ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Creating separate VPCs for development and production gives each environment an independent, non-overlapping IP space and its own routing and security boundaries, delivering the strongest form of logical segmentation at Layer 3. A VPC itself is free, and VPC peering has no hourly cost; you only pay for data that crosses the link. By attaching restrictive route-table entries and security-group rules to the peering connection, you can allow just the necessary CI/CD ports while denying all other traffic.

Placing dev and prod in different subnets with distinct network ACLs still leaves them in the same VPC, so misconfigurations (for example, overly permissive route tables) could expose prod resources, and stateless ACLs require duplicate in/out rules, increasing operational effort. Simply changing security groups keeps everything in one subnet, providing the weakest separation and a larger blast radius. Deploying AWS Network Firewall would achieve segmentation but adds additional service cost and management overhead that the scenario seeks to avoid.