A network engineer must add an AWS Network Firewall to control internet-bound traffic in an existing environment that contains five VPCs. Each VPC has an internet gateway, NAT gateways, public ALBs, and EC2 instances in private subnets across two Availability Zones. The engineer must be able to write rules that consider the environment’s public IP addresses regardless of traffic direction, minimize changes to production, and ensure high availability. Which combination of steps should the engineer take? (Choose two.)

The correct approach involves deploying Network Firewall endpoints within each VPC, rather than a centralized inspection VPC, to avoid hairpinning traffic and simplify routing for existing resources. Creating new subnets for the Network Firewall endpoints ensures dedicated resources and avoids conflicts with existing infrastructure. Updating the route tables for public subnets (where NAT Gateways and ALBs reside) is crucial because these are the egress points for internet-bound traffic. This ensures all outbound traffic from private subnets (via NAT Gateways) and inbound traffic to ALBs is inspected by the Network Firewall. Updating private subnet route tables directly would not capture all internet-bound traffic, as NAT Gateways are the primary egress for those instances.