How to Deploy Third-Party Firewalls with Gateway Load Balancer on AWS?

ANS-C01 By islever Editorial Last updated

Short answer

ACE Create a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets. Create a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway.

Question

A company is using third-party firewall appliances to monitor and inspect traffic on premises. The company wants to use the same model on AWS. The Company has a single VPC with an internet gateway. The VPC has a fleet of web servers that run on Amazon EC2 instances that are managed by an Auto Scaling group. The company’s network team needs to work with the security team to establish inline inspection of all packets that are sent to and from the web servers. The solution must scale as the fleet of virtual firewall appliances scales Which combination of steps should the network team take to implement this solution? (Choose three.)
  1. Create a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets. Correct Answer
  2. Create a security group for use with the firewall appliances, and allow port 443. Allow a port for the Galeway Load Balancer to perform health checks.
  3. Create a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks. Correct Answer
  4. Deploy a fleet of firewall appliances to the existing VPC. Create a Gateway Load Balancer. Add the firewall appliances as targets.
  5. Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway. Correct Answer

Key Takeaways

The exam tests whether you can architect elastic inline traffic inspection with Gateway Load Balancer, and the common trap is selecting HTTPS port 443 for appliance traffic instead of the GENEVE UDP port 6081, or placing the firewalls in the same VPC as the workloads.

For the AWS ANS-C01 exam, inline inspection of web server traffic in a single VPC is implemented by placing third-party firewall appliances in a separate VPC, fronting them with a Gateway Load Balancer, and routing traffic through a Gateway Load Balancer endpoint. Community consensus confirms that the correct combination is ACE, with attention to Geneve port 6081 and multi-route-table updates.

Common mistake: The most common wrong answers are choosing D (deploying appliances into the existing VPC) and B (allowing port 443 in the appliance security group). D creates routing and scaling complexity, while B misses the 6081 GENEVE protocol used by the Gateway Load Balancer to communicate with appliance targets.

Expert Analysis

A is correct because a separate inspection VPC isolates the firewall fleet from production workloads and allows appliance scaling to happen independently. The Gateway Load Balancer is created in that inspection VPC, and the firewall appliance instances are registered as targets in a target group. This is the standard AWS pattern for inserting third-party virtual appliances into a VPC traffic path.

C is correct because Gateway Load Balancer uses the GENEVE protocol on UDP port 6081 between its endpoints and the appliance targets. The appliance security group must allow port 6081 plus the configured health-check port; it does not require 443 for data traffic. E is correct because routing internet traffic through the firewall requires three route-table updates: an edge-associated route table for the internet gateway to send inbound traffic to the Gateway Load Balancer endpoint, the web-server subnet route table to send outbound traffic to the endpoint, and the endpoint subnet route table to direct inspected return traffic to the internet gateway. B is wrong because 443 is not the appliance-data port, and D is wrong because placing appliances in the same VPC as the web servers complicates routing and scaling. The option to create a new edge association is unnecessary if the existing route tables are updated as described in E.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When solving GWLB questions, trace a single packet through the entire path: from the internet gateway to the GWLBE, through the appliance on GENEVE port 6081, back to the GWLBE, and then to the web server. Use scratch paper to draw the route-table entries for IGW, web-server subnet, and endpoint subnet, and always verify that security groups allow 6081 plus the health-check port.

Community Votes

ACE
100%

100% of anonymous learners picked answer ACE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. woorkim 👍 5
    ACE is answer! B. Port 443 is for HTTPS traffic, but this does not apply to the Gateway Load Balancer D. Deploying the firewalls in the same VPC as the web servers complicates routing and scaling F. Creating a new edge association with the internet gateway is unnecessary. Updating the existing route tables (as described in Option E) is sufficient to route traffic through the Gateway Load Balancer.
  2. qomtodie 👍 3
    https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/target-groups.html
  3. 18641c6 👍 1
    I don't see why ACE is correct, I prefer ACF. When you create a new VPC there is no route table with edge association. So, a new route table must be created and then it gets associated with the edge. Or do I miss a certain point here?
  4. Canvill 👍 1
    CDF. Only a single VPC is mentioned
  5. VerRi 👍 3
    ACE is good for this case
Show 3 more comments
  1. AlirezaNetWorld 👍 2
    ACE is the best answer.
  2. aragon_saa 👍 1
    Answer is A,D,E
  3. cas_tori 👍 1
    this is DEF

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide