Answer-first summary for fast verification
Answer: Create a centralized inspection VPC with subnets in two Availability Zones. Deploy Network Firewall in this inspection VPC with an endpoint in each Availability Zone., Update the route tables that are associated with the private subnets that host the EC2 instances. Add routes to the Network Firewall endpoints.
To meet the requirements of improving network security with minimal changes to the existing production environment and ensuring high availability, the network engineer should take the following steps: A. Create a centralized inspection VPC with subnets in two Availability Zones. Deploy Network Firewall in this inspection VPC with an endpoint in each Availability Zone. This approach centralizes the firewall management and minimizes changes to the existing VPCs. D. Update the route tables that are associated with the private subnets that host the EC2 instances. Add routes to the Network Firewall endpoints. This ensures that all internet-bound traffic from the EC2 instances is routed through the Network Firewall for inspection, enhancing security without significant alterations to the existing infrastructure. Option B is not ideal because deploying Network Firewall in each VPC would require more changes and management overhead. Option C is not suitable because it suggests using existing subnets, which may not be optimized for firewall deployment and could lead to availability issues. Option E is incorrect because updating the route tables of public subnets that host NAT gateways and ALBs would not directly contribute to controlling internet-bound traffic from EC2 instances in private subnets.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
A network engineer aims to enhance the security of an existing AWS environment by deploying an AWS Network Firewall to manage internet-bound traffic. The environment includes five VPCs, each with an internet gateway, NAT gateways, public Application Load Balancers (ALBs), and EC2 instances in private subnets, spanning two Availability Zones. The engineer must configure rules for public IP addresses, regardless of traffic direction, while minimizing changes to the production setup and ensuring high availability.
Which two steps should the network engineer take to fulfill these requirements?
A
Create a centralized inspection VPC with subnets in two Availability Zones. Deploy Network Firewall in this inspection VPC with an endpoint in each Availability Zone.
B
Configure new subnets in two Availability Zones in each VPC. Deploy Network Firewall in each VPC with an endpoint in each Availability Zone.
C
Deploy Network Firewall in each VPUse existing subnets in each of the two Availability Zones to deploy Network Firewall endpoints.
D
Update the route tables that are associated with the private subnets that host the EC2 instances. Add routes to the Network Firewall endpoints.
E
Update the route tables that are associated with the public subnets that host the NAT gateways and the ALBs. Add routes to the Network Firewall endpoints.