Question 524 of 1,621
ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Network Firewall to inspect traffic between VPCs in a transit gateway setup. They have a rule group that allows HTTP and HTTPS traffic to a web server in a production VPC. Recently, the security team added a new Suricata IPS rule to block traffic from a specific IP address. After deploying the updated rule group, they notice that all traffic to the web server is being dropped, even from allowed IPs. The firewall logs show the new rule is triggering for all traffic, not just the specific IP. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server's security group is blocking traffic from the firewall's IP range after the firewall adds its source IP.
Why it's wrong here
Network Firewall does not change source IP; it forwards traffic. Security groups would not cause the firewall logs to show the rule triggering.
- ✗
The new Suricata rule uses the 'drop' action instead of 'reject', causing all packets to be dropped.
Why it's wrong here
The action 'drop' is appropriate for blocking. The issue is that the rule matches all traffic, not just the specific IP.
- ✓
The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.
Why this is correct
In Suricata rules, order matters. If the new rule has an incorrect source IP (e.g., using 'any' or a broad range), it will match all traffic and drop it before allow rules are evaluated. The rule should have the specific IP to block.
- ✗
The rule group is attached to the firewall policy in the wrong direction (e.g., outbound instead of inbound).
Why it's wrong here
Direction matters, but if it were wrong, traffic might not be inspected at all. The logs show the rule is triggering, so it is being evaluated.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.