SCS-C02 VPC Endpoint Practice Question
A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?
⚠ Common exam trap
Candidates may assume that AWS Systems Manager Patch Manager can download patches from any external domain via VPC endpoints, but SSM endpoints only provide private access to AWS services, not arbitrary external domains. The correct approach is to store patches in an AWS service like S3 and use a VPC endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.
It uses VPC endpoints for Amazon S3 (and optionally DynamoDB) to provide private connectivity to AWS services without requiring an internet gateway. By storing the security patches in an S3 bucket with a custom domain alias (e.g., patches.example.com), the application can download patches through the VPC endpoint, meeting the requirement of no internet route and minimizing operational overhead. Options A and D require an internet gateway, which creates a route to the internet. Option C does not provide access to an external domain like patches.example.com.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch a proxy server in a public subnet and configure the application to use the proxy.
Why it's wrong here
Deploying a proxy server in a public subnet necessitates an internet gateway to allow the proxy to fetch patches from the internet, so the VPC would have an IGW and an associated 0.0.0.0/0 route in the public subnet's route table. Even if the application is configured to send traffic through the proxy, the proxy's own upstream connectivity depends on that internet route, violating the design constraint. This approach introduces an internet dependency and is therefore incorrect.
- ✓
Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.
Why this is correct
A VPC endpoint for Amazon S3 (a gateway endpoint) allows resources in private subnets to access S3 using private IP addresses with traffic staying entirely within the AWS network, without any internet gateway, NAT device, or VPN connection. Since patches are stored in S3 buckets, the application can retrieve patch files directly over the endpoint, and an endpoint for DynamoDB can handle patch metadata or state tables. This satisfies the no-internet-route requirement while enabling secure patch downloads.
- ✗
Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.
Why it's wrong here
A VPC interface endpoint for AWS Systems Manager only enables private connectivity from your VPC to the Systems Manager API and does not provide access to external patch repositories or domains. Patch Manager orchestrates patching by instructing instances to download content from sources like Windows Update or Linux package repositories, which require internet egress unless you mirror them inside your VPC. Thus, this option would not allow the application to download patches from the specified external domain and is insufficient.
- ✗
Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.
Why it's wrong here
A NAT gateway must reside in a public subnet, and for it to function the VPC must be attached to an internet gateway (IGW) with a default route (0.0.0.0/0) pointing to that IGW. Adding a route from the private subnet to the NAT gateway makes the NAT gateway the next hop, but the NAT gateway itself still uses the IGW to reach the internet, which directly violates the requirement that the VPC have no route to the internet. This design does not provide a private, internet-free path to download patches.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.