ANS-C01 Question 214
Select 2You are designing a highly secure network architecture for a multi-account AWS setup. Your security team requires all inbound and outbound traffic between VPCs and on-premises networks to be inspected by a third-party firewall appliance deployed in a dedicated VPC. Which of the following options will allow you to achieve this requirement effectively?
- A
Use AWS Transit Gateway to route traffic through the firewall appliance VPC by configuring route tables with the firewall as the next hop.
- B
Deploy the third-party firewall appliance in a shared VPC and associate it with all other VPCs in your AWS Organization.
- C
Leverage AWS Network Firewall to automatically inspect all traffic without requiring any route changes.
- D
Use a Gateway Load Balancer to centrally manage traffic inspection and integrate it with the firewall appliance.
- E
Configure VPC peering between all VPCs and route traffic to the firewall appliance using individual route tables.
Show answer and explanation
Correct answers: A, D
Explanation
To inspect all traffic using a third-party firewall appliance, you can leverage AWS Transit Gateway or Gateway Load Balancer. AWS Transit Gateway provides a scalable and centralized routing solution for multi-account environments by directing traffic to the firewall VPC through route tables. Gateway Load Balancer integrates seamlessly with third-party appliances and ensures high availability and scalability for traffic inspection. Other options, such as VPC peering and AWS Network Firewall, either do not support third-party appliances or fail to provide centralized traffic inspection.
- A. Correct.
Correct: AWS Transit Gateway allows centralized routing across multiple VPCs and on-premises networks. You can configure route tables to direct traffic through the dedicated firewall appliance VPC.
- B. Incorrect.
Incorrect: Shared VPCs are not an AWS feature. VPC sharing allows resource sharing within an account but does not allow a single VPC to be associated with all accounts.
- C. Incorrect.
Incorrect: AWS Network Firewall is an AWS-managed service that does not directly support third-party appliances. It cannot integrate a dedicated third-party firewall in this scenario.
- D. Correct.
Correct: Gateway Load Balancer simplifies deployment, scaling, and high availability for third-party virtual appliances like firewalls, enabling centralized traffic inspection.
- E. Incorrect.
Incorrect: VPC peering does not scale well for multi-account environments and does not allow centralized traffic inspection across multiple VPCs and on-premises networks.