SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Set up AWS Direct Connect and route all traffic through the on-premises firewall.

  Why it's wrong here

  AWS Direct Connect establishes a dedicated network path between an on-premises data center and AWS, but forcing all inter-VPC traffic to hairpin through an on-premises firewall would introduce significant latency, create a single point of failure, and incur data transfer and Direct Connect port costs. It also fails to use the Transit Gateway's native routing and inspection capabilities, making this architecture unnecessarily complex and non-scalable for a multi-VPC environment.

• ✓

  Use Transit Gateway with appliance mode and route tables to direct traffic through a firewall appliance in a central VPC.

  Why this is correct

  Transit Gateway with appliance mode enables asymmetric routing support, allowing a gateway route table to forward traffic from source VPCs to the central inspection VPC, while the firewall appliance then routes return traffic back through the same appliance, ensuring both directions are inspected. By using separate route tables associated with each VPC attachment, you can force all inter-VPC and outbound traffic through the firewall appliance, which scales horizontally and keeps security inspection centralized.

• ✗

  Create VPC peering connections between each VPC and the firewall VPC.

  Why it's wrong here

  VPC peering creates a point-to-point network connection between exactly two VPCs, so connecting every VPC to the firewall VPC would require a full mesh of peering connections and does not allow transitive routing. Even with peering, there is no native mechanism to force all inter-VPC traffic through the firewall VPC unless you manually manipulate every route table, and even then, the firewall VPC becomes a transit point that can create routing loops and scalability issues. Peering also lacks centralized management and becomes unwieldy as VPC count grows.

• ✗

  Configure network ACLs in each VPC to block traffic unless it comes from the firewall.

  Why it's wrong here

  Network ACLs are stateless, rule-based filters applied at the subnet boundary and cannot be used to route traffic between VPCs or force traffic to pass through a firewall appliance. They evaluate only traffic entering or leaving a subnet based on source/destination IP, port, and protocol, and do not influence the path that packets take across the Transit Gateway or a peering connection. Blocking traffic unless it comes from the firewall would not prevent traffic from bypassing the firewall VPC entirely, and stateless rules would require separate inbound and outbound rules, making it operationally fragile.

Go deeper

Related to this question