SCS-C03 Infrastructure Security Practice Question
An enterprise provides a financial data service to clients via AWS PrivateLink. The security architect must ensure that only authorized consumer VPCs can connect to the Interface VPC Endpoint and that all traffic flow metadata is captured for forensic auditing. Which combination of actions meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add authorized account ARNs to the Endpoint Service allowed principals and enable VPC Flow Logs on the endpoint's elastic network interfaces.
PrivateLink security is managed through a combination of service-level permissions and network-level monitoring. By adding specific AWS account ARNs to the endpoint service allowed principals list, you control which accounts can discover the service. Enabling VPC Flow Logs on the network interfaces associated with the endpoint provides the necessary metadata for auditing all connection attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a resource-based policy to the Interface Endpoint and enable VPC Flow Logs on the consumer VPC subnets.
Why it's wrong here
Resource-based policies on interface endpoints control which actions can be performed through the endpoint, but they do not manage the initial connection permissions at the service provider level. While consumer VPC Flow Logs are useful, the provider needs to capture logs on their own infrastructure to ensure forensic integrity.
- ✗
Configure the Endpoint Service to require manual acceptance of connection requests and enable CloudTrail logging for the VPC.
Why it's wrong here
Manual acceptance provides a gatekeeping mechanism but does not scale well for automated environments or high-volume client onboarding. CloudTrail logs management API calls, such as creating or deleting connections, but it does not capture the actual network traffic metadata or flow information required for detailed forensic auditing.
- ✓
Add authorized account ARNs to the Endpoint Service allowed principals and enable VPC Flow Logs on the endpoint's elastic network interfaces.
Why this is correct
Whitelisting specific principals ensures that only authorized AWS accounts can create a connection to the service. Enabling VPC Flow Logs specifically on the ENIs associated with the interface endpoint allows the security team to monitor and audit every packet flow, including source IPs and port numbers, for compliance.
- ✗
Use a Security Group on the Interface Endpoint to restrict traffic to the consumer VPC CIDR and enable S3 Server Access Logs.
Why it's wrong here
Security groups on interface endpoints are effective for controlling traffic, but you cannot easily reference CIDR blocks from external consumer VPCs that may overlap or change. S3 Server Access Logs are irrelevant in this context as they track access to S3 buckets, not network traffic through a PrivateLink interface.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 156 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.