Outbound traffic from a VPC must be restricted to an approved list of domains, with Layer-7 inspection. Which AWS capability enforces domain-level egress filtering?
A.Security group outbound rules
SGs filter IP/port, not domain names.
B.AWS Network Firewall with stateful domain-list rules
Correct. Managed L7 domain filtering.
C.Network ACLs
NACLs are also IP/port-level and stateless.
D.Route 53 private hosted zones
Private zones resolve names; they don't filter egress.
Why this answer
Network Firewall is the managed L7 network firewall — stateful domain-list rules allow/deny outbound by domain name, plus Suricata IDS/IPS rules. SGs and NACLs work at IP/port level only — domains resolve to changing IPs, so they can't express domain policy.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Infrastructure Security practice session.
Practice Infrastructure Security