Lumen AI wants to prevent data exfiltration from its VPC by blocking outbound HTTPS to known malicious domains and also detect internal port scans. They prefer a managed, inline inspection service. Which solution best meets these requirements?

AWS Network Firewall is the best solution because it offers inline, managed network security with stateful inspection. You can create stateful rule groups, including domain lists for FQDN blocking via TLS SNI or HTTP Host headers, effectively preventing data exfiltration to malicious domains. Additionally, Network Firewall supports Suricata-compatible rules, allowing you to define custom rulesets to detect internal port scans. Routing outbound traffic through firewall subnets ensures all relevant traffic is inspected. Security groups operate at the instance level and only allow or deny traffic based on IP addresses and ports, not FQDNs or advanced threat detection like port scans. AWS WAF is designed for web applications and protects against common web exploits, not general outbound network traffic or port scanning within a VPC. Route 53 Resolver DNS Firewall blocks DNS queries to malicious domains but does not inspect L3/L4 traffic for port scans.