A three-tier VPC hosts public ALBs, private app servers, and databases. Policy requires stateful host filtering, subnet-level denial of a scanner CIDR, and centralized stateful egress URL filtering for malware domains. Which network control combination should the engineer troubleshoot and apply?
Select an answer to reveal the explanation.
Short Explanation
You need bouncers at three doors, not one overworked guard, and that's layering. Security groups handle hosts, NACLs block the scanner subnet, and Network Firewall screens outbound domains for you.
Full Explanation
The correct combination matches each control to its layer since security groups enforce stateful host filtering with automatic return allowance, NACLs enforce stateless subnet denial ideal for discarding scanner CIDR traffic at tier boundaries, and Network Firewall enforces centralized stateful egress inspection with Suricata FQDN rules to block malware domains. The NAT gateway design fails on egress concept because NAT provides translation and logging but lacks FQDN-aware stateful filtering, so malicious URLs would still pass despite correct host and subnet controls. The security group and firewall design fails on placement concept because blocking the scanner with firewall policy instead of NACLs misses the required subnet-level stateless deny and centralizes what should be a cheap edge discard. The NACL and firewall design fails on state concept because subnet NACLs cannot replace stateful host enforcement, requiring manual ephemeral ports and leaving instance isolation without connection tracking. Exam caveat is to anchor on keywords stateful host, stateless subnet, and centralized URL filtering rather than assuming one scalable service covers all layers. Practical check is to confirm NACL denies for scanner IP in flow logs, security group stateful accepts without explicit return rules, and firewall alert logs showing denied malware SNI domains.