SCS-C03 practice question: Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer)
Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A startup runs five VPCs in one AWS Region for its web, data and analytics workloads. Its security team wants all traffic between the VPCs, and all traffic going to the internet, to pass through one AWS Network Firewall, where the rules are managed in one place.
The team has noticed that inspected connections fail when the reply takes a different path through the firewall. The team wants inspection without moving the workloads into a new VPC.
Which design meets these requirements?
Choose one answer.
AA. Deploy a Network Firewall endpoint into every VPC, and route each VPC internet traffic through its own firewall, with the rules copied into each firewall by hand.
BB. Replace the firewall with security groups in each VPC, since security groups inspect every packet that reaches the workloads and apply rules to the packet contents.
CC. Attach the five VPCs and a central inspection VPC with Network Firewall endpoints to a Transit Gateway, and turn on appliance mode for the inspection attachment.
DD. Route all internet traffic through a NAT gateway in each VPC, and use the NAT gateway logs to find suspicious connections and block them by hand.
Show the answer and explanation
Answer: C
A. Wrong: This provides inspection, but it duplicates the firewall and its rules in five places, which the team wants to avoid. The requirement is one firewall with rules managed in one place.
B. Wrong: Security groups filter by address and port, but they do not apply firewall rules to packet contents. They also cannot inspect traffic between VPCs in one central place.
C. Right: Correct. The central firewall is managed in one place, and the Transit Gateway routes traffic through it. Appliance mode keeps the request and the reply in the same Availability Zone, so the stateful firewall sees both halves of each connection. Learn more: What is Transit Gateway? (opens in a new tab)
D. Wrong: A NAT gateway translates addresses and does not apply firewall rules to packet contents. Its logs show connections after the fact, so they do not stop suspicious traffic.
Explanation
A central inspection VPC with Network Firewall endpoints, reached through a Transit Gateway, gives one place for rules. Appliance mode keeps both halves of a connection in the same Availability Zone so stateful inspection works. Per-VPC firewalls, security groups and NAT logs each miss a stated requirement.
Want more on Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer)? The 5 full-length practice sets have 5 more Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →