A team needs a managed firewall for their VPC that supports custom Suricata-compatible rules and stateful inspection of traffic between subnets. Which service should they deploy?
Show answer and explanation
Answer: B
Network Firewall is deployed into dedicated firewall subnets and inspects traffic that is routed through them, using stateless rules plus stateful Suricata-compatible rule groups. Policies can be shared across VPCs through Firewall Manager, which makes it a fit for centralized inspection of east-west and egress traffic.
WAF and Shield address web requests and DDoS, not general VPC packet inspection.
Why the other options are wrong
- A. Security groups are stateful allow lists attached to interfaces. They support no signature language and cannot inspect payloads.
- C. WAF filters HTTP traffic at the application edge and does not process arbitrary protocols inside a VPC.
- D. AWS Shield mitigates DDoS attacks. It does not provide rule-based traffic inspection.