How to Fix Internet Access in AWS Cloud WAN with Network Firewall Inspection?

ANS-C01 By islever Editorial Last updated Aug 7, 2026

Short answer

AC Update the core network policy to configure segment sharing. Share the production segment with the security segment. Update the core network policy to create a static route for the production segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.

Question

A company has started using AWS Cloud WAN with one edge location in the us-east-1 Region. The company has a production segment and a security segment in AWS Cloud WAN. The company also has a default core network policy. The company has created a production VPC for the production workload. The company has created an outbound inspection VPC to inspect internet-bound traffic from the production VPC. The company has attached the production VPC to the production segment and has attached the outbound inspection VPC to the security segment. The company has also created an AWS Network Firewall firewall in the outbound inspection VPC to inspect internet-based traffic. The company has updated a route table for the production VPC to send all internet-bound traffic to the AWS Cloud WAN core network. The company has updated a route table for the outbound inspection VPC to ensure that Network Firewall inspects any outgoing traffic and incoming traffic. During testing, an Amazon EC2 instance in the production VPC cannot reach the internet. The company checks the Network Firewall rules and confirms that the rules are not blocking the traffic. Which combination of steps will meet these requirements? (Choose two.)

Update the core network policy to configure segment sharing. Share the production segment with the security segment. Correct Answer
Update the core network policy to create a static route for the security segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
Update the core network policy to create a static route for the production segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment. Correct Answer
Update the core network policy to create a static route for the production segment. Specify 10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment.
Create an attachment to attach the outbound inspection VPC to the production segment. Update the core network policy to turn on isolated attachment for the production segment.

Key Takeaways

The question tests understanding of cross-segment routing in AWS Cloud WAN and the necessity of both segment sharing and a default-route static policy to funnel internet-bound traffic through an inspection VPC.

This question tests the correct AWS Cloud WAN core network policy configuration to route internet-bound traffic from a production segment through an outbound inspection VPC in a security segment using AWS Network Firewall. Community consensus confirms that enabling segment sharing and creating a 0.0.0.0/0 static route in the production segment targeting the inspection VPC are the two required steps.

Common mistake: Many candidates incorrectly choose option B, believing a static route must be added to the security segment, but the production segment is the source of the traffic and requires the 0.0.0.0/0 route to the inspection VPC.

Expert Analysis

Understanding the Scenario

The company uses AWS Cloud WAN with two segments: production and security. The production VPC is attached to the production segment, and the outbound inspection VPC (containing AWS Network Firewall) is attached to the security segment. Internet-bound traffic from the production VPC is routed to the Cloud WAN core network, but the EC2 instance cannot reach the internet despite correct firewall rules.

Why Option A is Correct

Segment sharing must be enabled in the core network policy so that the production segment can communicate with the security segment. Without segment sharing, traffic from the production VPC cannot be forwarded to the inspection VPC in the security segment. As noted by community members, segment sharing is bidirectional by default, allowing return traffic from the inspection VPC back to the production segment.

Why Option C is Correct

A static route must be added to the core network policy for the production segment with destination 0.0.0.0/0, targeting the outbound inspection VPC attachment. This ensures that all internet-bound traffic from the production VPC is directed to the inspection VPC for Network Firewall processing before egressing to the internet. Community comments emphasize that this is the critical step to funnel traffic through the firewall.

Why Other Options Are Incorrect

Option B incorrectly adds the static route to the security segment. The traffic originates in the production segment, so the route must be defined there.
Option D uses a private CIDR block (10.2.0.0/16), which does not represent internet-bound traffic.
Option E suggests attaching the inspection VPC to the production segment and enabling isolated attachment, which contradicts the scenario where the inspection VPC is already in the security segment and would break the intended segmentation.

Key Takeaway

Proper AWS Cloud WAN routing for inspection scenarios requires both segment sharing and accurate static route definitions in the correct segment's policy.

Official Reference

https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-network-actions-routes.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When troubleshooting AWS Cloud WAN routing issues, always verify segment sharing and static route configurations in the core network policy. Pay close attention to which segment originates the traffic and ensure the route targets the correct attachment.

Community Votes

100%

100% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

Blitz1 👍 3

A. When traffic is returning from internet to inspection segment a route is needed to pass the traffic to correct segment. https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-network-actions-routes.html C. is pushing all the traffic (internet) to outbound inspection
Stants 👍 1

Option C: Update the core network policy to create a static route for the production segment. Specify 0.0.0.0/0 as the destination CIDR block. Specify the outbound inspection VPC as an attachment. Explanation: By creating a static route for the production segment with a destination of 0.0.0.0/0 (which covers all internet-bound traffic), and attaching it to the outbound inspection VPC, you ensure that traffic from the production VPC is directed to the Network Firewall in the outbound inspection VPC. Option D: Update the core network policy to create a static route for the production segment. Specify 10.2.0.0/16 as the destination CIDR block. Specify the outbound inspection VPC as an attachment. Explanation: Creating a static route for the production segment with a specific destination CIDR block (10.2.0.0/16) ensures that traffic from the production VPC is routed to the outbound inspection VPC.
woorkim 👍 1

Option B is not correct because a static route for the security segment targeting 0.0.0.0/0 does not directly solve the issue for production traffic routing. Option D is incorrect because it involves a route with a CIDR block that does not represent internet-bound traffic (10.2.0.0/16 is a private IP range). Option E is incorrect because attaching the outbound inspection VPC directly to the production segment and enabling isolated attachment conflicts with the requirement to inspect traffic through the security segment.
Rollizo 👍 1

It is C because of this sentence: "The company has updated a route table for the production VPC to send all internet-bound traffic to the AWS Cloud WAN core network." Then you need to configure the CORE route policy with a static route in production segment to send the traffic to inspection
secdaddy 👍 1

"Segment sharing is bidirectional by default." so A handles routing between security and production. https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-network-actions-routes.html B is required to enable the security segment to route traffic to the inspection VPC

Show 1 more comment

973b658 👍 3

A&C is OK.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide