A government contractor is designing a multi-account environment with multiple VPCs for a customer. A network security policy requires all traffic between any two VPCs to be transparently inspected by a third-party appliance. The customer wants a solution that features AWS Transit Gateway. The setup must be highly available across multiple Availability Zones, and the solution needs to support automated failover. Furthermore, asymmetric routing is not supported by the inspection appliances. Which combination of steps is part of a solution that meets these requirements? (Choose two.)
Select 2 answers.
Marked answer: B
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
1
The critical issue with D is that it does not propagate the application VPC attachments into the inspection route table. Without this propagation, the inspection VPC will not know how to route traffic back to the originating application VPCs after it has been inspected.
Chose BC1
BC are the correct answers. We need to used GWLB to load-balance the traffic to a target group of inspection appliance. Routes toward Applications VPCs need to be propagated and being reachable through their respective TGW attachment. Enable appliance mode to avoid asymmetric routing due to zone affinity.
Chose BC3
When application VPC wants to reach other app VPC via TGW, there should be default route pointed to inspection TGW attchement and when traffic traffic comes back to TGW after inspection/GWLB, TGW needs specific routes to app VPC CIDRs.
