SCS-C02 Infrastructure Security Practice Question

A company has deployed a multi-tier web application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The security team wants to ensure that the application servers cannot initiate outbound connections to the internet. What should the team do?

⚠ Common exam trap

Many candidates confuse security group rules or network ACLs with routing decisions, mistakenly believing that blocking outbound traffic at the firewall level is sufficient, when in fact AWS routes traffic before applying security group or ACL rules, so without a route, no traffic can leave the subnet regardless of allow rules.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.

Removing the default route (0.0.0.0/0) from the private subnet's route table ensures that any traffic destined for the internet has no valid path, effectively preventing application servers from initiating outbound internet connections. Network ACLs and security groups are stateful or stateless filters but do not control routing; without a route, packets cannot leave the subnet regardless of allow rules. This aligns with the principle of using route tables to enforce network segmentation in a multi-tier architecture.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add a deny rule for all outbound traffic in the network ACL of the private subnet.
Why it's wrong here
Network ACLs are stateless, so every outbound packet must be explicitly allowed by a rule. Adding a deny rule for all outbound traffic would also block the response traffic required for legitimate inbound requests, breaking the application's ability to reply to clients. Furthermore, network ACL rules apply to the entire subnet, so this action would affect all instances and is not a targeted or effective way to restrict outbound internet access.
✗
Modify the security group of the application servers to deny all outbound traffic.
Why it's wrong here
Security groups are stateful and support only allow rules, not deny rules. Even if you removed all outbound allow rules from the application servers' security group, return traffic for already-allowed inbound connections would still flow automatically because of statefulness. New outbound connections would be blocked, but the intended goal of preventing all outbound internet traffic is not achieved, and you cannot explicitly deny outbound as proposed.
✓
Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.
Why this is correct
Removing the default route (0.0.0.0/0) to an internet gateway or NAT gateway from the private subnet's route table eliminates the only path for outbound traffic to reach the internet. Route tables govern where traffic is sent from the subnet; without a default route, any packet destined outside the VPC has no route and is dropped. This does not affect inbound traffic, which is controlled by security groups and network ACLs, making it a precise and effective solution.
✗
Attach an egress-only internet gateway to the private subnet.
Why it's wrong here
An egress-only internet gateway is a VPC-level resource designed exclusively for IPv6 traffic. It cannot be attached to a subnet, and it does nothing to block IPv4 outbound traffic; in fact, it would enable outbound IPv6 connectivity if routes were added. The scenario requires blocking outbound internet access for the application servers, which are presumably using IPv4, so this action is irrelevant and incorrect.

Visual reference

Go deeper

SCS-C02 Infrastructure Security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question