Cloud workloads in several virtual networks currently reach the internet directly. The security team needs inline inspection of this outbound traffic, including threat prevention and URL filtering, before it leaves the cloud. Which deployment model fits?

Inline inspection requires a security control that traffic physically traverses. In cloud networks this is achieved with a gateway deployment model: a firewall or security gateway is placed in a hub or egress virtual network, and route tables in the workload networks send internet-bound traffic through it. The gateway can then apply threat prevention, URL and FQDN filtering and logging before traffic leaves the cloud. Cisco Multicloud Defense uses this model with egress gateways, and other cloud firewalls follow the same pattern. Agentless snapshot scanning examines disk images for vulnerabilities and misconfigurations; it is valuable for posture but never sees live network traffic, so it cannot inspect or block anything inline. Restricting security groups to TCP 443 outbound reduces exposure, but it is a port filter that cannot see URLs or threats, and most malicious traffic happily uses 443. Flow logs record metadata such as addresses, ports and byte counts after the fact; alerts on unusual destinations are detective controls that cannot inspect payloads or stop a connection. Exam caveat: decrypting outbound TLS on the gateway is needed for full content inspection, while FQDN filtering can work from the server name. Operational check: update route tables to point the default route at the gateway, generate test traffic from a workload to a blocked category, and confirm the gateway logs and blocks it.