correct
Adding a route for 0.0.0.0/0 to the Network Firewall endpoint's ENI forces all outbound traffic through the firewall for inspection.
- ✗
Add a transit gateway and attach the VPC and the internet gateway to it, then route traffic through the firewall.
Why it's wrong here
A transit gateway connects VPCs and on-premises networks; it does not route traffic through a firewall by itself.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.