A manufacturer must filter east-west traffic inside a VPC by domain name and by port. The traffic is not HTTP to a public load balancer. Which control matches that filter?
Select an answer to reveal the explanation.
Short Explanation
You need a firewall in the VPC path that can match both a domain and a port, so AWS Network Firewall fits this east-west traffic. AWS WAF on an Application Load Balancer cannot inspect traffic that never reaches it, and a CloudFront cache policy does not filter packets between subnets.
Full Explanation
AWS Network Firewall is the appropriate control because it can sit in the VPC traffic path and use stateful rules, including domain lists and ports, to filter traffic between subnets. That matches the east-west filtering requirement. AWS WAF on an Application Load Balancer inspects HTTP requests that reach the load balancer, but this traffic is not HTTP to a public load balancer and never reaches that endpoint. A CloudFront cache policy determines what CloudFront caches; it does not drop internal packets between subnets. S3 Block Public Access is an S3 account setting, not a control for inspecting VPC flows. Exam caveat: subnet route tables must direct the traffic through the Network Firewall endpoint; otherwise, packets can take another path and bypass the rules. As a practical check, a connection denied by the domain rule should fail, while an allowed port between the same subnets should succeed. Place firewall endpoints in dedicated subnets and route the east-west traffic through them. Domain list rules match the HTTP Host header or the TLS SNI, so they apply to HTTP and HTTPS flows, and port rules cover other protocols. If HTTP is later exposed at an Application Load Balancer, AWS WAF can be appropriate for that separate traffic. A firewall flow log can show a deny, confirming that the traffic passed through the firewall.