During review, route tables in a shared networking account send 0.0.0.0/0 from a protected subnet toward an inspection VPC rather than directly to an internet gateway. How should the architect treat that design?
Select an answer to reveal the explanation.
Short Explanation
Routes are traffic cops, not just plumbing. Sending default traffic into an inspection VPC on purpose is a security control—as long as the review proves that was the intent. Blasting everything straight to an IGW “for speed,” deleting route tables, or living on SSH tunnels misses that design lever.
Full Explanation
Route tables that send 0.0.0.0/0 from a protected subnet toward an inspection VPC instead of directly to an internet gateway are often a deliberate network security control, not an accidental blackhole. Centralized egress or east-west inspection architectures steer traffic to Gateway Load Balancer, firewall appliances, or inspection VPCs so packets are evaluated before leaving or crossing trust zones. Architects should treat that routing as prescribed policy and validate that every protected subnet’s default route matches the intended inspection path.
Always replacing inspection routes with direct IGW routes in every subnet to maximize performance ignores organizational inspection mandates. Removing all route tables and relying solely on public IP addressing for isolation is incoherent—routing is required for VPC communication. Disabling VPC routing and forcing all traffic through temporary bastion SSH tunnels cannot replace enterprise egress inspection and does not scale.
Exam caveat: a blackhole route can be intentional (sinkhole) or a misconfiguration; the stem’s “toward an inspection VPC” signals deliberate steering—do not “fix” it by pointing straight at an IGW without reading policy. Operational check: traceroute or flow-log an egress connection from the protected subnet, confirm next hop is the inspection attachment, verify return path symmetry through the appliance, and document which subnets are inspection-mandated versus exempt.