SCS-C02 Infrastructure Security Practice Question
A security engineer notices that an EC2 instance in a private subnet is able to make outbound connections to the internet. The instance does not have a public IP, and there is no NAT gateway or instance in the VPC. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume a private subnet inherently blocks internet access, but the question tests whether they understand that a subnet's route table—not its public/private designation—determines outbound connectivity, and a 0.0.0.0/0 route to an IGW makes it a public subnet regardless of the instance's IP assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC has an egress-only internet gateway for IPv6 traffic.
An egress-only internet gateway (EIGW) allows outbound IPv6 traffic from instances in a private subnet without requiring a public IPv4 address or NAT. Since the instance is making outbound connections to the internet and has no public IP or NAT, and the VPC likely has IPv6 enabled, the EIGW is the most plausible cause. Option D is incorrect because a default route to an internet gateway requires the instance to have a public IPv4 address for return traffic, which contradicts the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VPC has an egress-only internet gateway for IPv6 traffic.
Why this is correct
An egress-only internet gateway (EIGW) is an IPv6-specific VPC component that enables instances with IPv6 addresses to initiate outbound connectivity to the internet, but it blocks all inbound connections from the internet. Because an EIGW is completely independent of IPv4 addressing, an instance can reside in a private subnet without a public IPv4 address and still reach the internet via a route table entry for ::/0 pointing to the EIGW. In this scenario, the observed internet access is therefore consistent with the VPC having an egress-only internet gateway for IPv6 traffic.
- ✗
The instance has a public IP assigned automatically via Auto-assign Public IP.
Why it's wrong here
The Auto-assign Public IP attribute can be enabled at the subnet level or overridden at launch time, and when enabled it automatically allocates a public IPv4 address to interfaces in that subnet. However, the question explicitly states that the instance has no public IP, so this option cannot explain the traffic; additionally, even if a public IP were present, outbound internet access would still require a default route to an internet gateway or a NAT device. The premise rules out this mechanism entirely.
- ✗
The instance is using a VPC endpoint (Gateway type) for S3.
Why it's wrong here
A Gateway-type VPC endpoint for S3 creates a prefix list entry in the subnet's route table so that traffic destined for S3's public IP ranges is routed privately over the AWS backbone, without traversing an internet gateway or NAT device. That route only matches S3 (and, for the endpoint, its regional service) destinations; all other internet destinations are unaffected and would still fail without a public IP or NAT. Thus, an S3 endpoint could provide S3 connectivity but cannot account for general internet access from the instance.
- ✗
The subnet's route table has a default route (0.0.0.0/0) pointing to an internet gateway.
Why it's wrong here
Incorrect. An internet gateway does not perform NAT; it requires instances to have public IP addresses for return traffic. Without a public IP or NAT device, a default route to an IGW cannot provide internet connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.