Verdant Analytics connects dozens of VPCs through an AWS Transit Gateway and built a centralized inspection VPC with AWS Network Firewall. After enabling inspection, inter-VPC sessions are intermittently dropped due to asymmetric routing. Which actions are required to ensure reliable stateful inspection across the Transit Gateway? (Choose two.)

Asymmetric routing occurs when traffic takes different paths for the forward and return journeys, which breaks stateful firewalls like AWS Network Firewall. To fix this, two actions are needed. First, enable Appliance Mode on the Transit Gateway attachment for the inspection VPC. This ensures that return traffic for a session always goes back to the same Network Firewall endpoint that processed the initial traffic, maintaining state. Second, configure Transit Gateway route tables to explicitly steer traffic. This involves directing traffic from spoke VPC attachments to the inspection VPC attachment for inspection, and then ensuring return traffic from the inspection VPC is routed back to the correct originating spoke attachment. Adding default routes in spoke VPCs directly to Network Firewall ENIs is incorrect because traffic still needs to pass through the Transit Gateway for inter-VPC communication. Attaching AWS WAF to the Transit Gateway is incorrect; WAF is an L7 firewall and cannot be directly attached to a Transit Gateway, nor does it solve asymmetric routing for Network Firewall. Enabling NAT Gateway in each spoke VPC is incorrect because it doesn't address the routing issue through the Transit Gateway and would add unnecessary complexity and cost.