SAA-C03 Q402 · Networking

Question

An ecommerce company runs several internal applications in multiple AWS accounts. The company uses AWS Organizations to manage its AWS accounts. A security appliance in the company's networking account must inspect interactions between applications across AWS accounts. Which solution will meet these requirements?

Accepted Answer

**Answer C is correct because Gateway Load Balancer (GWLB) is purpose-built for exactly this use case — deploying, scaling, and managing third-party virtual network appliances.**

**Step-by-step requirement matching:**

1. **Security appliance inspection**: GWLB operates at Layer 3 (Network Layer) of the OSI model and uses the GENEVE protocol to encapsulate all traffic transparently. This means the security appliance receives the original packets with full visibility — source IP, destination IP, protocol, ports — without any modification. This is critical for deep packet inspection.

2. **Cross-account architecture**: GWLB supports a **cross-account model** via **GWLB endpoints** (a type of VPC endpoint powered by AWS PrivateLink). The GWLB is deployed in the networking/security account al

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips