AWS Certified SysOps Administrator – AssociateNetworking and Content DeliveryHard
A SysOps administrator needs to deploy a new security appliance (e.g., firewall, intrusion detection system) within a VPC. This appliance must inspect all north-south (internet-bound) and east-west (VPC internal) traffic between specific subnets. The appliance should be highly available, scalable, and transparently inserted into the network path without requiring manual route table changes for every new subnet or instance. Which AWS networking service is designed for this transparent traffic inspection and routing?
- ANetwork Load Balancer (NLB)
- BApplication Load Balancer (ALB)
- CAWS Transit Gateway
- DGateway Load Balancer (GWLB)
Show answer & explanationAnswer & explanation
Correct answer: D. Gateway Load Balancer (GWLB)
The Gateway Load Balancer (GWLB) is specifically designed to deploy, scale, and manage virtual appliances such as firewalls, intrusion detection/prevention systems, and deep packet inspection systems. It acts as a transparent network gateway, directing all traffic to the appliance fleet and then back to its destination.
Why the other options are wrong
- A. NLB operates at Layer 4 and distributes traffic to instances, but it's not designed for transparent insertion of security appliances into a network path for inspection.
- B. ALB operates at Layer 7 and is for HTTP/HTTPS traffic distribution, not for transparent inspection of all network traffic.
- C. AWS Transit Gateway is a central hub for connecting VPCs and on-premises networks, and while it can route traffic to a GWLB, it doesn't perform the transparent insertion and scaling of security appliances itself.
AWS Gateway Load Balancer (GWLB)
A load balancer that makes it easy to deploy, scale, and manage your virtual appliances, such as firewalls, intrusion detection and prevention systems.
- Operates at Layer 3 (network layer)
- Transparently inserts virtual appliances into network path
- Uses GWLB endpoints to route traffic to/from appliance VPC
- Supports both north-south and east-west traffic inspection
Memory trick: GWLB is the Gateway to your virtual appliance fleet.