SCS-C02 Infrastructure Security Practice Question
A security engineer is configuring a new VPC with public and private subnets. The application servers in the private subnet need to download patches from the internet. Which component is required?
⚠ Common exam trap
Test-takers frequently confuse a NAT gateway with an Internet Gateway, mistakenly thinking an Internet Gateway can be attached directly to a private subnet, but an Internet Gateway only works with resources that have public IP addresses, whereas a NAT gateway enables outbound internet access for private instances without public IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NAT gateway
A NAT gateway is required to allow instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing the internet from initiating inbound connections to those instances. The NAT gateway resides in a public subnet with an attached Internet Gateway, and it translates the private IP addresses of the application servers to the NAT gateway's Elastic IP address for outbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC endpoint
Why it's wrong here
A VPC endpoint (via AWS PrivateLink) provides private, highly available connectivity from your VPC to specific AWS services such as S3, DynamoDB, or API Gateway without traversing the public internet. It does not, however, provide a general-purpose path for outbound internet access or access to non-AWS endpoints. Private subnet instances needing to reach arbitrary public destinations still require a NAT gateway or alternative routing, making the endpoint incorrect for the scenario.
- ✗
Direct Connect
Why it's wrong here
AWS Direct Connect establishes a dedicated, low-latency network link between your on-premises data center and AWS, typically using a cross-connect at a hosted exchange. While it can carry traffic to private VPCs through private virtual interfaces, it does not inherently enable outbound internet access from private subnets to the general internet. To use it for internet egress you would need to route via a public virtual interface and an internet gateway, but that is not the standard solution for private subnet outbound connectivity, and it adds cost and complexity.
- ✗
Internet gateway
Why it's wrong here
An internet gateway is a horizontally scaled, redundant VPC component that allows bidirectional communication between a VPC and the internet, but it requires instances to have public IP addresses and be in a subnet with a route table entry pointing to the gateway. Instances in a private subnet, by definition, have no public IP and are not directly reachable from the internet. Pointing a private subnet route at an internet gateway is invalid; outbound traffic from those instances must instead traverse a NAT gateway or NAT instance in a public subnet.
- ✓
NAT gateway
Why this is correct
A NAT gateway is a managed AWS service that enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates or API calls) while preventing unsolicited inbound connections. It is deployed in a public subnet with an Elastic IP address, and the private subnet's route table sends non-local traffic to the NAT gateway's network interface. This exactly matches the requirement to provide outbound internet access for private subnet instances without exposing them to inbound traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.