A retailer runs public web apps behind an Application Load Balancer and private VPC workloads needing east-west inspection between subnets, SQL injection blocking, and subnet-level filtering with audit trails. Which network security architecture delivers traffic inspection, filtering, and application-layer protection?
Select an answer to reveal the explanation.
Short Explanation
You're guarding both the front door and hallways with cameras rolling. Layered controls put inspection at every tier from WAF to firewall to logs.
Full Explanation
The correct design is complete because AWS WAF on the Application Load Balancer provides Layer 7 inspection that blocks SQL injection, AWS Network Firewall endpoints placed in the routing path centralize stateful inspection of east-west traffic between subnets, NACLs add stateless subnet-level filtering, and VPC Flow Logs create audit trails. A design using only WAF with NACLs and Flow Logs is operationally sound for internet-facing apps but misses east-west inspection, since without route tables steering traffic to Network Firewall endpoints inter-subnet traffic is never centrally inspected. A design routing traffic through Network Firewall endpoints plus NACLs and Flow Logs is standard for segmentation and logging but misses application-layer defense, because Network Firewall works at network layers and cannot parse SQL payloads like WAF managed rules can. A design combining WAF with Network Firewall is powerful for edge and east-west inspection but misses subnet-level filtering and auditing by omitting NACLs and Flow Logs. For exams map phrases literally: SQL injection means WAF, east-west means Network Firewall, subnet stateless means NACLs, audit means Flow Logs. Practically verify Web ACL block samples, route tables pointing to the endpoint, and Flow Log records.