SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use Transit Gateway with appliance mode enabled on the attachments to the inspection VPC, and route inter-VPC traffic through the inspection VPC.

  Why this is correct

  Transit Gateway appliance mode on the attachments to the inspection VPC is the correct approach because it enables the Transit Gateway to forward packets to the network appliance even when return traffic would enter through a different attachment or follow a different path. This is critical for stateful appliances that must inspect both directions of a connection. Inter-VPC traffic is routed via TGW route tables to the inspection VPC attachment, and the appliance's ENI is the next hop inside that VPC. Without appliance mode, asymmetric routing could cause the appliance or the Transit Gateway to drop packets.

• ✗

  Use VPC Peering connections between all VPCs and route traffic through the inspection VPC.

  Why it's wrong here

  VPC peering does not support transitive routing, so creating peering connections between all VPCs and the inspection VPC would not allow the inspection VPC to forward traffic from one peered VPC to another. To route traffic through the inspection VPC, each VPC would need to peer with the inspection VPC, but the inspection VPC cannot use a peering connection as a next hop for traffic destined to a different VPC because such traffic does not have the inspection VPC as the source or destination. A full mesh of VPC peering connections among all VPCs is possible but does not force traffic through the inspection appliance, so it fails to meet the inspection requirement.

• ✗

  Place the network appliance in a public subnet of the inspection VPC and use internet gateways for routing.

  Why it's wrong here

  Placing the network appliance in a public subnet and using internet gateways for routing is insecure and fundamentally incorrect for inter-VPC traffic. An internet gateway only handles traffic destined to or from the internet; it cannot be used to route traffic between VPCs within a private network. Even if the appliance were in a public subnet, traffic would need to leave the AWS network and re-enter, exposing sensitive data to the public internet and increasing latency, which violates the requirement to keep traffic private and inspected securely.

• ✗

  Use Transit Gateway with route tables that point to the network appliance's ENI for all inter-VPC traffic.

  Why it's wrong here

  Transit Gateway route tables cannot point directly to a network appliance's Elastic Network Interface (ENI); TGW routes only target TGW attachments such as VPCs, VPNs, or Direct Connect. To direct traffic to an appliance, you must route the TGW to the inspection VPC attachment, and then within the inspection VPC's subnet route table specify the appliance ENI as the next hop. Additionally, simply pointing the TGW route tables to the inspection VPC is insufficient without enabling appliance mode, because asymmetric return paths would be discarded. Thus, this option conflates TGW route targets with VPC-level next hops and omits the necessary appliance mode.

Go deeper

Related to this question