SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Internet Gateway

  Why it's wrong here

  An Internet Gateway is a redundant VPC component that provides two-way connectivity between your VPC and the public internet, but it only works for instances that have public IP addresses and that live in subnets with a route pointing to the gateway. In a private subnet, instances typically have no public IP, so an Internet Gateway alone cannot be their default route; the subnet's route table would instead point to a NAT Gateway, which then uses the Internet Gateway to reach the internet. Thus, the Internet Gateway does not supply outbound-only access to private instances without an additional NAT device.

• ✗

  VPC Endpoint

  Why it's wrong here

  An interface or gateway VPC Endpoint provides private connectivity to a specific AWS service, such as S3, DynamoDB, or Lambda, using the AWS network instead of the public internet. Traffic destined for those services stays within the AWS backbone and does not traverse an Internet Gateway or NAT Gateway. A VPC Endpoint cannot be used as a general-purpose route to the internet, as it only resolves and forwards traffic to the particular service endpoints it is configured for, and it lacks the translation and routing capabilities needed for arbitrary external destinations.

• ✓

  NAT Gateway

  Why this is correct

  A NAT Gateway is a fully managed AWS service that enables instances in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound connections. It sits in a public subnet, uses an Elastic IP for source NAT, and forwards traffic through the Internet Gateway. Because it preserves the flow state, return traffic from the internet is translated back to the private instance, but no external host can directly initiate a session into the private subnet.

• ✗

  VPN Connection

  Why it's wrong here

  A Site-to-Site VPN Connection establishes an encrypted, IPsec tunnel between your VPC and a remote on-premises network, such as a corporate data center or branch office. It is designed for hybrid network extension, where private IP traffic traverses the tunnel to reach internal resources, not for generic outbound internet access. To get internet egress from a private subnet, you would still need a NAT device or a NAT gateway, because a VPN alone does not perform source translation or provide a default route to the public internet.

Go deeper

Related to this question