SCS-C02 Infrastructure Security Practice Question
A company uses an AWS Transit Gateway to connect multiple VPCs and on-premises networks. A security engineer needs to ensure that traffic between VPCs is inspected by a third-party firewall appliance. Which architecture should be used?
⚠ Common exam trap
Many exam-takers confuse transit gateway capabilities with VPC-level constructs like security groups or network ACLs, assuming they can be applied directly to the transit gateway, when in fact transit gateway traffic inspection requires a separate inspection VPC architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the firewall appliance to a dedicated inspection VPC and route traffic from other VPCs through the inspection VPC using transit gateway route tables.
It uses a dedicated inspection VPC as a central point for traffic inspection. By attaching the third-party firewall appliance to this inspection VPC and manipulating transit gateway route tables, you can force all inter-VPC traffic to be routed through the firewall for inspection. This architecture leverages the transit gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without modifying individual VPC routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure security groups on the transit gateway to inspect traffic.
Why it's wrong here
Security groups are stateful virtual firewalls that attach to Elastic Network Interfaces (ENIs) of EC2 instances, not to transit gateways. A transit gateway is a regional router operating at Layer 3, and it exposes route tables and attachments for VPCs and VPNs — it has no concept of security group membership. Therefore, attempting to configure security groups on the transit gateway itself is invalid; traffic inspection must be delegated to an explicit appliance or VPC-based filtering.
- ✗
Create VPC endpoints for each VPC to route traffic through the firewall.
Why it's wrong here
VPC endpoints (gateway endpoints for S3/DynamoDB or interface endpoints via PrivateLink) provide private connectivity to supported AWS services or your own services, they do not act as inline routing or inspection points for inter-VPC traffic. Creating one per VPC would only enable service access, not redirect East-West traffic through a firewall appliance, and VPC endpoints cannot be placed in the path of transitive traffic. This approach fails because the endpoint is a destination-based access mechanism, not a routing or security control.
- ✓
Attach the firewall appliance to a dedicated inspection VPC and route traffic from other VPCs through the inspection VPC using transit gateway route tables.
Why this is correct
This is the standard centralized inspection architecture: deploy the firewall appliance in a dedicated inspection VPC and attach that VPC to the transit gateway, then use separate transit gateway route tables to force all traffic from spoke VPCs to route to the inspection VPC before it proceeds to other attachments. The inspection VPC must also have route tables that forward traffic back to the transit gateway toward the final destination, enabling asymmetric return-path handling and stateful inspection. This design works because the transit gateway routes based on its route tables, so the firewall becomes an inline bump-in-the-wire for all inter-VPC traffic while maintaining a single control point.
- ✗
Use network ACLs on the transit gateway to filter traffic.
Why it's wrong here
Network ACLs are stateless rule sets applied at the subnet boundary of a VPC, not to routing constructs like a transit gateway. A transit gateway attachment corresponds to a VPC or on-premises connection, but there is no subnet-level association where a NACL could be applied to filter traffic passing between attachments. Thus, using NACLs on the transit gateway is impossible; subnet-level ACLs within the inspection or spoke VPCs would be the only adjacent application, and they cannot inspect traffic once it has left the subnet.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.