ANS-C01 Network Security, Compliance and Governance Practice Question
A company wants to ensure that all traffic to and from its Amazon EC2 instances in a VPC is inspected by a third-party security appliance. The instances are in private subnets and must maintain their private IP addresses. Which solution should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC
Gateway Load Balancer (GWLB) with Gateway Load Balancer endpoints (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' private IP addresses. The GWLB acts as a transparent layer between the VPC and the appliance, inspecting all traffic. Option A is incorrect because a Transit Gateway with a site-to-site VPN does not provide inline inspection without modifying the routing and IP addresses. Option C is incorrect because VPC Peering does not inherently provide traffic inspection; you would still need to route traffic through an appliance. Option D is incorrect because a Network Load Balancer is designed for load balancing, not for inline inspection of all traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a Transit Gateway with a site-to-site VPN to the appliance
Why it's wrong here
Transit Gateway with VPN does not provide inline inspection within the VPC.
- ✓
Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC
Why this is correct
Gateway Load Balancer with GWLBe allows transparent inline inspection of traffic.
- ✗
Use VPC Peering to connect to a central inspection VPC
Why it's wrong here
VPC Peering connects VPCs but does not inherently inspect traffic unless a device is configured.
- ✗
Set up a Network Load Balancer in front of the instances
Why it's wrong here
NLB distributes traffic but does not inspect it; it preserves source IP but does not insert a security appliance.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.