How to Deploy Third-Party Firewalls with Gateway Load Balancer on AWS?

A company is using third-party firewall appliances to monitor and inspect traffic on premises. The company wants to use the same model on AWS. The Company has a single VPC with an internet gateway. The VPC has a fleet of web servers that run on Amazon EC2 instances that are managed by an Auto Scaling group. The company’s network team needs to work with the security team to establish inline inspection of all packets that are sent to and from the web servers. The solution must scale as the fleet of virtual firewall appliances scales Which combination of steps should the network team take to implement this solution? (Choose three.)

Create a new VPC, and deploy a fleet of firewall appliances. Create a Gateway Load Balancer. Add the firewall appliances as targets. Source Reference Answer
Create a security group for use with the firewall appliances, and allow port 443. Allow a port for the Galeway Load Balancer to perform health checks.
Create a security group for use with the firewall appliances, and allow port 6081. Allow a port for the Gateway Load Balancer to perform health checks. Source Reference Answer
Deploy a fleet of firewall appliances to the existing VPC. Create a Gateway Load Balancer. Add the firewall appliances as targets.
Update the internet gateway route table and the web server route table to send traffic to and from the internet to the VPC endpoint ID of the Gateway Load Balancer. Update the subnet route table that is associated with the Gateway Load Balancer endpoint to direct internet traffic to the internet gateway. Source Reference Answer

Community Votes

ACE

100%

100% of anonymous learners picked answer ACE. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests whether you can architect elastic inline traffic inspection with Gateway Load Balancer, and the common trap is selecting HTTPS port 443 for appliance traffic instead of the GENEVE UDP port 6081, or placing the firewalls in the same VPC as the workloads.

For the AWS ANS-C01 exam, inline inspection of web server traffic in a single VPC is implemented by placing third-party firewall appliances in a separate VPC, fronting them with a Gateway Load Balancer, and routing traffic through a Gateway Load Balancer endpoint. Community consensus confirms that the correct combination is ACE, with attention to Geneve port 6081 and multi-route-table updates.

The most common wrong answers are choosing D (deploying appliances into the existing VPC) and B (allowing port 443 in the appliance security group). D creates routing and scaling complexity, while B misses the 6081 GENEVE protocol used by the Gateway Load Balancer to communicate with appliance targets.

Community Discussion (8 comments)

woorkim 👍 5

ACE is answer! B. Port 443 is for HTTPS traffic, but this does not apply to the Gateway Load Balancer D. Deploying the firewalls in the same VPC as the web servers complicates routing and scaling F. Creating a new edge association with the internet gateway is unnecessary. Updating the existing route tables (as described in Option E) is sufficient to route traffic through the Gateway Load Balancer.

18641c6 👍 1 Selected: AC

I don't see why ACE is correct, I prefer ACF. When you create a new VPC there is no route table with edge association. So, a new route table must be created and then it gets associated with the edge. Or do I miss a certain point here?

Canvill 👍 1 Selected: CD

CDF. Only a single VPC is mentioned

VerRi 👍 3 Selected: ACE

ACE is good for this case

AlirezaNetWorld 👍 2

ACE is the best answer.

qomtodie 👍 3 Selected: ACE

https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/target-groups.html

cas_tori 👍 1 Selected: DE

this is DEF

aragon_saa 👍 1 Selected: ADE

Answer is A,D,E

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

A is correct because a separate inspection VPC isolates the firewall fleet from production workloads and allows appliance scaling to happen independently. The Gateway Load Balancer is created in that inspection VPC, and the firewall appliance instances are registered as targets in a target group. This is the standard AWS pattern for inserting third-party virtual appliances into a VPC traffic path.

C is correct because Gateway Load Balancer uses the GENEVE protocol on UDP port 6081 between its endpoints and the appliance targets. The appliance security group must allow port 6081 plus the configured health-check port; it does not require 443 for data traffic. E is correct because routing internet traffic through the firewall requires three route-table updates: an edge-associated route table for the internet gateway to send inbound traffic to the Gateway Load Balancer endpoint, the web-server subnet route table to send outbound traffic to the endpoint, and the endpoint subnet route table to direct inspected return traffic to the internet gateway. B is wrong because 443 is not the appliance-data port, and D is wrong because placing appliances in the same VPC as the web servers complicates routing and scaling. The option to create a new edge association is unnecessary if the existing route tables are updated as described in E.

Official Reference

Exam Strategy

When solving GWLB questions, trace a single packet through the entire path: from the internet gateway to the GWLBE, through the appliance on GENEVE port 6081, back to the GWLBE, and then to the web server. Use scratch paper to draw the route-table entries for IGW, web-server subnet, and endpoint subnet, and always verify that security groups allow 6081 plus the health-check port.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide