A network engineer must deploy AWS Network Firewall into an existing environment that includes: a transit gateway with all VPCs attached; hundreds of application VPCs; a centralized egress internet VPC with a NAT gateway and an internet gateway; a centralized ingress internet VPC hosting public ALBs; and on-premises connectivity via a Direct Connect gateway. The application VPCs have workloads in private subnets and their route tables send 0.0.0.0/0 to the transit gateway. The firewall must inspect east-west (VPC-to-VPC) and north-south (internet and on-premises) traffic with Suricata-compatible rules. The solution should require minimal architectural changes. Which combination of steps should the engineer take? (Choose three.)

Deploying Network Firewall in a centralized inspection VPC minimizes architectural changes and simplifies management compared to deploying in every application VPC. This centralizes inspection for east-west and north-south traffic. Updating the HOMENET rule group variable to include all internal CIDR ranges (VPCs and on-premises) is crucial for Suricata-compatible rules to correctly identify internal networks and apply appropriate policies. EXTERNALNET should define external, untrusted networks. Configuring two transit gateway route tables, one for application VPCs and one for the inspection VPC, enables "bump-in-the-wire" traffic steering. Application VPCs route traffic to the inspection VPC, which then routes to the final destination (internet, on-premises, or other VPCs) after inspection, ensuring all traffic passes through Network Firewall. A single route table would not allow for this controlled traffic flow.