A city must inspect and filter VPC egress to the internet with controls deeper than security groups alone. Which service should the architect evaluate for centralized egress filtering?
Select an answer to reveal the explanation.
Short Explanation
Security groups are simple door locks; Network Firewall is the inspected checkpoint on the road out of town. Use it when you need deeper egress filtering than SG rules can express. Cognito, Macie, and ACM do not sit inline on NAT paths deciding which domains leave the VPC.
Full Explanation
When a city must inspect and filter VPC egress to the internet with controls deeper than security groups alone, evaluate AWS Network Firewall—often deployed with centralized inspection architectures and Gateway Load Balancer patterns—for stateful domain and protocol filtering on egress. Network Firewall adds suricata-style and domain-aware controls that security groups cannot express, supporting municipal acceptable-use and data-exfiltration defenses on the road out of town.
Amazon Cognito user pool rules blocking outbound OS package downloads fail because Cognito authenticates application users; it is not an inline VPC egress packet filter. Amazon Macie classification jobs as the inline packet filter on NAT gateways fail conceptually: Macie classifies S3 object contents asynchronously, not packets leaving a VPC. AWS Certificate Manager renewal events as a deny list for egress destinations fail because certificate lifecycle events are unrelated to destination-based egress filtering.
Exam caveat: Network Firewall inspection requires careful routing (traffic steered through the firewall endpoints); misrouted subnets silently bypass the control while dashboards still look “enabled.” Operational check: deploy firewall endpoints, update route tables so egress traverses inspection, test domain allow/deny policies with known good patch mirrors and known bad destinations, and monitor dropped flows for false positives affecting GIS or vendor updates.