AWS Certified Advanced Networking – Specialty (ANS-C01)Network ImplementationHard
A security-conscious organization needs to ensure that all network traffic leaving their VPCs for the internet passes through a specific set of security appliances for deep packet inspection. The solution must be highly available and allow for scaling of these appliances. Which AWS networking construct should be utilized to achieve this centralized egress inspection?
- AConfigure a NAT Gateway in each private subnet and route traffic through it.
- BSet up an Internet Gateway in a central VPC and peer all other VPCs to it.
- CDeploy a Gateway Load Balancer and integrate it with a dedicated inspection VPC.
- DUse a custom EC2 proxy server in a public subnet to forward all outbound traffic.
Show answer & explanationAnswer & explanation
Correct answer: C. Deploy a Gateway Load Balancer and integrate it with a dedicated inspection VPC.
A Gateway Load Balancer (GWLB) is designed to facilitate the transparent deployment and scaling of virtual network appliances such as firewalls for deep packet inspection. By deploying GWLB in an inspection VPC and routing all internet-bound traffic from other VPCs through GWLB endpoints, centralized, highly available, and scalable egress inspection is achieved.
Why the other options are wrong
- A. NAT Gateway provides outbound internet access but does not allow for transparent insertion of security appliances for deep packet inspection.
- B. Peering VPCs to a central VPC with an Internet Gateway does not inherently allow for deep packet inspection by security appliances without additional complex routing and potentially a GWLB.
- D. A custom EC2 proxy server is a manual solution that lacks the built-in high availability, scalability, and transparency of AWS managed services like GWLB.
Gateway Load Balancer (GWLB)
A service that enables you to deploy, scale, and manage virtual network appliances (e.g., firewalls, IDS/IPS) in a transparent and highly available manner.
- Transparently inserts appliances into the network path.
- Operates at Layer 3 (IP protocol).
- Supports auto-scaling and high availability of appliances.
Memory trick: GWLB: 'Guardian' of the 'Gateway' to the internet.