ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with public and private subnets. The security team wants to inspect all traffic between the private subnets and the internet using a centralized inspection VPC. The company uses AWS Network Firewall and wants to ensure that traffic cannot bypass the firewall. Which TWO actions should the company take? (Choose TWO.)
⚠ Common exam trap
Many candidates confuse AWS WAF with Network Firewall, thinking WAF can inspect all network traffic, when in fact WAF only inspects HTTP/HTTPS traffic at the application layer and cannot inspect non-web protocols like SSH, RDP, or custom TCP/UDP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the Network Firewall in a dedicated inspection VPC and use a VPC peering or transit gateway to route traffic from the workload VPC to the inspection VPC.
Deploying AWS Network Firewall in a dedicated inspection VPC and using a transit gateway (or VPC peering) allows centralized traffic inspection. This architecture ensures that all traffic between the workload VPC and the internet is routed through the inspection VPC, preventing bypass. The transit gateway enables transitive routing, while VPC peering can also be used with proper route table entries to force traffic through the firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an AWS WAF web ACL and associate it with the internet gateway.
Why it's wrong here
WAF protects web applications, not network-layer traffic inspection.
- ✓
Deploy the Network Firewall in a dedicated inspection VPC and use a VPC peering or transit gateway to route traffic from the workload VPC to the inspection VPC.
Why this is correct
A centralized inspection VPC allows the firewall to inspect traffic without being in the workload VPC.
- ✗
Enable VPC Flow Logs on the private subnets to monitor traffic.
Why it's wrong here
Flow logs monitor but do not enforce routing through the firewall.
- ✓
Configure the private subnet route table in the workload VPC to route 0.0.0.0/0 traffic to the Network Firewall endpoint.
Why this is correct
This forces all internet-bound traffic from private subnets to the firewall.
- ✗
Create an internet gateway in the workload VPC and attach it to the private subnets.
Why it's wrong here
Private subnets cannot have an internet gateway; they route through a NAT gateway or firewall.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.