SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a VPC Endpoint for each AWS service.

  Why it's wrong here

  VPC endpoints provide private connectivity only to AWS services (such as S3 or DynamoDB) from within the VPC, not to an on-premises data center. They do not alter the VPC route tables for traffic destined to on-premises CIDR blocks, nor do they involve a Virtual Private Gateway or Direct Connect. Therefore, they cannot force any hybrid traffic to traverse Direct Connect, so this option is incorrect.

• ✗

  Set up a VPN connection over the internet as a backup.

  Why it's wrong here

  A VPN over the internet still uses the public internet as the underlying transport, and merely adding it as a backup does not prevent the VPC from sending traffic directly over the internet via an internet gateway. Without route table entries that force all on-premises-bound traffic through the VPN tunnel (or through Direct Connect when available), normal traffic can still egress over the public path. Even if the VPN is preferred, it is not the same as Direct Connect and does not guarantee that internet routing is disabled.

• ✓

  Attach a Virtual Private Gateway to the VPC and update the route tables to point to the Direct Connect virtual interface.

  Why this is correct

  Forcing traffic through Direct Connect requires a Virtual Private Gateway (VGW) attached to the VPC and a private virtual interface (VIF) connecting the Direct Connect connection to that VGW. Once the VGW is attached, you update each subnet's route table with a static route pointing to the on-premises CIDR via the VGW, and you must also enable route propagation from the VGW so that routes are advertised. This ensures that any packet bound for the on-premises network is sent to the VGW and then over the Direct Connect private VIF, bypassing the internet entirely.

• ✗

  Configure the Direct Connect connection and assign public IPs to instances.

  Why it's wrong here

  Assigning public IP addresses to instances actually encourages traffic to use the internet, because instances with public IPs can reach the internet through an internet gateway, and sources on the internet can route back to them over the public path. Direct Connect private virtual interfaces operate at the private IP layer and require a Virtual Private Gateway and route table entries; addresses must be private and non-overlapping with the VPC CIDR. This option does not establish a private path, does not change routing, and could actively cause traffic to traverse the internet, so it is incorrect.

Go deeper

Related to this question