ANS-C01 Network Security, Compliance and Governance Practice Question

Correct answer & explanation

A more specific route (e.g., a /32 or /24 for the destination network) in the VPC route table will take precedence over the default route (0.0.0.0/0) that points to the firewall endpoint. This causes traffic destined for that specific network to bypass the firewall. Option A is incorrect because route propagation adds routes from VPN or Direct Connect but does not inherently cause bypass. Option B is incorrect because if the subnet is not associated with the firewall's route table, it uses the main route table, which could bypass the firewall, but the key issue here is the existence of a more specific route. Option C is incorrect because the firewall endpoint being in a different Availability Zone does not cause traffic to bypass; it can cause increased latency or other issues but not bypass.