Gateway Load Balancer for Cross-Account Traffic Inspection

SAA-C03 By islever Editorial Last updated

Determine high-performing and/or scalable network architectures.

Short answer

C Deploy a Gateway Load Balancer in the networking account and configure interface GWLB endpoints in application accounts.

Question

An ecommerce company runs several internal applications in multiple AWS accounts. The company uses AWS Organizations to manage its AWS accounts. A security appliance in the company's networking account must inspect interactions between applications across AWS accounts. Which solution will meet these requirements?
  1. Deploy a Network Load Balancer (NLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the NLB by using an interface VPC endpoint in the application accounts.
  2. Deploy an Application Load Balancer (ALB) in the application accounts to send traffic directly to the security appliance.
  3. Deploy a Gateway Load Balancer (GWLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the GWLB by using an interface GWLB endpoint in the application accounts. Correct Answer
  4. Deploy an interface VPC endpoint in the application accounts to send traffic directly to the security appliance.

Key Takeaways

The core concept tested is using Gateway Load Balancers for network virtual appliance deployment, with the common trap being confusion between ALB/NLB and GWLB capabilities for L3/L4 traffic inspection.

This question tests the use of Gateway Load Balancers (GWLB) to deploy and scale third-party security appliances across AWS accounts. It establishes that GWLB endpoints are the correct mechanism for transparent traffic inspection in multi-account environments.

Common mistake: Learners often select NLB or ALB because they are more commonly used for general load balancing, failing to recognize that only GWLB supports the specific encapsulation protocol (GENEVE) required by many security appliances for transparent inspection.

Expert Analysis

Why the Answer Is Correct

Gateway Load Balancer (GWLB) is specifically designed to deploy, scale, and manage third-party virtual appliances, such as firewalls and intrusion detection systems. It uses the GENEVE protocol to encapsulate traffic, allowing the security appliance to inspect packets transparently without requiring complex routing changes. By deploying a GWLB endpoint in each application VPC, traffic from different AWS accounts can be directed to the central security appliance in the networking account seamlessly.

Why the Other Options Are Wrong

Option A (NLB) and Option B (ALB) do not support the GENEVE tunneling required by most third-party security appliances for transparent inspection; they operate at Layer 4 and Layer 7 respectively but lack the specific integration for network virtual appliances. Option D suggests using an interface VPC endpoint directly, which typically refers to PrivateLink services for API access, not for forwarding raw network traffic to a security appliance for inspection.

Community Comment Notes

The community consensus strongly supports Option C, with multiple users noting that 'security appliance' and 'inspect interaction' are key indicators for GWLB. One user provided a direct link to the official AWS documentation on creating Gateway Load Balancer endpoint services, confirming the technical validity of this approach.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see keywords like 'third-party security appliance', 'transparent inspection', or 'network virtual appliance', immediately think of Gateway Load Balancer (GWLB). It is the only ELB type designed specifically for this use case in AWS.

Frequently Asked Questions

Why can't I use an NLB for security appliance inspection?

NLBs do not support the GENEVE protocol required by most third-party security appliances for transparent traffic inspection.

What is the role of the GWLB endpoint in the application account?

It acts as a target for traffic, directing it via GENEVE tunnels to the GWLB in the networking account for inspection.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. example_ 👍 3 Answered C
    https://docs.aws.amazon.com/vpc/latest/privatelink/create-gateway-load-balancer-endpoint-service.html
  2. swati1508 👍 3
    Inspect traffic for that use GWLB OPTION C
  3. mk168898 👍 2
    security appliance, inspect interaction => GWLB
  4. EllenLiu 👍 1 Answered C
    https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/getting-started.html
  5. poramesh 👍 2
    Finallly a ques on GLB
Show 1 more comment
  1. komorebi 👍 2 Answered C
    Answer is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide