ANS-C01 Question #203: Real Exam Question with Answer & Explanation

Question

A network engineer needs to improve the network security of an existing AWS environment by adding an AWS Network Firewall firewall to control internet-bound traffic. The AWS environment consists of five VPCs. Each VPC has an internet gateway, NAT gateways, public Application Load Balancers (ALBs), and Amazon EC2 instances. The EC2 instances are deployed in private subnets. The architecture is deployed across two Availability Zones. The network engineer must be able to configure rules for the public IP addresses in the environment, regardless of the direction of traffic. The network engineer must add the firewall by implementing a solution that minimizes changes to the existing production environment. The solution also must ensure high availability. Which combination of steps should the network engineer take to meet these requirements? (Choose two.)

Options

• ACreate a centralized inspection VPC with subnets in two Availability Zones. Deploy Network
• BConfigure new subnets in two Availability Zones in each VPC. Deploy Network Firewall in each
• CDeploy Network Firewall in each VPUse existing subnets in each of the two Availability Zones to
• DUpdate the route tables that are associated with the private subnets that host the EC2 instances.
• EUpdate the route tables that are associated with the public subnets that host the NAT gateways