SAP-C03 practice question: Network inspection and filtering (Network Firewall, WAF, GWLB)
Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A streaming service connects about 20 application VPCs through an AWS Transit Gateway. The security team needs one place to define which domains the spoke VPCs may reach on the internet, and it must inspect traffic that moves between spokes.
The firm wants the cost of inspection to stay flat as new spoke VPCs are added, so each spoke cannot run its own firewall. Separately, the public website must block common web exploits and bot traffic before requests reach its load balancers.
Which TWO designs meet these requirements? (Choose two.)
Choose two answers.
AA. Deploy an AWS Network Firewall endpoint in every spoke VPC, and manage each spoke's domain allowlist in that VPC's firewall policy.
BB. Attach the inspection VPC's subnets to the transit gateway without enabling appliance mode on the attachment. Use the firewall endpoints there to inspect traffic between the spokes.
CC. Create an inspection VPC with Network Firewall endpoints in each Availability Zone, and enable appliance mode on its transit gateway attachment. Route spoke egress and spoke-to-spoke traffic through it, using one firewall policy with the domain allowlist.
DD. Associate Route 53 Resolver DNS Firewall rule groups with each spoke VPC that allow only the approved domains, and keep the default security group rules for the traffic between spokes.
EE. Attach an AWS WAF web ACL to the CloudFront distribution in front of the website, with the core rule set managed rule group for common exploits and the Bot Control managed rule group for bots.
Show the answer and explanation
Answers: C, E
A. Wrong: Each spoke would pay for its own firewall endpoints, so the cost grows with every new VPC. Managing 20 separate policies also works against the one-place requirement.
B. Wrong: Without appliance mode, the request and return traffic of a flow can use different Availability Zones, and stateful inspection then fails. The design does not give reliable inspection between spokes.
C. Right: Correct. One central firewall with endpoints in each Availability Zone gives one policy and flat cost as spokes are added. Appliance mode keeps both directions of a flow in the same Availability Zone so stateful inspection works. Learn more: What is AWS Network Firewall? (opens in a new tab)
D. Wrong: DNS Firewall filters DNS queries, so it can block lookups of unapproved domains, but it does not inspect traffic between spokes. Connections made directly to IP addresses also bypass it, so the inspection requirement is not met.
E. Right: Correct. WAF inspects web requests at the edge before they reach the origin, and the core rule set and Bot Control managed rule groups cover common exploits and bot traffic. This meets the website requirement without changing the spoke network design. Learn more: What is AWS WAF? (opens in a new tab)
Explanation
A central Network Firewall with appliance mode meets the spoke egress and inspection needs at flat cost, and WAF on the distribution filters the public web requests. Per-spoke firewalls, DNS-only filtering and inspection without appliance mode each miss a requirement.
Want more on Network inspection and filtering (Network Firewall, WAF, GWLB)? The 5 full-length practice sets have 5 more Network inspection and filtering (Network Firewall, WAF, GWLB) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →