A fintech runs web, app, and database tiers in private subnets across two AZs, must allow outbound HTTPS only to approved payment APIs by domain, block all other egress, and log flow decisions centrally. Security groups cannot filter by domain and NACLs are stateless. Which network control provides stateful domain-based egress filtering for the workloads?
Select an answer to reveal the explanation.
Short Explanation
You nailed the domain-filter gap that groups and ACLs can't cover. Stateful firewall rules inspect hostnames and enforce your allowlist with logging built in, like a bouncer with a guest list.
Full Explanation
The egress VPC design centralizes outbound inspection through AWS Network Firewall endpoints, whose stateful engine tracks sessions and applies domain-list rules to permit only approved payment API HTTPS destinations while default-denying other egress, and natively emits flow and alert logs to central storage for audit, directly satisfying stateful, domain-based, and centralized-logging needs across both AZs. NAT gateways with VPC Flow Logs provide highly available outbound connectivity and record traffic centrally but enforce no Layer 7 policy, as they translate addresses by IP and port without TLS SNI awareness, so they cannot allowlist by domain and would still permit unapproved destinations. AWS WAF web ACLs on a load balancer are a mature Layer 7 control for inbound HTTP inspection and can match hostnames with detailed logging, yet they operate in the ingress path for requests to the application and never see forward egress sessions initiated by private-subnet workloads, leaving required outbound filtering unaddressed. Route 53 Resolver DNS Firewall with allowlisted domains and query logging is widely used to suppress resolution of unwanted domains, but it acts only at DNS time and does not statefully inspect subsequent HTTPS connections, so hardcoded IPs, external resolvers, or cached records can bypass enforcement. On exams distinguish inspection direction and enforcement layer carefully, as domain wording often tempts selection of DNS or WAF controls when the stem demands stateful egress filtering, and in practice validate private-subnet routes point to firewall endpoints in each AZ, test both allowed and denied FQDNs, and confirm alert logs arrive centrally before tightening to deny-by-default.