Security policy requires all egress traffic from workload VPCs to be inspected by an inline stateful firewall before reaching the internet. Which managed service provides this?
A.Security groups
Security groups are instance-level filters, not inline traffic inspection.
B.AWS Network Firewall
Correct. Network Firewall is the purpose-built inline inspection service.
C.AWS WAF
WAF filters layer-7 HTTP on ALB/CloudFront, not arbitrary egress flows.
D.Route 53 Resolver DNS Firewall
DNS Firewall filters DNS queries only, not general traffic.
Why this answer
AWS Network Firewall is the managed stateful firewall/IDS-IPS for VPCs — deployed inline (often via a dedicated inspection VPC + Transit Gateway), it inspects all traffic flows including egress with stateful rules.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security