SCS-C02 Infrastructure Security Practice Question
A company is designing a network architecture for a critical application that must meet strict compliance requirements. The application consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The instances need to access an Amazon RDS database in a different VPC. The company wants to minimize exposure to the internet. Which solution should the company use?
⚠ Common exam trap
It's easy for candidates to confuse VPC Peering with site-to-site VPN, thinking VPN is required for cross-VPC connectivity, but VPC Peering is the correct AWS-native solution for private VPC-to-VPC communication without internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a VPC Peering connection between the two VPCs.
VPC Peering establishes a private, direct network connection between two VPCs using AWS's internal infrastructure, with no exposure to the internet. Traffic stays within the AWS global network, meeting strict compliance requirements for minimizing internet exposure. This allows EC2 instances in the application VPC to communicate with the RDS database in the database VPC securely and with low latency, using private IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a site-to-site VPN connection between the VPCs.
Why it's wrong here
A site-to-site VPN connection is designed for establishing secure, encrypted connectivity between an AWS VPC and an on-premises network, or another external network. It fails this scenario because connecting two AWS VPCs directly does not require traversing external networks; AWS offers native services like VPC Peering or Transit Gateway for internal VPC-to-VPC communication. This option is tempting as VPNs provide secure private connectivity, crucial for compliance, but it is specifically for hybrid cloud or external network integration, not intra-AWS VPC communication.
- ✗
Use a NAT gateway in the database VPC and route traffic through it.
Why it's wrong here
A NAT gateway enables outbound-originated IPv4 traffic from a private subnet to reach the internet and only automatically forwards associated return traffic; it cannot act as a bidirectional interconnection point between VPCs. Routing database traffic through it would not establish a usable route from the application VPC to the database VPC because NAT gateways do not accept unsolicited inbound connections or relay traffic from another VPC into a private subnet. This option is designed strictly for internet egress, not private inter-VPC connectivity.
- ✓
Use a VPC Peering connection between the two VPCs.
Why this is correct
A VPC peering connection privately connects two VPCs using AWS's internal backbone, with no traffic traversing the public internet and no need for a public IP address, VPN appliance, or gateway. It creates direct layer-3 route table entries between the VPC CIDRs, and because the relationship is native to AWS, traffic stays isolated from external carriers. For a single application-to-database pair with non-overlapping CIDRs, VPC peering is the simplest and most cost-effective way to establish low-latency private connectivity.
- ✗
Use an internet gateway and route traffic over the internet with security groups.
Why it's wrong here
An internet gateway enables bidirectional communication between a VPC and the public internet, so using it here would force application-to-database traffic onto an external internet path. Even if restrictive security groups are applied, security groups are stateful virtual firewalls that only control traffic at the resource level; they do not protect traffic in transit or prevent public routing exposure once the IGW is in the route path. This approach violates the requirement to minimize exposure and creates an unnecessarily high attack surface for a critical database.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.