ANS-C01 Question 150

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose BCF2

  BCF Deploy Network Firewall in a centralized location : By deploying the Network Firewall in an inspection VPC, you can easily manage and inspect traffic from all parts of your environment. Define security policies : Updating the HOME_NET rule group variable ensures that internal traffic is properly inspected and protected by the Network Firewall. Route traffic effectively : Configuring two transit gateway route tables allows for effective routing of outbound traffic to the inspection VPC for firewall checks, while also ensuring that inspected traffic reaches its destination. These three options provide a comprehensive solution for deploying an AWS Network Firewall in your environment.

• Chose BCF1

  To inspect east-west (VPC-to-VPC) and north-south (internet-bound and on-premises) traffic using AWS Network Firewall with minimal changes to the existing environment, you need a scalable and centralized design.

• Chose BCF10

  Option B: A centralized inspection VPC approach would lead to a minimal architectural change and efficiently use Network Firewall resources. Option C: HOME_NET is usually defined as your local network. In this case, it would include all your VPCs and on-premises networks. Option F: Configuring two transit gateway route tables, one associated with all the application VPCs and another with the inspection VPC, will help route traffic effectively for inspection. All outbound traffic from application VPCs would be routed to the inspection VPC for firewall checks, and then the inspected traffic would be routed to its destination (internet or another VPC).