SCS-C02 Infrastructure Security Practice Question
A security engineer notices that an EC2 instance in a private subnet can reach the internet, even though there is no NAT gateway or instance in the route table. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume internet access from a private subnet always requires a NAT gateway or instance, overlooking the fact that egress-only internet gateways provide outbound-only IPv6 internet access without any NAT device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An egress-only internet gateway is used for IPv6 traffic.
An egress-only internet gateway (EIGW) allows outbound-only IPv6 traffic from instances in a private subnet to the internet, but it does not permit inbound connections initiated from the internet. Since the question states there is no NAT gateway or instance, and the instance can reach the internet, the most likely cause is that the VPC uses IPv6 and an EIGW is configured with a default route (::/0) pointing to it. This enables outbound internet access without a NAT device, matching the described scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An internet gateway is attached to the VPC and a default route points to it.
Why it's wrong here
An internet gateway (IGW) is a bidirectional device: if the subnet's route table had a default route pointing to an IGW, the subnet would no longer be private, and the instance would be both reachable from and able to reach the internet for IPv4 and IPv6. That would violate the observed outbound-only behavior, because the IGW forwards unsolicited inbound traffic just as readily as outbound. Egress-only connectivity for IPv6 requires an egress-only internet gateway, not an IGW.
- ✗
A VPC endpoint for S3 is configured.
Why it's wrong here
A VPC endpoint for S3 (whether gateway or interface type) provides private connectivity only to the S3 service prefix, not to the general internet. It works via route table entries for the S3 prefix (gateway endpoint) or via an ENI in the subnet (interface endpoint), neither of which establishes a default path to arbitrary internet hosts. Therefore, while an S3 endpoint could enable specific S3 API calls, it cannot explain general outbound internet traffic from the instance.
- ✗
A NAT gateway is configured in a different availability zone.
Why it's wrong here
A NAT gateway is IPv4-only and cannot forward IPv6 traffic, so it cannot be the mechanism behind egress-only IPv6 internet access. Additionally, if a NAT gateway were being used—even one placed in a different availability zone—it would appear as a target in the subnet's route table for the default IPv4 destination. If the route table shows no NAT gateway target and the traffic is IPv6, this option is definitively ruled out.
- ✓
An egress-only internet gateway is used for IPv6 traffic.
Why this is correct
An egress-only internet gateway (EIGW) is a special gateway that enables outbound IPv6 connectivity from a VPC to the internet while blocking any inbound IPv6 traffic. It is the IPv6 counterpart to a NAT gateway, designed for private subnets that need to initiate internet requests without being connetionally reachable. The presence of a route for ::/0 pointing to the EIGW in the private subnet's route table exactly produces the observed outbound-only behavior.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.