How to Fix Internet Access in AWS Cloud WAN with Network Firewall Inspection?
A company has started using AWS Cloud WAN with one edge location in the us-east-1 Region. The company has a production segment and a security segment in AWS Cloud WAN. The company also has a default core network policy. The company has created a production VPC for the production workload. The company has created an outbound inspection VPC to inspect internet-bound traffic from the production VPC. The company has attached the production VPC to the production segment and has attached the outbound inspection VPC to the security segment. The company has also created an AWS Network Firewall firewall in the outbound inspection VPC to inspect internet-based traffic. The company has updated a route table for the production VPC to send all internet-bound traffic to the AWS Cloud WAN core network. The company has updated a route table for the outbound inspection VPC to ensure that Network Firewall inspects any outgoing traffic and incoming traffic. During testing, an Amazon EC2 instance in the production VPC cannot reach the internet. The company checks the Network Firewall rules and confirms that the rules are not blocking the traffic. Which combination of steps will meet these requirements? (Choose two.)
Community Votes
100% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests understanding of cross-segment routing in AWS Cloud WAN and the necessity of both segment sharing and a default-route static policy to funnel internet-bound traffic through an inspection VPC.
This question tests the correct AWS Cloud WAN core network policy configuration to route internet-bound traffic from a production segment through an outbound inspection VPC in a security segment using AWS Network Firewall. Community consensus confirms that enabling segment sharing and creating a 0.0.0.0/0 static route in the production segment targeting the inspection VPC are the two required steps.
Many candidates incorrectly choose option B, believing a static route must be added to the security segment, but the production segment is the source of the traffic and requires the 0.0.0.0/0 route to the inspection VPC.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding the Scenario
The company uses AWS Cloud WAN with two segments: production and security. The production VPC is attached to the production segment, and the outbound inspection VPC (containing AWS Network Firewall) is attached to the security segment. Internet-bound traffic from the production VPC is routed to the Cloud WAN core network, but the EC2 instance cannot reach the internet despite correct firewall rules.
Why Option A is Correct
Segment sharing must be enabled in the core network policy so that the production segment can communicate with the security segment. Without segment sharing, traffic from the production VPC cannot be forwarded to the inspection VPC in the security segment. As noted by community members, segment sharing is bidirectional by default, allowing return traffic from the inspection VPC back to the production segment.
Why Option C is Correct
A static route must be added to the core network policy for the production segment with destination 0.0.0.0/0, targeting the outbound inspection VPC attachment. This ensures that all internet-bound traffic from the production VPC is directed to the inspection VPC for Network Firewall processing before egressing to the internet. Community comments emphasize that this is the critical step to funnel traffic through the firewall.
Why Other Options Are Incorrect
- Option B incorrectly adds the static route to the security segment. The traffic originates in the production segment, so the route must be defined there.
- Option D uses a private CIDR block (10.2.0.0/16), which does not represent internet-bound traffic.
- Option E suggests attaching the inspection VPC to the production segment and enabling isolated attachment, which contradicts the scenario where the inspection VPC is already in the security segment and would break the intended segmentation.
Key Takeaway
Proper AWS Cloud WAN routing for inspection scenarios requires both segment sharing and accurate static route definitions in the correct segment's policy.
Official Reference
Exam Strategy
When troubleshooting AWS Cloud WAN routing issues, always verify segment sharing and static route configurations in the core network policy. Pay close attention to which segment originates the traffic and ensure the route targets the correct attachment.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →