Topic 1 Question 150
3 つ選択A network engineer needs to deploy an AWS Network Firewall firewall into an existing AWS environment. The environment consists of the following:
• A transit gateway with all VPCs attached to it • Several hundred application VPCs • A centralized egress internet VPC with a NAT gateway and an internet gateway • A centralized ingress internet VPC that hosts public Application Load Balancers • On-premises connectivity through an AWS Direct Connect gateway attachment
The application VPCs have workloads deployed across multiple Availability Zones in private subnets with the VPC route table s default route (0.0.0.0/0) pointing to the transit gateway. The Network Firewall firewall needs to inspect east-west (VPC-to-VPC) traffic and north-south (internet-bound and on-premises network) traffic by using Suricata compatible rules.
The network engineer must deploy the firewall by using a solution that requires the least possible architectural changes to the existing production environment.
Which combination of steps should the network engineer take to meet these requirements?
Deploy Network Firewall in all Availability Zones in each application VPC.
Deploy Network Firewall in all Availability Zones in a centralized inspection VPC.
Update the HOME_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
Update the EXTERNAL_NET rule group variable to include all CIDR ranges of the VPCs and on-premises networks.
Configure a single transit gateway route table. Associate all application VPCs and the centralized inspection VPC with this route table.
Configure two transit gateway route tables. Associate all application VPCs with one transit gateway route table. Associate the centralized inspection VPC with the other transit gateway route table.
ユーザの投票
コメント(3)
- 正解だと思う選択肢: BCF
Option B: A centralized inspection VPC approach would lead to a minimal architectural change and efficiently use Network Firewall resources.
Option C: HOME_NET is usually defined as your local network. In this case, it would include all your VPCs and on-premises networks.
Option F: Configuring two transit gateway route tables, one associated with all the application VPCs and another with the inspection VPC, will help route traffic effectively for inspection. All outbound traffic from application VPCs would be routed to the inspection VPC for firewall checks, and then the inspected traffic would be routed to its destination (internet or another VPC).
👍 4Certified1012023/08/02 - 正解だと思う選択肢: BCE
Doesn't make sense separate inspection VPC and other VPC into two TGW RT, if do so, no traffic will be able to send/receive between these
👍 1Neo002023/07/25 - 👍 1ISSDoksim2023/07/30
シャッフルモード