A company is implementing a hub-and-spoke design that uses a Gateway Load Balancer (GWLB) and GWLB endpoints. The hub contains the GWLB and virtual appliances; spoke VPCs have internet gateways. Which of the following sequences correctly describes the traffic path from an application in a spoke VPC to the internet?

The correct answer accurately describes the traffic flow. Spoke VPCs are configured with route tables that direct internet-bound traffic to the GWLB endpoint. This endpoint then securely and privately forwards the traffic to the GWLB in the hub VPC. The GWLB distributes the traffic to a virtual appliance for inspection. After inspection, the return traffic is sent back to the GWLB, which then routes it back through the GWLB endpoint in the spoke VPC. Finally, the traffic exits to the internet via the internet gateway in the spoke VPC. Incorrect options introduce errors such as traffic being delivered to the GWLB endpoint instead of the GWLB itself in step 2, or incorrectly stating that the GWLB sets an X-Forwarded-For header (which is an HTTP header, not relevant for GWLB's network-layer inspection). Other incorrect options also misrepresent the return path, suggesting traffic returns directly to the GWLB instead of the GWLB endpoint.