A fintech runs public APIs on an ALB with microservices in private subnets and Direct Connect to on-premises. It must inspect all east-west and egress traffic, filter stateless floods, and block OWASP web attacks centrally. Which network security architecture provides layered traffic inspection and filtering?

The correct architecture works because it enforces layered inspection at a centralized choke point: Transit Gateway routes east-west traffic between VPCs, egress traffic, and Direct Connect traffic through an inspection VPC (or a Transit Gateway-attached firewall) where AWS Network Firewall applies stateless rules for floods, stateful rules, and intrusion prevention, while AWS WAF on the public ALB adds Layer 7 filtering for OWASP threats such as injection and cross-site scripting. The Transit Gateway and Network Firewall design with Shield Advanced is strong on network-layer centralization and DDoS protection, but fails the requirement to block OWASP web attacks because neither Transit Gateway, Network Firewall, nor Shield Advanced parses HTTP semantics the way WAF does. The NAT Gateway with Network Firewall plus WAF design secures internet egress and the public edge but misses east-west coverage, because service-to-service traffic inside private subnets never traverses the NAT gateway and so bypasses inspection. The per-VPC Network Firewall with WAF design uses the right engines but breaks the central-management requirement by scattering policy across every VPC, which complicates Direct Connect integration, audit, and consistent updates. Exam caveat is to map each keyword in the stem to a distinct layer and to confirm whether central enforcement is explicitly required. Practical check is to audit route tables so all private subnet and inter-VPC routes point to the inspection path and to confirm WAF is in block mode with centralized logging enabled.