ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The security team needs to centrally manage and enforce network security policies across all accounts. Which TWO services or features can be used to centrally enforce network security controls? (Choose TWO.)
⚠ Common exam trap
AWS often tests the distinction between monitoring tools (like VPC Flow Logs) and enforcement tools (like AWS Network Firewall), leading candidates to mistakenly select VPC Flow Logs as a security control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Network Firewall
AWS Network Firewall is a managed, stateful firewall service that provides application-layer filtering and intrusion prevention for VPCs. AWS Firewall Manager offers a centralized dashboard to deploy and manage firewall rules across all accounts in an AWS Organization. Together, they enable consistent, centrally enforced network security policies. In contrast, Network ACLs (option B) are stateless and must be configured per subnet per account—no central management. VPC Flow Logs (option D) capture traffic metadata but do not enforce any rules. Security groups with cross-account references (option E) allow referencing security groups from other accounts but require per-resource attachment and lack central policy enforcement. Therefore, the two correct services are AWS Network Firewall (A) and AWS Firewall Manager (C).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Network Firewall
Why this is correct
Network Firewall can be centrally deployed and managed using Firewall Manager.
- ✗
Network ACLs
Why it's wrong here
NACLs are associated with subnets and not centrally enforced across accounts.
- ✓
AWS Firewall Manager
Why this is correct
Firewall Manager provides centralized management of firewall rules across accounts.
- ✗
VPC Flow Logs
Why it's wrong here
Flow Logs are for monitoring traffic, not enforcing policies.
- ✗
VPC security groups with cross-account references
Why it's wrong here
Security group IDs are not automatically shared across accounts without manual setup.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.