AWS Certified Advanced Networking – Specialty (ANS-C01)Network Security, Compliance, and GovernanceMedium
A financial institution is migrating its on-premises applications to AWS. Due to stringent regulatory requirements, all network traffic, both internal and external, must be inspected for malicious activity and unauthorized data exfiltration. The institution needs a centralized solution that can enforce a consistent set of security policies across multiple AWS accounts and VPCs, and integrate with existing security information and event management (SIEM) systems. Which AWS service should be used to meet these requirements?
- AAWS Shield Advanced
- BAmazon GuardDuty
- CAWS WAF (Web Application Firewall)
- DAWS Network Firewall
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Network Firewall
AWS Network Firewall is a managed service that provides intrusion prevention and detection for all VPC traffic. It allows for centralized policy management across accounts and VPCs using AWS Firewall Manager, and can inspect both ingress and egress traffic, fulfilling the requirement for inspecting all network traffic for malicious activity and unauthorized data exfiltration.
Why the other options are wrong
- A. AWS Shield Advanced provides enhanced DDoS protection for applications, but it is not designed for general network traffic inspection and policy enforcement.
- B. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not provide inline traffic inspection and prevention capabilities.
- C. AWS WAF protects web applications from common web exploits at the application layer, but does not inspect all network traffic within VPCs.
AWS Network Firewall
A managed firewall service that makes it easier to deploy, configure, and scale network security across your AWS VPCs.
- Provides intrusion prevention and detection.
- Inspects all VPC traffic (ingress and egress).
- Integrates with AWS Firewall Manager for centralized policy management.
Memory trick: Firewall protects the 'NET' from all 'TRAFFIC'.