A network engineer needs to improve the network security of an existing AWS environment by adding an AWS Network Firewall firewall to control internet-bound traffic. The AWS environment consists of five VPCs. Each VPC has an internet gateway, NAT gateways, public Application Load Balancers (ALBs), and Amazon EC2 instances. The EC2 instances are deployed in private subnets. The architecture is deployed across two Availability Zones. The network engineer must be able to configure rules for the public IP addresses in the environment, regardless of the direction of traffic. The network engineer must add the firewall by implementing a solution that minimizes changes to the existing production environment. The solution also must ensure high availability. Which combination of steps should the network engineer take to meet these requirements? (Choose two.)
Select 2 answers.
Marked answer: A
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose AD1
A and D. It says to make minimal changes to the production environment. Changing the route tables for public subnets require FW endpoint routing and other routing requirements such as the NFW route table needing to route out to the internet either via NATGW or IGW.
Chose BE1
Why not A? A centralized inspection VPC would require more routing changes, likely Transit Gateway integration, and a larger architecture change.
Chose BE1
Aiming to implement the Centralized Inspection VPC with AWS Network Firewall, you should have a Transit Gateway, so it is a requirement. For this scenario, if your spoke VPCs have their own NAT Gateways and internet access, you need to route traffic through the Transit Gateway to the inspection VPC if you want centralized inspection. So, A doesn't make sense if you don't have a Transit gateway.
