During review, route tables in a shared networking account send 0.0.0.0/0 from a protected subnet toward an inspection VPC rather than directly to an internet gateway. How should the architect treat that design?
Select an answer to reveal the explanation.
Short Explanation
Routes are traffic cops, not just plumbing. Sending default traffic into an inspection VPC on purpose is a security control—as long as the review proves that was the intent. Blasting everything straight to an IGW “for speed,” deleting route tables, or living on SSH tunnels misses that design lever.
Full Explanation
Route tables are first-class network security controls in AWS architectures that force traffic through inspection appliances, firewall endpoints, or centralized egress. A 0.0.0.0/0 target aimed at an inspection VPC attachment can be correct when policy requires east-west or egress inspection, provided the path is intentional and monitored. Blindly preferring direct internet gateway routes, removing routing structure, or substituting ad-hoc bastion tunnels abandons that control. Security review should confirm routes implement the prescribed inspection design rather than assume any non-IGW default is a mistake.