Outbound traffic from VPCs must be filtered to allow only approved domains — a managed firewall inspecting egress at L3–L7. Which service?
A.Security groups with domain rules
SGs take IPs/ports/SG-refs — not domains.
B.AWS Network Firewall with domain-list rule groups
Managed domain-aware egress filtering. Correct.
C.NACLs with hostname rules
NACLs are also IP-level — no hostname support.
D.Route53 Resolver DNS Firewall only
DNS Firewall stops resolution but traffic to raw IPs bypasses it.
Why this answer
Network Firewall is the managed L3–L7 stateful firewall: Suricata rules + domain-list rule groups filter outbound traffic by hostname/domain (TLS SNI/HTTP Host). SGs/NACLs are IP/port-level — no domain awareness. DNS Firewall filters DNS resolution only.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security