A bank wants every internet-bound flow that starts inside an AWS VPC to be inspected by the campus firewall. Traffic between two private subnets in the VPC must stay inside AWS. Which policy matches the internet requirement?
Select an answer to reveal the explanation.
Short Explanation
You want outbound cloud traffic to visit your own checkpoint before it sees the internet. That is a backhaul of the VPC's internet egress through the campus firewall. Locking the door between two private subnets is a different job, and you were told to leave that traffic inside AWS.
Full Explanation
Backhaul of internet traffic means packets that would have used the cloud internet gateway are routed instead across the site-to-site path to the campus firewall, inspected, and then sent to the internet. That matches the bank's requirement for flows that start in the VPC and are bound for the internet. An east-west security group between two private subnets controls traffic that stays inside the VPC. The requirement says that traffic must remain inside AWS, so changing it to a block would violate the second sentence. An inbound publish rule allows clients on the public internet to start sessions toward the application. It does not force the VPC's own outbound flows through the campus. A public virtual interface on Direct Connect is for public AWS services, not for private VPC prefixes, and swapping it in for the virtual private gateway does not create an inspected egress path. Exam caveat: backhaul needs a route in the VPC, often a default route to the virtual private gateway or transit gateway, and a return path. A more specific route to the internet gateway will bypass the firewall. Operational check: a flow from a private instance to a public website should arrive on the campus firewall, while a flow between the two private subnets should not leave AWS.