ANS-C01 Network Implementation Practice Question
A company is running a stateful firewall appliance in an EC2 instance in a VPC. The appliance inspects traffic between subnets. The company needs to ensure that traffic from the web tier subnet to the application tier subnet passes through the firewall, but the firewall itself must not affect other traffic. Which configuration should the company implement?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that network ACLs or security groups can redirect traffic to a firewall appliance, but these are filtering mechanisms, not routing or forwarding mechanisms; the trap here is confusing stateless/stateful filtering with traffic steering, which requires route table manipulation or a Gateway Load Balancer endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.
A Gateway Load Balancer (GWLB) allows you to deploy a fleet of third-party firewall appliances in a separate subnet and use a Gateway Load Balancer endpoint (GWLBe) to transparently intercept and steer inter-subnet traffic through the firewall. By configuring the route tables of the web and application subnets to send traffic to the GWLBe, the firewall inspects only the desired traffic without affecting other VPC traffic, as the GWLB operates at Layer 3 (Geneve encapsulation) and does not alter the source/destination IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the firewall in the same subnet as the web tier and use security groups to redirect traffic.
Why it's wrong here
Security groups do not perform routing or redirection.
- ✗
Place the firewall in a separate subnet and use network ACLs to force traffic through it.
Why it's wrong here
Network ACLs filter packets, they do not route traffic to a specific instance.
- ✓
Use a Gateway Load Balancer to deploy the firewall appliance in a separate subnet, and configure route tables to send inter-subnet traffic to the Gateway Load Balancer endpoint.
Why this is correct
GWLB transparently intercepts traffic for inspection.
- ✗
Use a transit gateway with appliance mode and attach all subnets to it, then configure routing to send traffic through the firewall.
Why it's wrong here
Attaching all subnets to a Transit Gateway with appliance mode would direct *all* inter-subnet traffic through the firewall, failing to meet the requirement that the firewall must not affect other traffic. Transit Gateway appliance mode is designed to centralise inspection for traffic flowing *between different Transit Gateway attachments*, such as multiple VPCs or on-premises networks, by ensuring all traffic between these attachments traverses a shared security appliance. It is not intended for granularly inspecting specific traffic flows *between subnets within a single VPC* while bypassing others.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.