A company has a multi-account environment managed by AWS Control Tower. They want to implement a centralized egress architecture. All outbound internet traffic from the private subnets of 50 member accounts must be routed through a central 'Network' account. The Network account will inspect the traffic using AWS Network Firewall before allowing it to the internet. Which architecture provides the MOST scalable solution?

Deploy an AWS Transit Gateway in the Network account and share it via AWS RAM. Attach the member VPCs. Route default traffic (0.0.0.0/0) from member VPCs to the Transit Gateway. In the Network account, route traffic from the TGW to the Network Firewall, then to a NAT Gateway.

Set up VPC Peering between all 50 member VPCs and the central Network VPC. Route default traffic over the peering connections to the Network Firewall.

Deploy a NAT Gateway in every member VPC. Route traffic from the NAT Gateways to the central Network Firewall using AWS PrivateLink.

Use AWS Cloud WAN to create a core network. Attach the member VPCs. Configure the core network to route all traffic directly to the internet, bypassing the Network account.