How to deploy AWS Network Firewall to minimize changes in a multi-VPC environment?

A network engineer needs to improve the network security of an existing AWS environment by adding an AWS Network Firewall firewall to control internet-bound traffic. The AWS environment consists of five VPCs. Each VPC has an internet gateway, NAT gateways, public Application Load Balancers (ALBs), and Amazon EC2 instances. The EC2 instances are deployed in private subnets. The architecture is deployed across two Availability Zones. The network engineer must be able to configure rules for the public IP addresses in the environment, regardless of the direction of traffic. The network engineer must add the firewall by implementing a solution that minimizes changes to the existing production environment. The solution also must ensure high availability. Which combination of steps should the network engineer take to meet these requirements? (Choose two.)

Create a centralized inspection VPC with subnets in two Availability Zones. Deploy Network Firewall in this inspection VPC with an endpoint in each Availability Zone.
Configure new subnets in two Availability Zones in each VPC. Deploy Network Firewall in each VPC with an endpoint in each Availability Zone. Source Reference Answer
Deploy Network Firewall in each VPUse existing subnets in each of the two Availability Zones to deploy Network Firewall endpoints.
Update the route tables that are associated with the private subnets that host the EC2 instances. Add routes to the Network Firewall endpoints.
Update the route tables that are associated with the public subnets that host the NAT gateways and the ALBs. Add routes to the Network Firewall endpoints. Source Reference Answer

Community Votes

63%

37%

63% of anonymous learners picked answer BE. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the understanding of distributed vs. centralized firewall deployment models and the specific route table modifications required to inspect internet-bound traffic without disrupting existing private subnet configurations.

This question explores deploying AWS Network Firewall in a distributed model across multiple VPCs to inspect internet-bound traffic while minimizing changes to the existing production environment. The correct approach involves creating new subnets for the firewall endpoints and updating the route tables of the public subnets hosting NAT gateways and ALBs.

Many candidates incorrectly choose Option A (centralized inspection VPC) because it seems to minimize changes by avoiding modifications to existing VPCs. However, a centralized model requires Transit Gateway or VPC peering, which introduces significant architectural changes and complexity not mentioned in the scenario.

Community Discussion (11 comments)

backspace0900 👍 7 Selected: BE

BE New Firewall subnet Public subnet Routetable change

percolate792 👍 1 Selected: AE

Comparing this to Option A (centralized inspection VPC), which creates a single new VPC without touching the existing VPCs' structure, Option B introduces more changes to the production environment by adding new subnets to each VPC. In terms of "minimizing changes to existing production environment," Option A (centralized model) would generally be considered less intrusive than Option B (distributed model) because: It leaves the structure of existing VPCs unchanged It requires only one Network Firewall deployment instead of five It centralizes security management rather than distributing it

hughnguyen 👍 2 Selected: AE

It's easier to create a single VPC than it is to add 2 subnets two five VPCs

MO_SAM 👍 1 Selected: BE

ALL options are valid ___but___ you need to look at the requirements aka the criteria! which means min changes/interruption to the existing PROD env so definitely BE

Blitz1 👍 2 Selected: BE

It took me some time to understand the infra and what is requested. It's indeed about decentralized env because you need transit gateway for centralized one. Plus it is saying that each vpc is completely independent and we need to provide a " solution that minimizes changes". OK , so we have B until now. But were we put the routes: in private subnet or in public subnet. Here is comes the trick saying that we have ALB. So we will put route in public subnet to protect also ALB. So we have E. please read carefully: https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/

acloudguru 👍 1 Selected: AE

The combination of these two steps meets the requirements of adding an AWS Network Firewall firewall to control internet-bound traffic, minimizing changes to the existing production environment, ensuring high availability, and allowing the configuration of rules for public IP addresses in both directions. Options B and C involve deploying Network Firewall in each VPC, which may not be necessary and could lead to increased complexity and management overhead. Option D alone is not sufficient, as it only covers traffic from the private EC2 instances but not the public ALBs.

cerifyme85 👍 2 Selected: BE

It is not a centralised setup. It is a distributed setup. Five seperate VPCs Each VPC : ALB + NAT + EC2 Question says architecture should not be changed. So just deploy ANF endpoints in a sep subnet in each AZ. https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/#:~:text=AWS%C2%A0Network%C2%A0Firewall%20is%20deployed%20to%20protect%20traffic%20between%20a%20workload%20public%20subnet%20and%20IGW Also question is concenred about about inbound traffic so E To use centralised we need a TGW

[Removed] 👍 1

I believe AE is correct, because: E is correct as we need to inspect internet-bound traffic. E already includes that we need to update route tables. With this given, A a centralized approach would make more sense than (again) updating the production environment by adding new subnets there (option B). So AE for me

cerifyme85 👍 1 Selected: AD

Ans is AD

xTrayusx 👍 3 Selected: AE

'The network engineer must add the firewall by implementing a solution that minimizes changes to the existing production environment'

JoellaLi 👍 1 Selected: AD

The Network Firewall acts as a "filter" for traffic between the subnets and locations outside the VPC. To enable this filtering, route tables need to be modified so traffic passes through the firewall endpoints. Private subnets contain the EC2 instances, so their route tables should be updated to send outbound traffic to the firewall. The firewall then allows or denies the traffic before sending it to its final destination like internet gateway or NAT gateway. Route tables for public subnets hosting NAT/ALB do not need changes as instances are not present there. Traffic originating from private subnets is what needs inspection.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

The scenario describes a distributed environment with five independent VPCs, each containing public and private subnets across two Availability Zones. The requirement is to add AWS Network Firewall to control internet-bound traffic while minimizing changes to the existing production environment and ensuring high availability.

Why Option B is correct: Option B proposes deploying Network Firewall in each VPC with new subnets in each Availability Zone. This distributed approach aligns with the existing architecture where each VPC operates independently. By creating dedicated subnets for the firewall endpoints, you avoid modifying existing subnet configurations, thus minimizing disruption. Deploying endpoints in two AZs per VPC ensures high availability.

Why Option E is correct: Option E involves updating the route tables of the public subnets that host NAT gateways and ALBs. Since the requirement is to inspect internet-bound traffic, the traffic from private subnets (EC2 instances) already routes to NAT gateways in public subnets for internet access. By adding routes in the public subnet route tables to direct traffic through the Network Firewall endpoints, you can inspect this traffic without altering the private subnet route tables. This approach minimizes changes to the existing production environment.

Why Option A is incorrect: Option A suggests a centralized inspection VPC. While this might seem to minimize changes to existing VPCs, it requires implementing Transit Gateway or VPC peering to route traffic to the central firewall. This introduces significant architectural changes, additional costs, and complexity, contradicting the requirement to minimize changes.

Why Option C is incorrect: Option C proposes using existing subnets for Network Firewall endpoints. This would require modifying existing subnet configurations, potentially disrupting current workloads and violating the requirement to minimize changes.

Why Option D is incorrect: Option D suggests updating the route tables of private subnets. While this would route traffic through the firewall, it modifies the existing private subnet configurations, which contradicts the requirement to minimize changes. Additionally, since the traffic is already routed to NAT gateways in public subnets, inspecting at the public subnet level is more efficient.

Official Reference

Exam Strategy

When a question emphasizes 'minimizing changes to the existing environment,' carefully evaluate whether the proposed solution introduces hidden dependencies like Transit Gateway or VPC peering. Distributed solutions that work within existing boundaries often score higher on this criterion than centralized ones.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide