Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select 2 answers.
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The question mentions "dedicated VPC" for the application, i.e. the security tools will *not* run in the same VPS. Therefore, the use of TGW makes a lot of sense.
The correct answer is DE. The key is that the application is deployed in a dedicated VPC, which implies the security tool is in a separate inspection VPC. To inspect traffic without impacting performance, you use Gateway Load Balancer (D). Since the security and application VPCs are separate, you need a Transit Gateway (E) to route traffic between them. This pattern aligns with AWS's best practice for centralizing security in a scalable, high-availability setup. Option A falls short because it implies deploying the security tool in the same VPC, which doesn't align with the "dedicated" wording in the question — and breaks isolation.
A. Deploy the security tool on EC2 instances Since the tool is legacy and has no cloud-native support, it must run on EC2 instances. An Auto Scaling group helps maintain availability and resilience. Placing the tool in the same VPC allows for easy traffic routing via a Gateway Load Balancer. D. Provision a Gateway Load Balancer (GWLB) per AZ Gateway Load Balancer is designed specifically for this use case: deploying virtual appliances (like firewalls, IDS/IPS, and packet inspection tools). It redirects VPC traffic to your EC2-based security tool instances for inline, transparent inspection, without affecting the app performance.