Third-party firewall appliances must inspect traffic inline between VPCs and the internet — with the appliances themselves load-balanced, scaled, and transparent to both endpoints. What integrates them into the path?
A.An Application Load Balancer in front of the firewalls
ALB terminates HTTP — it's not transparent L3 inline inspection.
B.Gateway Load Balancer with GWLB endpoints routing flows through the appliance fleet
Correct. GWLB endpoints put appliances in-path transparently.
C.A Network Load Balancer with TCP listeners
NLB is L4 and not designed as an inspection insertion point.
D.Traffic Mirroring to the appliances
Mirroring is passive copy — detection only, no enforcement.
Why this answer
GWLB is the purpose-built insertion point for third-party appliances: GENEVE-encapsulated flows routed via GWLB endpoints, appliances scale behind the balancer, source/destination see no proxy. Mirroring copies traffic for analysis — it doesn't sit inline.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security