Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 107 discussion

C, When you deploy a virtual security appliance inline in a subnet, you need to ensure that it can effectively route traffic between different subnets. The "Network Source/Destination check" is a feature in Amazon EC2 that controls whether source/destination checking is enabled or disabled on a network interface. In this context, the virtual security appliance acts as a router, and the "Network Source/Destination check" should be disabled on its elastic network interface. When this check is disabled, the network interface can handle traffic that is not specifically destined for the instance it is attached to, allowing it to route traffic between different subnets.

C for sure

Source/destination checking You can enable or disable source/destination checks, which ensure that the instance is either the source or the destination of any traffic that it receives. Source/destination checks are enabled by default. You must disable source/destination checks if the instance runs services such as network address translation, routing, or firewalls. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

Option C is the correct solution. To allow a virtual security appliance deployed inline to route traffic between subnets, the Network Source/Destination Check needs to be disabled on its elastic network interface. This enables the appliance to receive traffic that is not specifically addressed to itself. Option A is incorrect because disabling network ACLs is not required for a virtual appliance deployment and would reduce security. Option B mentions promiscuous mode which applies to physical network interfaces, not virtual ones in AWS. Option D places the appliance in the public subnet which may help route internet traffic but does not address routing between private subnets. Disabling the Source/Destination Check is required to enable that routing functionality.

Answer: C

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

C is correct

correct