nerdexam
Amazon

SAP-C02 · Question #734

A company uses AWS Organizations. The company runs two firewall appliances in a centralized networking account. Each firewall appliance runs on a manually configured highly available Amazon EC2…

The correct answer is A. Deploy a Gateway Load Balancer in the centralized networking account. Set up an endpoint C. Create an Auto Scaling group and a launch template that uses the new script as user data to F. Create VPC endpoints in the centralized networking account. Update the route tables in each. To modernize and scale firewall appliances in a centralized networking account using a Transit Gateway, the solution involves deploying a Gateway Load Balancer (GWLB) for transparent appliance insertion and traffic distribution. The firewall instances should be managed by an…

Submitted by satoshi_tk· Mar 6, 2026Design Solutions for Organizational Complexity

Question

A company uses AWS Organizations. The company runs two firewall appliances in a centralized networking account. Each firewall appliance runs on a manually configured highly available Amazon EC2 instance. A transit gateway connects the VPC from the centralized networking account to VPCs of member accounts. Each firewall appliance uses a static private IP address that is then used to route traffic from the member accounts to the internet. During a recent incident, a badly configured script initiated the termination of both firewall appliances. During the rebuild of the firewall appliances, the company wrote a new script to configure the firewall appliances at startup. The company wants to modernize the deployment of the firewall appliances. The firewall appliances need the ability to scale horizontally to handle increased traffic when the network expands. The company must continue to use the firewall appliances to comply with company policy. The provider of the firewall appliances has confirmed that the latest version of the firewall code will work with all AWS services. Which combination of steps should the solutions architect recommend to meet these requirements MOST cost-effectively? (Choose three.)

Options

  • ADeploy a Gateway Load Balancer in the centralized networking account. Set up an endpoint
  • BDeploy a Network Load Balancer in the centralized networking account. Set up an endpoint
  • CCreate an Auto Scaling group and a launch template that uses the new script as user data to
  • DCreate an Auto Scaling group. Configure an AWS Launch Wizard deployment that uses the new
  • ECreate VPC endpoints in each member account. Update the route tables to point to the VPC
  • FCreate VPC endpoints in the centralized networking account. Update the route tables in each

How the community answered

(20 responses)
  • A
    60% (12)
  • B
    10% (2)
  • D
    5% (1)
  • E
    25% (5)

Why each option

To modernize and scale firewall appliances in a centralized networking account using a Transit Gateway, the solution involves deploying a Gateway Load Balancer (GWLB) for transparent appliance insertion and traffic distribution. The firewall instances should be managed by an Auto Scaling Group with a launch template that uses the new configuration script. Finally, VPC endpoints (GWLBEs) must be created in the centralized networking account, and route tables in member accounts (and the Transit Gateway) updated to direct traffic through these endpoints to the firewalls.

ADeploy a Gateway Load Balancer in the centralized networking account. Set up an endpointCorrect

Deploying a Gateway Load Balancer (GWLB) is specifically designed for transparent insertion and scaling of network virtual appliances like firewalls, enabling high availability and efficient traffic distribution.

BDeploy a Network Load Balancer in the centralized networking account. Set up an endpoint

A Network Load Balancer (NLB) is not designed for transparent appliance insertion and GENEVE-encapsulated traffic routing needed for a firewall in a centralized inspection architecture; a Gateway Load Balancer is the correct choice.

CCreate an Auto Scaling group and a launch template that uses the new script as user data toCorrect

An Auto Scaling group with a launch template ensures the firewall appliances are highly available, automatically replaced if terminated, and can scale dynamically, using the provided script for automated configuration at startup.

DCreate an Auto Scaling group. Configure an AWS Launch Wizard deployment that uses the new

AWS Launch Wizard is a deployment tool, not the primary service for achieving dynamic scaling and high availability of instances, which is the function of an Auto Scaling group with a launch template.

ECreate VPC endpoints in each member account. Update the route tables to point to the VPC

Creating VPC endpoints in *each member account* is incorrect; the Gateway Load Balancer Endpoints that direct traffic to the centralized firewalls are created in the *centralized networking account* where the GWLB and firewalls reside.

FCreate VPC endpoints in the centralized networking account. Update the route tables in eachCorrect

Creating VPC endpoints (Gateway Load Balancer Endpoints) in the centralized networking account and updating Transit Gateway and member account VPC route tables ensures that traffic from member accounts is correctly steered through the GWLB and the firewall appliances for inspection.

Concept tested: AWS Gateway Load Balancer, Auto Scaling Groups, and centralized network inspection architecture with Transit Gateway

Source: https://docs.aws.amazon.com/vpc/latest/userguide/what-is-gwlb.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice