A city requires that traffic leaving private application subnets be inspected and limited to approved destinations and ports. Default routes that send private-tier traffic directly to an Internet Gateway are not allowed. Which design best enforces that egress control?
Select an answer to reveal the explanation.
Short Explanation
Think of the firewall path like a single guarded gate out of the city yard. Route tables force cars through that gate for inspection—no sneaky driveway straight onto the IGW highway from private tiers.
Full Explanation
When a city requires inspection and destination control for traffic leaving private application subnets, route tables are the steering wheel. Private-subnet default routes must not point directly at an Internet Gateway; instead they should target a firewall inspection path such as AWS Network Firewall endpoints or a firewall appliance gateway so egress is forced through policy evaluation—approved destinations, ports, and protocols—before anything reaches the public internet. That design encodes "single guarded gate" egress rather than hoping each instance self-polices.
Attaching an Internet Gateway mindset to every private subnet and opening all outbound ports in the network ACL to 0.0.0.0/0 fails segmentation and inspection: private tiers become effectively public egress highways with no content or destination control. Removing all route tables and relying on security group descriptions in a wiki fails because routing, not documentation, determines packets. Publishing private subnet CIDRs to the public internet via BGP from each application instance fails operational sanity and security—it advertises internal addressing and bypasses centralized egress control.
Exam caveat: security groups and NACLs still matter, but without route-forced inspection, a permissive outbound SG can exfiltrate to arbitrary destinations; defense in depth means routes plus firewall policy plus least-privilege SGs. Operational check: traceroute or VPC flow analysis from a private instance should show the firewall endpoint hop, denied destinations should fail closed, and there must be no direct 0.0.0.0/0 route from private app subnets to an IGW.