ANS-C01 Network Implementation Practice Question
A company has deployed a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application must be accessible over the internet, but the security team requires that all traffic be inspected by a third-party firewall appliance. What is the MOST scalable architecture?
⚠ Common exam trap
Test-takers frequently confuse Gateway Load Balancer with Network Load Balancer, thinking an NLB can transparently insert firewalls, but only GWLB supports transparent inline traffic inspection using GENEVE encapsulation without requiring the firewall to be the destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Gateway Load Balancer with firewall appliances in each Availability Zone.
Gateway Load Load Balancer (GWLB) is designed to scale third-party virtual appliances (e.g., firewalls) horizontally across multiple Availability Zones. It uses the GENEVE protocol to encapsulate traffic, enabling transparent inspection while preserving the original packet headers. This architecture meets the security requirement for traffic inspection and provides high availability and elasticity, unlike a single appliance or a proxy-based solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Network Load Balancer with target groups pointing to firewall appliances.
Why it's wrong here
NLB does not inspect; it load balances.
- ✗
Use an EC2 instance as a transparent proxy and set it as the next-hop in the route table.
Why it's wrong here
EC2 instance as next-hop is not scalable and hard to manage.
- ✓
Use a Gateway Load Balancer with firewall appliances in each Availability Zone.
Why this is correct
GWLB provides scalable, HA traffic inspection.
- ✗
Deploy a single firewall appliance in one Availability Zone and route all traffic through it.
Why it's wrong here
Single point of failure; not scalable.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.