SCS-C02 Infrastructure Security Practice Question
A security engineer needs to ensure that all traffic between two EC2 instances in different subnets is encrypted in transit. What is the most secure and efficient solution?
⚠ Common exam trap
A common mix-up: candidates confuse network-layer connectivity solutions (like VPC Peering or security groups) with encryption mechanisms, assuming that routing traffic through AWS's private network or allowing traffic via security groups inherently encrypts the data, when in fact neither provides encryption in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up an IPsec VPN between the instances
An IPsec VPN between the two EC2 instances provides end-to-end encryption of all traffic at the network layer, regardless of the application protocol. This ensures that data in transit between the instances is encrypted using IPsec (ESP/AH), which is the most secure and efficient solution for encrypting traffic between two specific instances in different subnets without relying on the underlying network infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure network ACLs to allow traffic
Why it's wrong here
Network ACLs are stateless, subnet-level packet filters that apply allow/deny rules based on source/destination IP addresses, ports, and protocols. They do not possess any encryption or decryption capability; their only role is to permit or block packets as they cross the subnet boundary. Even with a permissive NACL rule, traffic passes in plaintext, so this option fails to provide the required data-in-transit encryption.
- ✗
Use VPC Peering
Why it's wrong here
VPC peering establishes direct layer-3 connectivity between two VPCs over AWS's private backbone and routes traffic between them without traversing the internet. Peering does not negotiate an IPsec tunnel or apply per-packet encryption to the application payload, so the data remains readable at the IP layer. Thus it solves reachability but not an explicit requirement for encryption in transit.
- ✓
Set up an IPsec VPN between the instances
Why this is correct
An IPsec VPN creates an encrypted tunnel between the configured endpoints (here, the instances), typically using ESP in tunnel or transport mode to encrypt IP payloads and, when needed, the original IP header. It also provides mutual authentication, integrity checking, and anti-replay protection, ensuring all traffic between the instances is confidential and tamper-evident. This is the only option that actively encrypts the traffic itself.
- ✗
Configure security groups to allow traffic
Why it's wrong here
Security groups act as a stateful virtual firewall at the instance or elastic network interface level and evaluate traffic against inbound and outbound allow rules, with an implicit deny for non-matching traffic. They filter and track connections, but they contain no cryptographic functions, so they cannot encrypt or decrypt any packet content. Opening security group ports only permits traffic to flow; it does not protect the payload from being read in transit.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.