Security policy requires all outbound internet traffic from 20 workload VPCs to pass through deep packet inspection. What's the scalable architecture?
A.NAT gateways in every VPC with security groups
NAT + SGs provide no DPI — just connectivity and port filtering.
B.A dedicated egress/inspection VPC with AWS Network Firewall, fronted by Transit Gateway routing all outbound flows through it
Correct. Centralized inspection VPC + TGW is the documented design.
C.WAF on each VPC's internet gateway
WAF attaches to ALB/CloudFront, not outbound NAT paths.
D.Squid proxies in one VPC with VPC peering
DIY proxies + peering don't scale and lack managed DPI.
Why this answer
The reference pattern: a centralized inspection VPC running Network Firewall (or GWLB + appliances), with TGW route tables steering all egress through it — scales to many VPCs with one policy domain.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security