ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

AWS Network Firewall is a managed, highly available service that lets administrators create stateful rule groups, including domain-list rules that allow or deny traffic based on fully qualified domain names. By deploying a firewall endpoint in the VPC's egress path and whitelisting only repo.example.com while blocking all other destinations, the engineer enforces the policy before traffic leaves the private subnets. A VPC endpoint policy applies only to AWS services, so it cannot restrict access to an external vendor site. A NAT instance can be customized with iptables, but that requires continuous patching and scaling management, increasing operational overhead and cost. Amazon GuardDuty provides threat detection and alerting after the fact and is therefore a detective, not preventative, control.