Courseiva
Infrastructure SecurityhardMultiple SelectObjective-mapped

SCS-C03 Infrastructure Security Practice Question

A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Amazon VPC security groups

Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • AWS Network Firewall

    Why it's wrong here

    AWS Network Firewall provides managed stateful network firewall and intrusion detection capabilities at the VPC boundary, rather than stateless inspection specifically at the subnet boundary combined with instance-level security groups.

  • Amazon VPC security groups

    Why this is correct

    Security groups operate as stateful virtual firewalls for EC2 instances and network interfaces, tracking the state of connections to automatically permit return traffic without requiring separate rules for outbound responses.

  • AWS Shield Advanced

    Why it's wrong here

    AWS Shield Advanced is a managed security service that safeguards applications against distributed denial of service attacks and does not act as a packet filtering mechanism for subnets or instances.

  • Amazon VPC Network ACLs

    Why this is correct

    Network ACLs act as a stateless layer of security at the subnet boundary, requiring separate rules for inbound traffic and outbound return traffic to control packet flows into and out of subnets.

  • Amazon Route 53 Resolver DNS Firewall

    Why it's wrong here

    DNS Firewall filters and monitors outbound DNS queries made from resources within a VPC, protecting against domain generation algorithms and data exfiltration over DNS, but it is not a general network packet filtering feature.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint

This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.