ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to ensure that all internet-bound traffic from VPCs in the organization goes through a centralized egress VPC where it is inspected by a firewall. Which TWO steps are required to enforce this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a central egress VPC with an Internet Gateway and a NAT Gateway or firewall.
Options A and E are correct. Option A: A central egress VPC with an Internet Gateway and NAT Gateway or firewall is required to route and inspect all internet-bound traffic. Option E: An SCP denying ec2:CreateInternetGateway in all accounts except the central network account prevents other accounts from creating their own Internet Gateways, thereby forcing traffic through the central VPC. Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/S traffic, not a method to block all internet access at the network level. Option C is incorrect because AWS Direct Connect is for private on-premises connectivity, not for routing internet traffic. Option D is incorrect because VPC endpoints provide private access to AWS services without traversing the internet; they do not enforce internet egress routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a central egress VPC with an Internet Gateway and a NAT Gateway or firewall.
Why this is correct
Central egress VPC hosts the internet gateway.
- ✗
Use AWS WAF to block internet access from all VPCs except the central egress VPC.
Why it's wrong here
WAF is for web ACLs, not egress enforcement.
- ✗
Set up an AWS Direct Connect connection to route internet traffic through the central VPC.
Why it's wrong here
Direct Connect is for private connectivity, not internet.
- ✗
Configure VPC endpoints for all AWS services to force traffic through the central VPC.
Why it's wrong here
VPC endpoints are for AWS services, not internet traffic.
- ✓
Apply an SCP that denies the ec2:CreateInternetGateway action in all accounts except the central network account.
Why this is correct
SCP prevents creation of internet gateways in other accounts.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.