SCS-C03 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deploy a NAT Gateway in a public subnet to allow outbound traffic for patching.

  Why it's wrong here

  A NAT Gateway allows instances to access the internet. While this enables patching, it increases the attack surface by allowing outbound communication to any destination on the internet. Security best practices favor the use of VPC endpoints to keep all traffic within the AWS backbone, avoiding public internet connectivity entirely.

• ✓

  Use Systems Manager with VPC endpoints to manage instances in a private subnet.

  Why this is correct

  VPC endpoints for Systems Manager allow private communication between your EC2 instances and the SSM service. This eliminates the need for an IGW or NAT Gateway, keeping instance traffic entirely off the public internet. This architecture perfectly satisfies the requirement for security and patch management in a restricted network environment.

• ✗

  Enable public IP addresses on instances and use Security Groups to restrict outbound traffic.

  Why it's wrong here

  Assigning public IPs to instances is a security anti-pattern if internet access is not strictly required. It exposes the instances to potential threats from the public internet. Furthermore, managing outbound traffic via security groups is difficult to scale and maintain compared to utilizing private, service-specific VPC endpoints for internal communication.

• ✗

  Manually download patches to an S3 bucket and have instances pull them locally.

  Why it's wrong here

  Manual patching processes are prone to human error and do not scale well. They also require complex configuration of S3 bucket policies and private access. AWS Systems Manager provides an automated, scalable, and secure framework for patching that integrates directly with AWS services, making it the superior choice for enterprise infrastructure.