ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Study guide / Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer)

Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer): SCS-C03 study notes and practice questions

What to know about Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer) for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

These questions describe a multi-account network where a rule such as “production must never reach development” or “all traffic between VPCs must pass the firewall” has to hold, and the team must prove it. You choose the design that routes traffic through inspection, and the tool that finds paths the rule forbids.

Route traffic through inspection

  • In an inspection VPC, Transit Gateway routes traffic to the firewall, which can be Network Firewall or a third-party appliance behind a Gateway Load Balancer. The traffic then returns to Transit Gateway for its destination.
  • Turn on appliance mode on the Transit Gateway attachment for the inspection VPC. It keeps both directions of a flow in the same Availability Zone, so a stateful appliance sees the whole conversation.
  • Use separate Transit Gateway route tables for groups of spoke attachments. Association and propagation decide which routes each spoke learns, so production does not learn development routes.
  • Security groups that reference other security groups segment resources within a VPC without any new appliance.

Read how Transit Gateway works, which includes the shared services appliance example and appliance mode.

Find unintended access

  • Network Access Analyzer compares your network configuration against a network access scope that you define, such as “no path from the internet to private subnets.” It reports every path that violates the scope. It analyzes configuration and does not send traffic.
  • Reachability Analyzer tests one source and one destination, and reports whether a path exists and what blocks it. Use it to troubleshoot a specific connection.
  • VPC Flow Logs record traffic that actually flowed. They show what is used, not what could be reached, so they cannot prove that a path is closed.

Read the Network Access Analyzer guide for how scopes are written.

How to choose

Scenario wording Pick
Prove production cannot reach development, across accounts Network Access Analyzer with a scope
Test whether one instance can reach one database Reachability Analyzer
Find allowed rules that no traffic ever uses VPC Flow Logs analysis
Force traffic between VPCs through inspection Transit Gateway with an inspection VPC
Keep a stateful firewall’s flows symmetric across AZs Appliance mode on the Transit Gateway attachment
Segment instances inside one VPC by role Security group references

Common traps

  • Reachability Analyzer for an organization-wide audit. It checks one path at a time.
  • Flow Logs as proof of no access. Silence means no traffic was seen, not that a path is closed.
  • Missing appliance mode, so return traffic takes another AZ and the stateful firewall drops it.
  • One shared Transit Gateway route table for every spoke, which lets all spokes reach each other.
  • VPC peering as the inspection design. Peering is not transitive, so traffic cannot be routed through a central inspection VPC.

Try the 1 practice question

Practice Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer)Take the free practice exam

Question 1

Easier ·Link to this question (question 1)

A startup runs five VPCs in one AWS Region for its web, data and analytics workloads. Its security team wants all traffic between the VPCs, and all traffic going to the internet, to pass through one AWS Network Firewall, where the rules are managed in one place.

The team has noticed that inspected connections fail when the reply takes a different path through the firewall. The team wants inspection without moving the workloads into a new VPC.

Which design meets these requirements?

Choose one answer.

  1. A. Deploy a Network Firewall endpoint into every VPC, and route each VPC internet traffic through its own firewall, with the rules copied into each firewall by hand.
  2. B. Replace the firewall with security groups in each VPC, since security groups inspect every packet that reaches the workloads and apply rules to the packet contents.
  3. C. Attach the five VPCs and a central inspection VPC with Network Firewall endpoints to a Transit Gateway, and turn on appliance mode for the inspection attachment.
  4. D. Route all internet traffic through a NAT gateway in each VPC, and use the NAT gateway logs to find suspicious connections and block them by hand.
Show the answer and explanation

Answer: C

  • A. Wrong: This provides inspection, but it duplicates the firewall and its rules in five places, which the team wants to avoid. The requirement is one firewall with rules managed in one place.
  • B. Wrong: Security groups filter by address and port, but they do not apply firewall rules to packet contents. They also cannot inspect traffic between VPCs in one central place.
  • C. Right: Correct. The central firewall is managed in one place, and the Transit Gateway routes traffic through it. Appliance mode keeps the request and the reply in the same Availability Zone, so the stateful firewall sees both halves of each connection. Learn more: What is Transit Gateway? (opens in a new tab)
  • D. Wrong: A NAT gateway translates addresses and does not apply firewall rules to packet contents. Its logs show connections after the fact, so they do not stop suspicious traffic.

Explanation

A central inspection VPC with Network Firewall endpoints, reached through a Transit Gateway, gives one place for rules. Appliance mode keeps both halves of a connection in the same Availability Zone so stateful inspection works. Per-VPC firewalls, security groups and NAT logs each miss a stated requirement.

Study

Want more on Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer)? The 5 full-length practice sets have 5 more Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer)

More Infrastructure Security topics