SCS-C03 Infrastructure Security Practice Question
A security engineer must protect a multi-tier web application hosted in Amazon EC2 instances inside a private subnet. The application requires outbound internet access to download software updates, but malicious actors must never be able to initiate inbound connections to the instances. Which architecture satisfies these requirements securely?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provision a NAT Gateway in a public subnet, and configure the private subnet route table to direct 0.0.0.0/0 traffic to that NAT Gateway.
Routing outbound traffic through a NAT Gateway ensures that instances can initiate communication with external endpoints while remaining entirely unreachable from the outside. NAT Gateways do not support inbound traffic initiation, providing a robust boundary. This design prevents direct exposure of private workloads, aligning with defense-in-depth principles for infrastructure security in AWS environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Elastic IP directly to each EC2 instance and remove the default route pointing to the internet gateway in the route table.
Why it's wrong here
Attaching public IP addresses directly to internal instances exposes them to the public internet, violating the core requirement that malicious actors must never be able to initiate inbound connections, even if network ACLs attempt to block the traffic.
- ✗
Deploy an Internet Gateway in the private subnet and associate it with the route table used by the application instances.
Why it's wrong here
Internet Gateways provide bi-directional communication and require instances to have public IP addresses to route traffic properly. Placing an Internet Gateway in a private subnet and routing traffic through it compromises the network isolation boundaries.
- ✓
Provision a NAT Gateway in a public subnet, and configure the private subnet route table to direct 0.0.0.0/0 traffic to that NAT Gateway.
Why this is correct
NAT Gateways allow private instances to send outbound requests to the internet for updates while blocking all unsolicited inbound connection attempts. This architecture maintains strict workload isolation while fulfilling operational update prerequisites safely.
- ✗
Configure a VPC endpoint for every external repository and remove all internet route entries from the VPC route tables entirely.
Why it's wrong here
VPC endpoints support AWS services and specific partner services via AWS PrivateLink, but generic external software repositories on the public internet cannot be reached via standard interface or gateway endpoints without a NAT mechanism.
Visual reference
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.