SCS-C03 Infrastructure Security Practice Question
A company is designing a hub-and-spoke network architecture using AWS Transit Gateway. They want to centralize inbound and outbound internet traffic inspection using a fleet of firewalls in a dedicated 'Security VPC'. Which TWO steps are required to ensure traffic is correctly routed for inspection? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.
In a centralized inspection model, Transit Gateway (TGW) acts as the hub. Traffic from spoke VPCs must be routed to the TGW, which then uses a specific route table to forward traffic to the Security VPC. Appliance Mode must be enabled on the TGW attachment to ensure session stickiness for stateful firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.
Why this is correct
Appliance Mode ensures that the Transit Gateway maintains flow symmetry by sending both the request and response traffic through the same Availability Zone in the Security VPC. This is critical for stateful firewalls to correctly track connections and prevent packets from being dropped due to out-of-order or missing state information.
- ✓
Configure a default route (0.0.0.0/0) in the spoke VPC subnets pointing to the Transit Gateway.
Why this is correct
To centralize outbound traffic, spoke VPCs must be configured to send all non-local traffic to the Transit Gateway. By setting the default route to the TGW, any traffic destined for the internet is handed off to the central hub, where it can be redirected to the inspection firewall fleet.
- ✗
Disable 'Source/Destination Check' on all Transit Gateway attachments.
Why it's wrong here
Source/Destination Check is an EC2 instance-level setting, not a Transit Gateway attachment setting. While it must be disabled on the firewall instances themselves to allow them to process traffic not destined for their own IP, it is not a configuration option or requirement for the TGW attachments themselves.
- ✗
Use VPC Peering between all spoke VPCs and the Security VPC to bypass the Transit Gateway.
Why it's wrong here
VPC Peering does not support transitive routing, meaning traffic cannot pass through one VPC to get to another. To centralize inspection, a Transit Gateway or a complex mesh of peering is required. Using peering would defeat the purpose of a hub-and-spoke architecture and would not scale effectively.
- ✗
Create a separate NAT Gateway in every spoke VPC to handle the inspection traffic locally.
Why it's wrong here
Creating NAT Gateways in every spoke VPC would result in decentralized internet access, bypassing the central Security VPC's firewalls. The goal of this architecture is to consolidate egress points to a single location for better control, monitoring, and cost management of the third-party firewall licenses.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.