SCS-C03 Infrastructure Security Practice Question
A company requires all outbound internet traffic from its VPC to be inspected by a fleet of third-party firewall appliances. The solution must scale horizontally and ensure that traffic is symmetric, meaning requests and responses pass through the same firewall instance. Which architecture should the security engineer implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a Gateway Load Balancer and create a GWLB endpoint in the traffic-originating subnets.
Gateway Load Balancer (GWLB) is designed for deploying, scaling, and managing third-party virtual appliances. It uses the GENEVE protocol to wrap packets and maintain flow affinity, ensuring that both directions of a traffic flow are handled by the same appliance, which is critical for stateful inspection and security monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy the firewalls behind an Application Load Balancer and use host-based routing.
Why it's wrong here
Application Load Balancers operate at Layer 7 and are designed for HTTP/HTTPS traffic. They do not support the transparent inspection of all outbound traffic (including non-HTTP protocols) and cannot easily be used to intercept and forward raw IP packets to a firewall fleet while maintaining the original packet headers.
- ✓
Deploy a Gateway Load Balancer and create a GWLB endpoint in the traffic-originating subnets.
Why this is correct
A Gateway Load Balancer simplifies the insertion of security appliances into the network path. By using GWLB endpoints and updating VPC route tables, traffic is transparently routed to the firewall fleet. The GWLB ensures high availability and flow consistency, which is essential for stateful firewalls to function correctly.
- ✗
Use a Transit Gateway with VPC Peering and ECMP enabled for load balancing.
Why it's wrong here
While Transit Gateway can route traffic to a central security VPC, ECMP (Equal-Cost Multi-Path) alone does not guarantee flow symmetry for stateful appliances across different VPCs without additional complex configuration. GWLB is the purpose-built AWS service specifically designed to solve the flow symmetry and appliance scaling problem.
- ✗
Set up a Network Load Balancer with Proxy Protocol enabled for the firewall instances.
Why it's wrong here
A Network Load Balancer can handle high volumes of traffic, but it requires the target appliances to be configured as standard proxies or targets. It does not provide the transparent 'bump-in-the-wire' capability that a Gateway Load Balancer offers, making it difficult to inspect all outbound traffic without modifying client configurations.
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.