Practice SCS-C03 Infrastructure Security questions with full explanations on every answer.
Start practicing
Infrastructure Security — choose a session length
Free · No account required
Click any question to see the full explanation and answer options, or start a focused practice session above.
Refer to the exhibit. A user is attempting to connect to a web server from the IP address 203.0.113.5 on port 80. Based on the provided Network ACL and Security Group configurations, what will be the result of this connection attempt?
2A company requires all outbound internet traffic from its VPC to be inspected by a fleet of third-party firewall appliances. The solution must scale horizontally and ensure that traffic is symmetric, meaning requests and responses pass through the same firewall instance. Which architecture should the security engineer implement?
3A company wants to eliminate the need for managing SSH keys and bastion hosts while still allowing administrators to securely access EC2 instances in private subnets. Which AWS service provides this capability and allows for centralized IAM-based access control?
4A security engineer is configuring AWS Network Firewall to protect a VPC. They need to implement a rule that inspects the 'Host' header of HTTP traffic to block specific unauthorized domains. Which type of rule group should be used?
5A company is designing a hub-and-spoke network architecture using AWS Transit Gateway. They want to centralize inbound and outbound internet traffic inspection using a fleet of firewalls in a dedicated 'Security VPC'. Which TWO steps are required to ensure traffic is correctly routed for inspection? (Select TWO.)
6Refer to the exhibit. This policy is applied to an Amazon S3 bucket named 'sensitive-data'. What is the security implication of this policy configuration?
7A company needs to log all DNS queries made by EC2 instances within their VPC to identify potential data exfiltration via DNS tunneling. Which feature should the security engineer enable?
8Refer to the exhibit. A security engineer has deployed this AWS WAF rule. If a single IP address sends 1,500 requests in a 5-minute window, what will happen according to this configuration?
9A security engineer must protect a multi-tier web application hosted in Amazon EC2 instances inside a private subnet. The application requires outbound internet access to download software updates, but malicious actors must never be able to initiate inbound connections to the instances. Which architecture satisfies these requirements securely?
10A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)
11An organization is deploying a multi-tier application. Which TWO of the following configurations are required to ensure that the backend application tier in a private subnet can securely communicate with an RDS database instance while preventing direct internet access?
12Refer to the exhibit. A security engineer notices that despite the IP restriction, users are still unable to access the S3 bucket from within the corporate network. What is the most likely cause of this issue?
13A security engineer needs to ensure that all EC2 instances are patched against critical vulnerabilities without exposing them to the public internet. Which architecture is most appropriate for this task?
14Which THREE actions are essential to harden an Amazon EC2 Linux instance against unauthorized SSH access?
15An enterprise provides a financial data service to clients via AWS PrivateLink. The security architect must ensure that only authorized consumer VPCs can connect to the Interface VPC Endpoint and that all traffic flow metadata is captured for forensic auditing. Which combination of actions meets these requirements?
16A company is experiencing a high volume of SQL injection attempts against its web application. The application is behind an Application Load Balancer (ALB). The security team wants to block these attacks while ensuring that legitimate traffic containing technical documentation (which may include SQL-like snippets) is not accidentally blocked. What is the best approach?
The Infrastructure Security domain covers the key concepts tested in this area of the SCS-C03 exam blueprint published by Amazon Web Services. Courseiva provides free domain-focused practice, mock exams, missed-question review, and readiness tracking across all SCS-C03 domains — no account required.
The Courseiva SCS-C03 question bank contains 16 questions in the Infrastructure Security domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Infrastructure Security domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included