SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway

  Why this is correct

  The NAT Gateway is deployed in a public subnet with an Elastic IP and performs source network address translation for instances in private subnets. Outbound packets are sent to the NAT Gateway via the 0.0.0.0/0 route, and return traffic is delivered back through the same stateful translation. Because private instances lack public IPs and the route table points to the NAT Gateway rather than an internet gateway, unsolicited inbound connections cannot reach them, making this the standard design for outbound-only internet access.

• ✗

  Create a VPC endpoint for Amazon S3 and route traffic through it

  Why it's wrong here

  A VPC endpoint for Amazon S3 is a Gateway or Interface endpoint that provides private connectivity to the S3 service only, bypassing the internet entirely. It does not handle general internet traffic, and routing 0.0.0.0/0 to such an endpoint is invalid because the endpoint is tied to a specific service prefix. Even if an S3 endpoint existed, instances would still need a separate path (via NAT or internet gateway) for any other internet-bound traffic, so this option is incomplete and incorrect for the stated requirement.

• ✗

  Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

  Why it's wrong here

  Attaching an internet gateway to a subnet and adding a 0.0.0.0/0 route to the internet gateway makes that subnet effectively public, because the internet gateway enables bidirectional communication between the VPC and the internet for any instance with a public IP. A private subnet is defined precisely by the absence of an internet gateway route; adding one would allow unsolicited inbound traffic and defeat the subnet's isolation, so this is the opposite of the intended design.

• ✗

  Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

  Why it's wrong here

  A bastion host is designed as a managed jump host for inbound administrative sessions (such as SSH or RDP) from the internet to instances in private subnets, not for outbound internet traffic. To use it as a NAT device, you would need to enable IP forwarding and configure iptables or a similar software NAT, creating a single point of failure and a security risk. The AWS-recommended managed alternative is a NAT Gateway, which is highly available, scales automatically, and does not require instance maintenance.

Go deeper

Related to this question