Amazon Exam ANS-C01 Topic 2 Question 18 Discussion

Actual exam question for Amazon's ANS-C01 exam

Question #: 18
Topic #: 2

A company is deploying third-party firewall appliances for traffic inspection and NAT capabilities in its VPC. The VPC is configured with private subnets and public subnets. The company needs to deploy the firewall appliances behind a load balancer.

Which architecture will meet these requirements MOST cost-effectively?

ADeploy a Gateway Load Balancer with the firewall appliances as targets. Configure the firewall appliances with a single network interface in a private subnet. Use a NAT gateway to send the traffic to the internet after inspection.

BDeploy a Gateway Load Balancer with the firewall appliances as targets. Configure the firewall appliances with two network interfaces: one network interface in a private subnet and another network interface in a public subnet. Use the NAT functionality on the firewall appliances to send the traffic to the internet after inspection.

CDeploy a Network Load Balancer with the firewall appliances as targets. Configure the firewall appliances with a single network interface in a private subnet. Use a NAT gateway to send the traffic to the internet after inspection.

DDeploy a Network Load Balancer with the firewall appliances as targets. Configure the firewall appliances with two network interfaces: one network interface in a private subnet and another network interface in a public subnet. Use the NAT functionality on the firewall appliances to send the traffic to the internet after inspection.

Show Suggested Answer

Suggested Answer: B

by Herminia at Dec 23, 2023, 06:58 PM

Limited Time Offer

25%

Off

Get Premium ANS-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sunshine

7 months ago

Haha, yeah, the load balancer choices are definitely meant to trip people up. But I agree, option B seems like the way to go. It checks all the boxes - cost-effective, traffic inspection, and NAT capabilities. *laughs* Although, I do kind of wish we could just use a single firewall appliance and save even more money. Maybe I'll suggest that to the company, they'll probably love the idea!

upvoted 0 times

...

Marshall

7 months ago

Hmm, I was also considering option D with the Network Load Balancer, but I think you guys make a good point. The Gateway Load Balancer is probably a better fit since it's designed for this use case. And using the firewall's built-in NAT is a smart way to save on costs. *chuckles* I wonder if the exam writers are trying to trick us with all these load balancer options.

upvoted 0 times

...

7 months ago

Okay, let's think through this step-by-step. The key requirements here are cost-effectiveness, traffic inspection, and NAT capabilities. I'm leaning towards option B - the Gateway Load Balancer with the firewall appliances having two network interfaces, one in a private subnet and one in a public subnet. This way, we can leverage the firewall's built-in NAT functionality rather than using a separate NAT gateway, which could be more cost-effective.

upvoted 0 times

...