An administrator deploys a VM-Series firewall into Amazon Web Services. Which attribute must be disabled on the data-plane elastic network interface for the instance to handle traffic that is not…

Question

Options

• Asecurity group
• Btags
• Celastic ip address
• Dsource/destination checking

• A
  5% (3)
• B
  2% (1)
• C
  2% (1)
• D
  91% (53)

Explanation

Source/destination checking (D) must be disabled because AWS enforces it by default - it drops any packet where the source or destination IP doesn't match the interface's own IP. A firewall acting as a transit device (routing traffic between other hosts) must forward packets destined for other IPs, so this check would block all transiting traffic.

Why the distractors are wrong:

• A (Security group): Security groups control which traffic is allowed to reach the interface; they don't prevent the firewall from forwarding traffic to other destinations.
• B (Tags): Tags are metadata labels for organization/billing; they have zero impact on packet forwarding behavior.
• C (Elastic IP): An EIP is a static public IPv4 address assignment; removing it affects reachability to the firewall itself, not its ability to forward transit traffic.

Memory tip: Think of it as the "nosy neighbor" check - AWS normally asks every interface "is this packet addressed to you?" and drops it if not. A firewall needs to say "none of your business, forward it anyway," which requires turning that check off.

No community discussion yet for this question.