ANS-C01 practice question 17 of 35

A company is using third-party firewall appliances to monitor and inspect traffic on premises The company wants to use this same model on AWS. The…

A company is using third-party firewall appliances to monitor and inspect traffic on premises The company wants to use this same model on AWS. The company has a single VPC with an internet gateway. The VPC has a fleet of web servers that run on Amazon EC2 instances that are managed by an Auto Scaling group. The company's network team needs to work with the security team to establish inline inspection of all packets that are sent to and from the web servers. The solution must scale as the fleet of virtual firewall appliances scales. Which combination of steps should the network team take to implement this solution? (Select THREE.)

Answer options

A: Create a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets. Correct answer

B: Create a security group for use with the firewall appliances, and allow port 443. Allow a port for the Gateway Load Balancer to perform health checks.

C: Create a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks. Correct answer

D: Deploy a fleet of firewall appliances to the existing VPC. Create a Gateway Load Balancer. Add the firewall appliances as targets.

E: Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway. Correct answer

F: Create a new route table inside the web server VPC. Create a new edge association with the internet gateway. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.

Correct Answer:

A. Create a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets.; C. Create a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks.; E. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.

Explanation

Gateway Load Balancer (GWLB) is the AWS-supported mechanism for transparent, inline inspection with third-party firewalls. Best practice is to place the appliances in a separate “inspection” VPC, front them with a GWLB, and expose the service to the workload VPC through a GWLB endpoint. The security group on the appliances must allow the GENEVE encapsulation port 6081 that GWLB uses, plus the chosen health-check port. Finally, the workload VPC’s subnet route table and the IGW-edge route table are updated so that all traffic to and from the web servers is sent to the GWLB endpoint and returns to the internet through the IGW, providing scalable inspection as firewall targets scale.

Why Incorrect

B – GWLB uses GENEVE (UDP 6081), not TLS 443; traffic would be dropped. D – Placing appliances in the same VPC breaks the hub-and-spoke model and limits horizontal scaling across VPCs. F – Creating an extra edge-associated route table is optional; updating existing IGW route table suffices, adding unnecessary complexity.

References

1. AWS Gateway Load Balancer – “GWLB uses the GENEVE protocol on UDP port 6081” (User Guide, ‘How GWLB works’, 2023-11-20).

2. AWS Gateway Load Balancer – “Create an inspection VPC and attach firewall appliances behind a GWLB” (Getting Started Tutorial, steps 1–3).

3. AWS Gateway Load Balancer – “Add a route that points 0.0.0.0/0 to the GWLB endpoint; in the IGW-edge route table, add 0.0.0.0/0 to the IGW” (User Guide, ‘Routing internet traffic through a GWLB endpoint’).

4. AWS Prescriptive Guidance: “Scale network firewalls in an inspection VPC with GWLB” (2023-05, Architecture Diagram & routing section).

5. AWS Reference Architecture Library, ID arch-cns-gwlb-2022-09, p.4-5.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test