Here you can find all the free questions related with Amazon AWS Certified Security - Specialty (SCS-C03) exam. You can also find on this page links to recently updated premium files with which you can practice for actual Amazon AWS Certified Security - Specialty Exam. These premium versions are provided as SCS-C03 exam practice tests, both as desktop software and browser based application, you can use whatever suits your style. Feel free to try the AWS Certified Security - Specialty Exam premium files for free, Good luck with your Amazon AWS Certified Security - Specialty Exam.
Question No: 1
MultipleChoice
A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. Each Availability Zone contains one public subnet and one private subnet. Three route tables exist: one for the public subnets and one for each private subnet.
The security engineer discovers that all four subnets are routing traffic through the internet gateway that is attached to the VPC.
Which combination of steps should the security engineer take to remediate this scenario? (Select TWO.)
Options
Answer A, DExplanation
AWS networking best practices require private subnets to access the internet only through NAT gateways located in public subnets. According to the AWS Certified Security -- Specialty Study Guide, NAT gateways must be provisioned in public subnets and used as the default route for outbound traffic from private subnets.
Verifying NAT gateways in each Availability Zone ensures high availability and fault tolerance. Updating the private subnet route tables to send 0.0.0.0/0 traffic to the NAT gateway prevents direct internet access while allowing outbound connectivity.
Routing private subnet traffic directly to an internet gateway violates subnet isolation principles. NAT gateways must never be placed in private subnets.
Referenced AWS Specialty Documents:
AWS Certified Security -- Specialty Official Study Guide