ANS-C01 Question 212
Select 2An organization is deploying a third-party firewall appliance in their AWS environment to inspect traffic between their public-facing application and the internet. The firewall appliance is deployed in a dedicated subnet within a VPC. What additional configuration is necessary to ensure that all inbound and outbound traffic flows through the firewall appliance?
- A
Create route table entries in the public subnets to direct traffic to the firewall appliance's elastic network interface (ENI).
- B
Configure a NAT Gateway in the same subnet as the firewall appliance to handle outbound internet traffic.
- C
Establish route table entries in private subnets to send traffic to the firewall appliance's ENI for inspection.
- D
Enable source/destination checks on the firewall appliance's ENI to ensure traffic is not dropped.
- E
Use Network ACLs to explicitly allow inbound and outbound traffic to and from the firewall appliance's subnet.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure that the third-party firewall appliance inspects all traffic, route tables in the public and private subnets must direct traffic to the appliance's ENI. This ensures that the firewall appliance acts as a central point for traffic inspection. Source/destination checks must be disabled on the appliance's ENI to allow it to forward traffic. NAT Gateways and Network ACLs are not directly required for this configuration.
- A. Correct.
Correct. For the firewall appliance to inspect traffic, the route tables in the public subnets need to direct traffic to the firewall appliance's ENI.
- B. Incorrect.
Incorrect. A NAT Gateway is not required to route traffic through a firewall appliance. The firewall appliance itself handles traffic inspection and routing.
- C. Correct.
Correct. To ensure the firewall appliance inspects traffic leaving the private subnets, route table entries must direct traffic to the firewall appliance's ENI.
- D. Incorrect.
Incorrect. Source/destination checks should be disabled on the firewall appliance's ENI to allow it to forward traffic. When enabled, the ENI will drop traffic that does not originate from or is not destined for itself.
- E. Incorrect.
Incorrect. While Network ACLs can control traffic at the subnet level, they are not sufficient for routing traffic through the firewall appliance. Proper route table configurations are required.