SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A single NAT gateway in a public subnet, and a default route (0.0.0.0/0) in each private subnet route table pointing to that NAT gateway.

  Why this is correct

  A NAT gateway must reside in a public subnet with an internet gateway as the next-hop for 0.0.0.0/0 so it can perform source NAT for outbound traffic. Placing a single NAT gateway there and adding a 0.0.0.0/0 route in every private subnet route table pointing to that gateway ID centralizes internet egress while keeping instances private. This is the standard minimal design, though it is a single point of failure if that availability zone goes down.

• ✗

  A single NAT gateway in a private subnet, and a default route in each private subnet pointing to the NAT gateway.

  Why it's wrong here

  NAT gateways are an AWS-managed service with an elastic network interface in the subnet where they are created; they cannot work unless that subnet is public and has a route to an internet gateway. If a NAT gateway is placed in a private subnet, it has no internet path, so even if private route tables point to it, outbound traffic will fail at the NAT stage. Additionally, a private subnet's default route pointing to a gateway inside the same subnet creates a routing dependency that cannot satisfy the gateway's need for an internet gateway.

• ✗

  One NAT gateway per private subnet, each with a route to an internet gateway.

  Why it's wrong here

  This configuration mistakenly treats NAT gateways as subnet-specific appliances and claims they need a route to an internet gateway. NAT gateways do not have individual route tables; instead, the route to the internet gateway must be in the route table of the public subnet where the NAT gateway is launched. Creating one NAT gateway per private subnet is wasteful, does not improve availability or performance, and makes egress management fragmented rather than centralized.

• ✗

  One NAT gateway per Availability Zone, with routes to the internet gateway.

  Why it's wrong here

  While one NAT gateway per Availability Zone is an AWS-recommended HA pattern, it is not the answer here because the question asks for centralized egress management; using multiple NAT gateways creates multiple independent egress points that require per-AZ route table entries and can produce asymmetric routing. Also, a NAT gateway cannot have a direct route to an internet gateway; that route belongs to the public subnet where the NAT gateway lives. The extra gateways increase cost and make inspecting egress traffic with central security controls more difficult.

Go deeper

Related to this question