ANS-C01 Question 434
Select 2You are designing a network architecture for a financial services company that must comply with strict regulatory requirements around data protection and access control. The company requires that all outbound internet traffic from its Amazon VPC be inspected and logged to meet compliance needs. Which combination of solutions should you implement to meet these requirements?
- A
Deploy a NAT Gateway in the VPC and enable VPC Flow Logs for all subnets.
- B
Set up an AWS Network Firewall with outbound traffic inspection rules and enable logging.
- C
Use an internet gateway with Security Groups configured to allow only specific outbound traffic.
- D
Deploy a Gateway Load Balancer and integrate it with a third-party traffic inspection appliance.
- E
Enable AWS WAF on the VPC's internet gateway to monitor outbound traffic.
Show answer and explanation
Correct answers: B, D
Explanation
To meet the compliance requirements of inspecting and logging all outbound traffic, a combination of AWS Network Firewall for deep packet inspection and logging, and a Gateway Load Balancer for integration with third-party traffic inspection appliances, is recommended. These solutions ensure robust compliance and security for outbound traffic from the VPC.
- A. Incorrect.
NAT Gateway alone does not perform traffic inspection or logging; VPC Flow Logs capture metadata but do not inspect packet contents.
- B. Correct.
AWS Network Firewall provides deep packet inspection and logging, making it suitable for compliance and security requirements.
- C. Incorrect.
Security Groups alone cannot inspect traffic; they only allow or deny traffic based on rules.
- D. Correct.
Gateway Load Balancer can route traffic through third-party appliances for inspection, which is often used for compliance.
- E. Incorrect.
AWS WAF is designed for application layer protection (Layer 7) and does not monitor general outbound traffic from the VPC.