A company is deploying a third-party firewall appliance (from AWS Marketplace) into a shared-services VPC to inspect and protect all outbound internet-bound traffic from the organization’s VPCs. The architect must prioritize reliability and minimize failover time between firewall appliances within the same AWS Region. Routing from the shared-services VPC to other VPCs is already configured. Which of the following steps should the architect recommend? (Choose three.)

To ensure high reliability and minimize failover time, deploying two firewall instances in different Availability Zones (AZs) is crucial for redundancy. A Gateway Load Balancer (GWLB) is specifically designed for deploying, scaling, and managing virtual appliances like firewalls. It acts as a transparent network gateway, preserving source IP addresses and allowing appliances to inspect traffic in-line. Creating a target group and registering the firewall instances with the GWLB enables it to distribute traffic and perform health checks. Finally, a VPC Gateway Load Balancer endpoint (GWLB endpoint) in the shared-services VPC is needed to route traffic from other VPCs through the GWLB, directing it to the firewall appliances for inspection. Incorrect options: Creating a Network Load Balancer (NLB) is not ideal because GWLB is purpose-built for transparent appliance insertion and preserves source IP addresses, which is critical for firewalls. Deploying both firewall instances in the same AZ would create a single point of failure, compromising reliability. A VPC interface endpoint is for private access to AWS services, not for routing traffic through a firewall appliance.