Security wants to insert scalable inline network appliances (IDS/firewall) into VPC traffic flows without hand-building fragile per-instance routes for every new appliance. Which load balancing pattern supports that insertion model?
Select an answer to reveal the explanation.
Short Explanation
Think of Gateway Load Balancer as the on-ramp that fans traffic through a fleet of inspection trucks and back—add trucks as load grows instead of rewriting every route by hand.
Full Explanation
Security teams that must insert scalable inline network appliances (IDS/firewall) into VPC traffic flows without hand-building fragile per-instance routes for every new appliance should use a Gateway Load Balancer (GWLB). GWLB is designed to distribute traffic to third-party virtual appliances and to simplify insertion using Gateway Load Balancer endpoints, so east-west or ingress/egress flows can be steered through a scalable appliance fleet. That replaces brittle one-off route hacks each time the municipality adds another inspection node.
Application Load Balancer host headers alone route HTTP to targets; they are not a replacement for inline packet appliances that must see traffic transparently at generic network layers. Amazon CloudFront origin groups help HTTP origin failover at the edge—they are not the mechanism to inspect east-west VPC flows with IDS appliances. NAT Gateway rewrite rules embedding full IDS signatures misstate NAT Gateway’s purpose: NAT provides outbound translation/egress assistance, not a full IDS signature platform.
Exam caveat: GWLB is the appliance-insertion load balancer; do not confuse it with ALB (L7 HTTP) or NLB (L4 connection scale for applications). Appliance health, GENEVE encapsulation behavior, and careful route table design to avoid asymmetric traffic blackholes remain operational responsibilities.
Operational check: deploy GWLB with a pair of IDS appliances across AZs; point route tables through GWLB endpoints for the protected subnets; fail one appliance and confirm traffic continues through healthy nodes; and verify inspection policies still see both directions of municipal application flows without per-instance static routes.