SCS-C02 Infrastructure Security Practice Question

A company has a VPC with multiple subnets across multiple Availability Zones. The security team wants to inspect all traffic between subnets for malicious activity. Which AWS service should be used?

⚠ Common exam trap

Test-takers frequently confuse VPC Flow Logs (a logging service) with a security inspection service, or assume security groups can inspect traffic content, when in fact only AWS Network Firewall provides the required deep packet inspection for inter-subnet traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Network Firewall

AWS Network Firewall is a managed stateful firewall service that can inspect all traffic between subnets within a VPC, including east-west traffic, for malicious activity. It provides deep packet inspection (DPI) at Layers 3–7, supporting Suricata-compatible rules to detect and block threats like malware or intrusion attempts. This makes it the correct choice for the security team's requirement to inspect inter-subnet traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture metadata about IP traffic reaching and leaving network interfaces in the VPC — source/destination IP, ports, protocol, and whether the action was accepted or rejected. However, they are a passive telemetry and compliance tool: they neither modify nor stop traffic, and they perform zero deep packet inspection or signature-based threat detection. Even if you aggregate logs in CloudWatch Logs or Athena, Flow Logs will never block malicious traffic or inspect payload contents.
✓
AWS Network Firewall
Why this is correct
AWS Network Firewall is the correct choice because it is a managed, stateful firewall that can inspect all traffic crossing subnet boundaries within the VPC, including traffic routed between application tiers or from a transit gateway. It combines stateless rule groups with stateful inspection engines (Suricata-compatible) to detect and block malicious payloads, protocol anomalies, and known threat signatures at wire speed. By forcing traffic through firewall endpoints in each Availability Zone and using route tables, you can enforce intrusion prevention and traffic filtering across the VPC, which aligns directly with the requirement for network-level threat detection and blocking.
✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that protects only HTTP/HTTPS endpoints, typically deployed in front of Application Load Balancers, Amazon CloudFront, or API Gateway. It evaluates web requests at the application layer (L7), not raw IP packets, so it cannot inspect or block non-HTTP-based network traffic between subnets such as database, RPC, or custom TCP/UDP flows. Since the requirement is about traffic between VPC subnets (which may include all protocols), WAF alone is insufficient and does not address the underlying network packet flow.
✗
Security groups
Why it's wrong here
Security groups act as a virtual stateful firewall at the instance or ENI level, filtering traffic based on allow rules for ports, protocols, and source/destination CIDRs. They do not perform any stateful intrusion prevention, deep packet inspection, or content inspection — they only evaluate packet headers and connection state. Therefore, while security groups are an important perimeter control, they cannot detect and block malicious content hidden inside allowed traffic, which is exactly the requirement in this scenario.

Visual reference

Go deeper

SCS-C02 Infrastructure Security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question