A company uses third-party firewall appliances on-premises and wants the same inline inspection model in AWS. There is one VPC with an internet gateway and a fleet of web servers in an Auto Scaling group. The security and network teams need inline inspection of all packets to and from the web servers, and the solution must scale as the firewall appliance fleet scales. Which combination of actions should the teams take? (Choose three.)

To implement inline inspection with third-party firewalls in AWS, a dedicated VPC for the firewall appliances is best practice for security and scalability, separating the inspection layer from the application layer. A Gateway Load Balancer (GWLB) is essential for distributing traffic to the firewall fleet and ensuring high availability and scalability. GWLB uses port 6081 for its GENEVE encapsulation protocol, so the firewall security group must allow this port for traffic inspection and health checks. Routing traffic through the GWLB endpoint is achieved by updating the internet gateway's route table and the web server subnet route tables to direct traffic to the GWLB endpoint, and then routing traffic from the GWLB endpoint back to the internet gateway for external connectivity. Deploying firewalls in the existing VPC is less secure and harder to manage. Creating a security group allowing port 443 is incorrect as GWLB uses port 6081. Associating a new route table with the internet gateway is not the correct mechanism; instead, the existing internet gateway route table is updated.