SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create VPC peering connections between each VPC and the shared services VPC.

  Why it's wrong here

  VPC peering connections create direct, non-transitive links between VPCs; they do not provide a hub that can inspect inter-VPC traffic. Even if every VPC is peered with the shared services VPC, the traffic between two spoke VPCs would need to traverse the shared services VPC without any routing mechanism to force it through a firewall, and VPC peering does not support transitive routing through an intermediate VPC.

• ✓

  Configure transit gateway route tables to route all inter-VPC traffic through the firewall appliance.

  Why this is correct

  A transit gateway with carefully designed route tables is the standard way to enforce centralized inspection: attach all VPCs to the transit gateway, then configure a route in each spoke VPC's propagation that sends inter-VPC destination CIDRs to the firewall appliance's elastic network interface in the shared services VPC. The firewall inspects and forwards the traffic back to the transit gateway, which delivers it to the destination VPC. This enables deterministic, high-availability routing through the security appliance.

• ✗

  Use security groups to route traffic through the firewall.

  Why it's wrong here

  Security groups are stateful, host-level firewalls that filter traffic at the elastic network interface based on allow rules; they cannot act as routers or be used as a route table target. Routing inter-VPC traffic through a firewall appliance requires a layer-3 forwarding device or a gateway such as a transit gateway route or a GWLB endpoint. Security groups can only permit or deny traffic to and from an instance, not forward packets between VPCs.

• ✗

  Deploy a Gateway Load Balancer (GWLB) in the shared services VPC and register the firewall as a target.

  Why it's wrong here

  A Gateway Load Balancer (GWLB) is used to distribute traffic to a pool of firewall appliances, providing scale and high availability, but it does not automatically intercept all inter-VPC traffic. To enforce inspection, you must route traffic to the GWLB endpoint via route table entries—for example, in the transit gateway route tables or in the VPC route tables. Without those routes, traffic between VPCs uses the normal transit gateway path and bypasses the firewall entirely; GWLB by itself is just a target, not a routing mechanism.

Go deeper

Related to this question