Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 128 discussion

Nope, you can't do centralized deployment. "For centralized deployment model, AWS Transit Gateway is a prerequisite." https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/

For centralized deployment model, AWS Transit Gateway is a prerequisite. Cannot add a new Shared VPC which is required for Centralized deployment.

As the environment spans two AWS Regions with VPC peering, a centralized model would require establishing a separate inspection VPC in each Region. This increases complexity versus directly protecting each VPC.

C is the right answer.

We're not planning on changing for the next 2yrs so B is correct.

C The distributed deployment model supports unencrypted traffic and can be set up to protect traffic within each VPC.

Deployment models There are multiple deployment models available with AWS Network Firewall. The right model depends on the use case and requirements. The following models are most common: Distributed AWS Network Firewall deployment model: AWS Network Firewall is deployed into each individual VPC. Centralized AWS Network Firewall deployment model: AWS Network Firewall is deployed into centralized VPC for East-West (VPC-to-VPC) and/or North-South (internet egress and ingress, on-premises) traffic. We refer to this VPC as inspection VPC throughout this blog post. Combined AWS Network Firewall deployment model: AWS Network Firewall is deployed into centralized inspection VPC for East-West (VPC-to-VPC) and subset of North-South (On Premises/Egress) traffic. Internet ingress is distributed to VPCs which require dedicated inbound access from the internet and AWS Network Firewall is deployed accordingly.

Centralized AWS Network Firewall deployment model: AWS Network Firewall is deployed into centralized VPC for East-West (VPC-to-VPC) and/or North-South (internet egress and ingress, on-premises) traffic. We refer to this VPC as inspection VPC throughout this blog post. B is correct ans

https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/

C is the answer, each VPC has network firewall in distributed deployment model only.