Examice

Exam SAP-C02 All QuestionsBrowse all questions from this exam

Question 312

A company is deploying a third-party firewall appliance solution from AWS Marketplace to monitor and protect traffic that leaves the company's AWS environments. The company wants to deploy this appliance into a shared services VPC and route all outbound internet-bound traffic through the appliances.

A solutions architect needs to recommend a deployment method that prioritizes reliability and minimizes failover time between firewall appliances within a single AWS Region. The company has set up routing from the shared services VPC to other VPCs.

Which steps should the solutions architect recommend to meet these requirements? (Choose three.)

Deploy two firewall appliances into the shared services VPC, each in a separate Availability Zone.

Create a new Network Load Balancer in the shared services VPC. Create a new target group, and attach it to the new Network Load Balancer. Add each of the firewall appliance instances to the target group.

Create a new Gateway Load Balancer in the shared services VPCreate a new target group, and attach it to the new Gateway Load Balancer Add each of the firewall appliance instances to the target group.

Create a VPC interface endpoint. Add a route to the route table in the shared services VPC. Designate the new endpoint as the next hop for traffic that enters the shared services VPC from other VPCs.

Deploy two firewall appliances into the shared services VPC, each in the same Availability Zone.

Create a VPC Gateway Load Balancer endpoint. Add a route to the route table in the shared services VPC. Designate the new endpoint as the next hop for traffic that enters the shared services VPC from other VPCs.

Correct Answer: A, C, F

To ensure high availability and reliability while minimizing failover times, the deployment should involve multiple Availability Zones and use specialized AWS services. Deploying two firewall appliances in separate Availability Zones increases redundancy and fault tolerance. A Gateway Load Balancer (GWLB) is designed to handle traffic routing and balancing for virtual appliances like firewalls. A GWLB endpoint ensures that traffic from other VPCs can be routed to the firewall appliances effectively. These steps ensure that failover times are minimized and reliability is prioritized.

Discussion

ayadmawlaOptions: ACF

Need (A) two firewalls spread over two availability zones for HA and balanced by an NLB, then (C) a Gateway Load Balancer to interface to the virtual 3rd party network firewalls through the NLB, then (F) a Gateway Load Balancer EndPoint in the Consumer VPC with routes taking the traffic to the shared GLB + Firewalls A simple diagram is given here so you don't forget if you are visual like me :) https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/getting-started.html

ayadmawla

apologies, I meant balanced by the GLB (A)

s61Options: ACF

ACF https://docs.aws.amazon.com/vpc/latest/privatelink/create-gateway-load-balancer-endpoint-service.html

UstadOptions: ACF

https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-supported-architecture-patterns/

airgeadOptions: ACD

A: Use 2 firewall Apliances for each AZ C: Use GWLB for 3rd party appliances routing traffic D: nables the routing of outbound internet-bound traffic through the firewall appliances.

KungLjao

Why not gw endpoint?

gfhbox0083Options: ACF

A, C, F for sure. Using Gateway Load Balancer for distributing traffic across multiple virtual appliances

sarlos

healthy virtual appliances means gateway load balancer.

enkOptions: ABD

Obviously A over E. GWLB's don't make good load balancers. Avoid C and F. Need NLB to minimize the failover time between the (2) 3rd party FW's.

enk

Well, I read a bit further on Gateway Load Balancers and a 3rd party firewall is the perfect scenario to use a GwLB. So, looks like the correct answers are ACF.