SCS-C03 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Stateless rule group with 5-tuple filtering.

  Why it's wrong here

  Stateless rule groups only look at individual packets and use 5-tuple information (source/destination IP, source/destination port, and protocol). They cannot maintain state across multiple packets or inspect the application-layer payload, such as HTTP headers, making them incapable of performing domain-based filtering or deep packet inspection.

• ✓

  Stateful rule group with domain list filtering.

  Why this is correct

  Stateful rule groups can be configured with domain lists, which use the Suricata engine to inspect the SNI in TLS handshakes or the Host header in HTTP requests. This allows the firewall to block or allow traffic based on fully qualified domain names (FQDNs) rather than just static IP addresses.

• ✗

  AWS WAF with a web ACL associated with the VPC.

  Why it's wrong here

  AWS WAF is designed to protect Application Load Balancers, CloudFront distributions, and API Gateways, but it cannot be directly associated with a VPC to filter all outbound traffic. Network Firewall is the appropriate service for VPC-level network traffic filtering across all subnets and non-HTTP protocols.

• ✗

  VPC Endpoint Policy associated with an S3 gateway.

  Why it's wrong here

  VPC Endpoint Policies control access to specific AWS services from within a VPC, but they do not provide general-purpose traffic filtering for external internet domains. They are used to restrict which buckets or actions can be performed via the endpoint, not to inspect or block arbitrary HTTP traffic headers.