SAP-C02 Practice Question 12: Centralized Inspection Appliance Mode
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 2 · question 2 of 10
A network team centralized east-west traffic inspection for 25 spoke VPCs. Every spoke VPC is attached to one transit gateway. The spoke route table sends 0.0.0.0/0 to an inspection VPC attachment, and the inspection VPC contains AWS Network Firewall endpoints in three Availability Zones. Each Availability Zone's transit gateway attachment subnet routes to the firewall endpoint in the same zone. Stateful rule groups are in use.
Since the cutover, users report that some connections between spoke VPCs hang or reset while others work normally. Flow logs show that the failing flows are always between workloads in different Availability Zones. Traffic between workloads in the same Availability Zone never fails. Firewall rules allow the traffic, and the firewall's alert logs show the return packets being dropped as not belonging to any known session.
What should the solutions architect do to fix the problem with the least change to the design?
Show answer and explanation
Answer:
This is the classic asymmetric-routing failure of a centralized inspection VPC. Without appliance mode, a transit gateway tries to keep traffic in the Availability Zone it came from. A request from a workload in AZ-1 enters the inspection VPC through the AZ-1 attachment subnet and is inspected by the AZ-1 firewall endpoint. The response from a workload in AZ-2 enters through the AZ-2 subnet and reaches the AZ-2 endpoint, which never saw the original request. A stateful engine drops that packet as out-of-state. That explains why only cross-AZ flows fail. With appliance mode enabled on the inspection VPC attachment, the transit gateway hashes each flow to a single network interface in the appliance VPC and uses the same one for return traffic. Both directions then pass through the same endpoint for the life of the flow. It is one attachment setting, with no redesign.
AWS now also offers Network Firewall as a native transit gateway *network function attachment*, which is created with appliance mode already on. For an existing self-managed inspection VPC, the fix is to turn the setting on.
Option B throws away the security model to hide the symptom. Stateless rules can't track connections, so the team loses stateful domain filtering, protocol detection, and session-aware rules, which were presumably why they centralized inspection.
Option C is not a workable design. A VPC attachment spans the subnets you choose in each zone, and splitting routing by zone across several transit gateways leaves cross-AZ flows asymmetric. The documentation also warns that connecting more than one transit gateway to an appliance VPC does not guarantee flow stickiness.
Option D is not available for this case. Transit gateway ECMP applies to VPN, Connect, and Direct Connect gateway attachments, not to VPC attachments. And spreading return traffic across endpoints is exactly the asymmetry that breaks a stateful firewall.
Reference: How AWS Transit Gateway works - appliance in a shared services VPC