SCS-C02 Question 58
Single answerA company has several sensitive workloads running in their VPC. They want to ensure that all outbound internet traffic from their instances is inspected for malicious activity and that only approved traffic is allowed. Additionally, they want to centralize the management of these controls. Which solution is the most appropriate for achieving these requirements?
- A
Use AWS Network Firewall to inspect the outbound traffic and define rules to allow or deny traffic based on policies.
- B
Enable flow logs on the VPC and analyze the logs to identify and block malicious traffic.
- C
Deploy third-party intrusion detection and prevention software on each instance to monitor outbound traffic.
- D
Use AWS WAF (Web Application Firewall) to define rules for outbound traffic inspection and blocking.
Show answer and explanation
Correct answer: A
Explanation
AWS Network Firewall is specifically designed to provide centralized management and inspection of network traffic, including outbound traffic from VPCs. It allows you to define and enforce security policies at the network level, making it the most appropriate solution for inspecting and controlling outbound traffic in this scenario. The other options either lack the required functionality or introduce unnecessary operational complexity.
- A. Correct.
AWS Network Firewall is designed to provide network protection, allowing you to inspect inbound and outbound traffic using rules. It is a managed service that can be centralized for ease of management, making it the best choice for this scenario.
- B. Incorrect.
VPC flow logs provide visibility into network traffic but do not actively inspect or block traffic. They are used for logging and monitoring, not for enforcing security policies.
- C. Incorrect.
Deploying third-party software on each instance can achieve the goal, but it is operationally complex, not centralized, and less scalable compared to AWS Network Firewall.
- D. Incorrect.
AWS WAF is designed for web application traffic filtering and operates at the application layer. It does not inspect general outbound traffic from instances, making it unsuitable for this use case.