SCS-C03 Infrastructure Security Practice Question
A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon VPC security groups
Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Network Firewall
Why it's wrong here
AWS Network Firewall provides managed stateful network firewall and intrusion detection capabilities at the VPC boundary, rather than stateless inspection specifically at the subnet boundary combined with instance-level security groups.
- ✓
Amazon VPC security groups
Why this is correct
Security groups operate as stateful virtual firewalls for EC2 instances and network interfaces, tracking the state of connections to automatically permit return traffic without requiring separate rules for outbound responses.
- ✗
AWS Shield Advanced
Why it's wrong here
AWS Shield Advanced is a managed security service that safeguards applications against distributed denial of service attacks and does not act as a packet filtering mechanism for subnets or instances.
- ✓
Amazon VPC Network ACLs
Why this is correct
Network ACLs act as a stateless layer of security at the subnet boundary, requiring separate rules for inbound traffic and outbound return traffic to control packet flows into and out of subnets.
- ✗
Amazon Route 53 Resolver DNS Firewall
Why it's wrong here
DNS Firewall filters and monitors outbound DNS queries made from resources within a VPC, protecting against domain generation algorithms and data exfiltration over DNS, but it is not a general network packet filtering feature.
Visual reference
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.