Two workloads in a cloud VPC must be inspected when they talk to each other. The inspection must stay in the cloud. Campus delay is not acceptable. Which policy fits?
Select an answer to reveal the explanation.
Short Explanation
The two workloads need a checkpoint in the cloud, not a trip to campus and back. You put east-west inspection on the path between them. Backhaul adds the delay you were told not to accept, and the campus VPN never sees a flow that stays in the VPC.
Full Explanation
East-west inspection between two workloads in a VPC is a cloud security policy on the path those packets actually take, such as a firewall or a security group design that forces the flow through an inspection point in the cloud. That meets the requirement to stay in the cloud. Backhaul through the campus firewall sends the flow out and back, which adds the delay the design forbids. An inbound publish rule lets internet clients in. It does not inspect workload-to-workload traffic. A longer IKE lifetime changes the campus VPN rekey. Packets that stay in the VPC never cross that VPN, so the lifetime cannot inspect them. Exam caveat: the route between the workloads has to pass the inspection point. A security policy on a firewall the packets do not traverse does nothing. Operational check: a flow between the workloads should show a hit on the in-cloud inspection log and should not appear on the campus firewall.