Frontend and backend VMs are in the same VPC across different subnets. NVAs (full proxies) that SNAT allowed traffic must inspect frontend->backend traffic. NVAs are deployed and an internal passthrough ILB is available. How should you configure VPC routing so NVAs inspect inter-subnet traffic?

The correct solution uses a Policy-Based Route (PBR) to redirect traffic from the frontend subnet to the NVAs via an internal passthrough ILB. PBRs are ideal for granular traffic steering based on source and destination, which is necessary for inter-subnet inspection. By scoping the PBR to VMs with the frontend network tag, only relevant traffic is redirected, ensuring the NVAs inspect the frontend-to-backend flow. The NVAs, acting as full proxies, will then forward the SNATted traffic to the backend. Incorrect options: The first incorrect option incorrectly sets the PBR's source to the backend subnet and destination to the frontend subnet, which would redirect traffic in the reverse direction (backend to frontend) instead of the desired frontend to backend. The second and third incorrect options suggest using a custom static route with an instance tag as the target. Custom static routes primarily use IP prefixes as destinations and do not support instance tags as next-hop targets for traffic redirection to an ILB for inspection in this manner. Additionally, the third option's multi-NIC NVA setup is not directly relevant to the routing mechanism for inspection via an ILB.