A fintech VPC hosts payment APIs that must allow HTTPS only from approved partner CIDRs, deny all other ingress, log rejected traffic, and filter outbound malicious domains. State checks show security groups alone are insufficient. Which network control design permits and prevents traffic as required?
Select an answer to reveal the explanation.
Short Explanation
You've got to lock down your payment APIs tight, so you'll pair your security groups with NACLs and add Network Firewall for bad domains. It's like stacking sieves that catch finer junk each time for solid defense in depth.
Full Explanation
Stateful security groups enforce allow-only HTTPS from partner CIDRs at the instance elastic network interface, stateless network ACLs provide subnet-level allow and explicit deny with logging context via VPC Flow Logs for rejected traffic, and AWS Network Firewall adds stateful egress inspection with Suricata domain allow-listing to block malicious domains, jointly meeting ingress, logging, and egress needs that groups alone cannot cover. DHCP option sets with route propagation and peering fails by concept because it manages name resolution and routing, not packet filtering or domain inspection, so it cannot permit or deny specific ports or domains. Internet gateway plus NAT scaling fails by concept because it provides connectivity and address translation, not granular ingress restriction or malicious domain filtering, and broad Elastic IP use expands exposure. CloudFront caching with Route 53 and S3 hosting fails by concept because it optimizes content delivery and DNS failover, not VPC ingress and egress packet control for private payment APIs. For the exam, map stateless NACLs to subnet deny, security groups to instance allow, and Network Firewall to stateful domain filtering, and in practice verify rule order, statefulness, and firewall policy hits.