A company is using third-party firewall appliances to monitor and inspect traffic on premises The company wants to use this same model on AWS. The…

This combination of steps correctly establishes a scalable, inline traffic inspection solution using a third-party firewall fleet with an AWS Gateway Load Balancer (GWLB).

1. (A) Creating a new, dedicated VPC for the firewall appliances and the GWLB establishes a centralized inspection architecture. This is a common AWS best practice that separates the security infrastructure from application workloads, enhancing security posture and simplifying management.

2. (C) The security group for the firewall appliances must be configured to allow traffic on UDP port 6081. GWLB uses the GENEVE protocol to encapsulate traffic and forward it to the appliances on this specific port. Allowing health check traffic is also essential for the GWLB to monitor appliance health.

3. (E) Modifying the route tables is the crucial step that directs traffic through the inspection appliances. The internet gateway's route table is updated for ingress traffic, and the web server subnet's route table is updated for egress traffic, both pointing to the GWLB endpoint.

B. This is incorrect. The Gateway Load Balancer uses the GENEVE protocol on UDP port 6081 to encapsulate traffic, not port 443.

D. This is incorrect because it is mutually exclusive with option A. A solution cannot simultaneously create a new VPC for the appliances (A) and deploy them to the existing VPC (D).

F. This is less accurate than option E. It is overly prescriptive by stating "Create a new route table," which may not be necessary. Option E correctly focuses on the essential action of updating routes to direct traffic.

1. AWS Documentation, Gateway Load Balancers, How Elastic Load Balancing works. "To inspect traffic, you must route traffic from the source to the Gateway Load Balancer endpoint and from the Gateway Load Balancer endpoint to the destination." This supports the routing changes described in option E. The documentation also shows architectural patterns, including the centralized model described in option A. (Source: AWS Elastic Load Balancing User Guide).

2. AWS Documentation, Gateway Load Balancers, Target groups for your Gateway Load Balancers, Target security groups. "The Gateway Load Balancer uses the GENEVE protocol on UDP port 6081. The security groups for your appliance instances must allow traffic from the Gateway Load Balancer nodes on UDP port 6081." This directly supports option C and invalidates option B. (Source: AWS Elastic Load Balancing User Guide).

3. AWS Networking & Content Delivery Blog, Centralized inspection architecture with AWS Gateway Load Balancer. This official blog post details the reference architecture of creating a dedicated "security VPC" to host the GWLB and firewall appliances, which aligns with option A. It also describes the necessary routing table modifications for ingress and egress traffic, supporting option E. (Source: aws.amazon.com/blogs/networking-and-content-delivery/).