Exams / SAP-C03 / Study guide / Network inspection and filtering (Network Firewall, WAF, GWLB)
Network inspection and filtering (Network Firewall, WAF, GWLB): SAP-C03 study notes and practice questions
What to know about Network inspection and filtering (Network Firewall, WAF, GWLB) for the SAP-C03 exam, from the Architecture Design and Implementation Built for the Cloud domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks which control inspects or blocks a given kind of traffic, and how to build one inspection layer for many VPCs without breaking routing.
Controls by layer
Control
Layer and use
Security groups
Stateful, per ENI, allow rules only; reference other groups for tiered access
Network ACLs
Stateless, per subnet, ordered allow and deny; quick IP blocks
AWS Network Firewall
Managed stateful and stateless inspection: Suricata-compatible rules, domain allow and deny lists, IPS signatures, TLS inspection; scales automatically
Gateway Load Balancer
Inserts third-party appliances transparently using GENEVE; GWLB endpoints are route table targets
AWS WAF
Layer 7 on CloudFront, ALB, API Gateway, AppSync, Cognito and others: managed rule groups, rate-based rules, SQL injection and XSS, Bot Control, geo match
AWS Shield
Standard DDoS protection for all; Shield Advanced adds response team support, cost protection and advanced detection
VPC Flow Logs
Accepted and rejected flow metadata (no payloads) to CloudWatch Logs, S3 or Firehose for troubleshooting and audit
Inspection architectures
Distributed: a firewall endpoint in each VPC; simple, but more endpoints to manage.
Centralized: an inspection VPC attached to Transit Gateway (or Cloud WAN) inspects east-west and egress traffic; turn on appliance mode for symmetric flows. Network Firewall can now attach to Transit Gateway natively, removing the separate inspection VPC.
Ingress: route internet traffic through firewall endpoints with IGW ingress routing, or protect web apps with WAF on CloudFront or ALB.
AWS Firewall Manager applies WAF, Shield Advanced, security group and Network Firewall policies across the organization and auto-applies them to new accounts and resources.
How to choose
Scenario wording
Choose
“Allow outbound traffic only to approved domains”
Network Firewall domain list
“Must keep using our existing firewall vendor”
Gateway Load Balancer with the appliances
“Block SQL injection and throttle abusive IPs”
AWS WAF managed rules and rate-based rules
“Large DDoS attacks, need AWS response team and cost protection”
Shield Advanced
“Apply the same WAF rules to every account automatically”
Firewall Manager
“Inspect all traffic between VPCs centrally”
Inspection with Transit Gateway (appliance mode) or native TGW-attached Network Firewall
“Find which flows are being rejected”
VPC Flow Logs
Common traps
WAF for non-HTTP traffic, or Network Firewall for application-layer attacks it can’t parse as well.
Security groups to deny a specific IP.
Missing appliance mode, so return traffic takes another AZ and the stateful firewall drops it.
Flow Logs to see packet contents.
Managing rules account by account instead of Firewall Manager.
A streaming service connects about 20 application VPCs through an AWS Transit Gateway. The security team needs one place to define which domains the spoke VPCs may reach on the internet, and it must inspect traffic that moves between spokes.
The firm wants the cost of inspection to stay flat as new spoke VPCs are added, so each spoke cannot run its own firewall. Separately, the public website must block common web exploits and bot traffic before requests reach its load balancers.
Which TWO designs meet these requirements? (Choose two.)
Choose two answers.
AA. Deploy an AWS Network Firewall endpoint in every spoke VPC, and manage each spoke's domain allowlist in that VPC's firewall policy.
BB. Attach the inspection VPC's subnets to the transit gateway without enabling appliance mode on the attachment. Use the firewall endpoints there to inspect traffic between the spokes.
CC. Create an inspection VPC with Network Firewall endpoints in each Availability Zone, and enable appliance mode on its transit gateway attachment. Route spoke egress and spoke-to-spoke traffic through it, using one firewall policy with the domain allowlist.
DD. Associate Route 53 Resolver DNS Firewall rule groups with each spoke VPC that allow only the approved domains, and keep the default security group rules for the traffic between spokes.
EE. Attach an AWS WAF web ACL to the CloudFront distribution in front of the website, with the core rule set managed rule group for common exploits and the Bot Control managed rule group for bots.
Show the answer and explanation
Answers: C, E
A. Wrong: Each spoke would pay for its own firewall endpoints, so the cost grows with every new VPC. Managing 20 separate policies also works against the one-place requirement.
B. Wrong: Without appliance mode, the request and return traffic of a flow can use different Availability Zones, and stateful inspection then fails. The design does not give reliable inspection between spokes.
C. Right: Correct. One central firewall with endpoints in each Availability Zone gives one policy and flat cost as spokes are added. Appliance mode keeps both directions of a flow in the same Availability Zone so stateful inspection works. Learn more: What is AWS Network Firewall? (opens in a new tab)
D. Wrong: DNS Firewall filters DNS queries, so it can block lookups of unapproved domains, but it does not inspect traffic between spokes. Connections made directly to IP addresses also bypass it, so the inspection requirement is not met.
E. Right: Correct. WAF inspects web requests at the edge before they reach the origin, and the core rule set and Bot Control managed rule groups cover common exploits and bot traffic. This meets the website requirement without changing the spoke network design. Learn more: What is AWS WAF? (opens in a new tab)
Explanation
A central Network Firewall with appliance mode meets the spoke egress and inspection needs at flat cost, and WAF on the distribution filters the public web requests. Per-spoke firewalls, DNS-only filtering and inspection without appliance mode each miss a requirement.
Want more on Network inspection and filtering (Network Firewall, WAF, GWLB)? The 5 full-length practice sets have 5 more Network inspection and filtering (Network Firewall, WAF, GWLB) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Network inspection and filtering (Network Firewall, WAF, GWLB)