What's changed: Deepened ANS-C01 Chapter 6 (SG/NACL eval order/SG references/ephemeral, inspection VPC routing/appliance mode/firewall remits, Shield Adv/WAF Web ACL/Firewall Mgr prereqs/ACM Region + tables, scenarios, FAQ, traps; ja figures)
6.2Centralized Inspection and Firewalls
Inspect at one point—understand AWS Network Firewall, an inspection VPC, routing via Transit Gateway, appliance insertion with GWLB, and the Route 53 Resolver DNS Firewall.
To inspect traffic from many VPCs in one place, put AWS Network Firewall in an inspection VPC and route all traffic through it via the Transit Gateway.
6.2.1Centralized inspection architecture
- AWS Network Firewall: a managed stateful firewall + IPS. Apply domain allow-lists and IPS rules.
- Inspection VPC + TGW: aggregate all VPCs’ traffic through the TGW into an inspection VPC.
- GWLB: use to transparently insert third-party appliances (NGFW/IDS).
- Route 53 Resolver DNS Firewall: block resolution to malicious domains at the DNS query level.
Common on ANS-C01: VPC-level managed stateful FW/IPS with domain allow-lists = AWS Network Firewall, centralized inspection of all VPCs = inspection VPC + TGW, insert third-party FW = GWLB, and block resolution of malicious domains = Route 53 Resolver DNS Firewall. The key contrast: managed = Network Firewall, third-party = GWLB.
ANS-C01 probes the routing design of centralized inspection and each firewall’s remit. In an inspection VPC, you split TGW route tables to send spoke east-west/egress traffic first to the inspection VPC attachment and then back to the destination—a round trip prone to asymmetry—solved with TGW appliance mode, which pins a flow to the same-AZ Network Firewall endpoint. AWS Network Firewall is a managed stateful engine (Suricata-compatible rules) built on GWLB internally, strong at domain-based filtering (FQDN allow/deny lists), IPS signatures, and egress control—while L7 HTTP attacks themselves (SQLi/XSS) are WAF’s domain. At the DNS layer, Route 53 Resolver DNS Firewall evaluates DNS queries from the VPC and blocks resolution of malicious domains with NODATA, NXDOMAIN, or custom responses (managed domain lists available), a frequent countermeasure to DNS tunneling/exfiltration. To summarize remits: L7 at the edge = WAF, DDoS = Shield, VPC network-layer filtering/IPS/FQDN = Network Firewall, DNS resolution control = Resolver DNS Firewall, and transparent third-party appliance insertion = GWLB. Enforcing all of these org-wide is Firewall Manager (next section).
| What it protects | Use | Layer/scope |
|---|---|---|
| SQLi/XSS/rate to web app | AWS WAF | L7, CloudFront/ALB/API GW |
| VPC east-west/egress, FQDN/IPS | AWS Network Firewall | L3-L7, inspection VPC |
| Malicious domain resolution | Route 53 Resolver DNS Firewall | Per DNS query |
| Transparent third-party FW | Gateway Load Balancer | L3 gateway |
Scenario: you aggregated all spoke VPC egress through Network Firewall in an inspection VPC, but return packets occasionally drop. → The round trip causes asymmetry where forward and return traverse firewall endpoints in different AZs. Enable Transit Gateway appliance mode to pin a flow to the same-AZ endpoint, and verify the TGW route-table split (pre/post inspection) is correct.
FAQ: Q. Network Firewall or WAF? A. Different roles—HTTP app-layer attacks = WAF; VPC network-layer filtering, FQDN, IPS, and egress control = Network Firewall; using both is common. Q. Stop data exfiltration via DNS tunneling? A. Use Resolver DNS Firewall to block resolution of malicious/unapproved domains.
Trap: "use AWS Network Firewall to stop SQL injection" is false—HTTP app-layer SQLi/XSS is WAF’s job. Network Firewall excels at network-layer through FQDN/IPS and egress control. Conversely, "use WAF to do FQDN-based egress control for a VPC" is wrong—that is Network Firewall’s (or Resolver DNS Firewall’s) domain.
6.2.2Section summary
- Centralized inspection = Network Firewall in an inspection VPC, aggregated via TGW
- Third-party insertion = GWLB; DNS control = Resolver DNS Firewall
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Inspect east-west/egress traffic from many VPCs in one place with domain allow-lists and IPS. Best choice?
Q2. Block DNS resolution from EC2 to specific malicious domains. What?
Q3. Transparently insert an existing third-party next-gen firewall into the traffic path. What?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.