SCS-C03 Infrastructure Security — 10 Questions

Question 1

A security engineer must monitor and record all rejected TCP connection attempts to a fleet of EC2 instances within a private subnet. The logs must be stored in a durable manner for three years to meet regulatory compliance. Which solution meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable VPC Flow Logs and configure the destination as an Amazon S3 bucket.. VPC Flow Logs must be specifically configured to capture 'REJECT' traffic (or 'ALL' traffic) to meet the requirement. Simply enabling Flow Logs is insufficient if the default 'ACCEPT' setting is used. The explanation should clarify that the log configuration must include the REJECT action.

Answer

Install the CloudWatch Logs agent on all instances to capture local kernel network logs.

Answer

Enable Amazon GuardDuty and review the 'UnauthorizedAccess:EC2/SSHBruteForce' findings.

Answer

Configure an AWS Config rule to monitor the state of all Security Group rules daily.

Question 2

A company uses an Application Load Balancer (ALB) to route traffic to EC2 instances. A security engineer needs to ensure that only traffic originating from a specific Amazon CloudFront distribution can reach the ALB. What is the most secure way to implement this restriction?

Accepted Answer

Use a Lambda@Edge function to sign all requests with an AWS Signature Version 4.. AWS supports SigV4 for requests from CloudFront to an Application Load Balancer. By configuring CloudFront to sign requests using AWS Signature Version 4 (SigV4), the ALB can natively authenticate that the traffic originates from the specified CloudFront distribution, without requiring custom header management or reliance on frequently changing IP ranges. While custom headers (Option C) were historically common, SigV4 is the most secure and modern native method for ALB origins.

Answer

Add the CloudFront IP ranges to the ALB's Security Group inbound rules.

Answer

Configure CloudFront to use an Origin Access Control (OAC) with the ALB as the target.

Answer

Configure the ALB to only accept traffic containing a custom header set by CloudFront.

Question 3

A financial services company is concerned about large-scale DDoS attacks affecting its public-facing DNS and web applications. Which TWO AWS services or features provide automatic protection or mitigation against Layer 3, Layer 4, and Layer 7 DDoS attacks? (Select TWO.)

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides managed protection for L3/L4 and L7 attacks. AWS WAF is specifically designed for L7 (application layer) protection. While they are often used together, AWS WAF does not provide L3/L4 protection. The question asks for services that provide protection against L3, L4, AND L7. Shield Advanced covers all three, while WAF covers L7. The combination is the correct answer, but the explanation should clarify that WAF is specifically for L7.

Answer

AWS Global Accelerator

Answer

Amazon Inspector

Answer

VPC Reachability Analyzer

Question 4

A security engineer is tasked with restricting access to Amazon S3 and Amazon DynamoDB so that traffic never leaves the AWS private network. Which TWO types of VPC endpoints should be used to achieve this for these specific services? (Select TWO.)

Accepted Answer

Gateway Endpoint for Amazon S3. While Gateway endpoints are the traditional and cost-effective way to access S3 and DynamoDB, both services now support Interface endpoints (AWS PrivateLink). The explanation incorrectly states that DynamoDB only supports Gateway endpoints, which is false. Furthermore, the stem asks for the two types of endpoints that ensure traffic never leaves the AWS private network; while both types achieve this, Gateway endpoints are the standard architectural recommendation for these specific services to avoid NAT Gateway costs.

Answer

Interface Endpoint for Amazon DynamoDB

Answer

Interface Endpoint for Amazon S3

Answer

Service Endpoint for Amazon Route 53

Question 5

A security engineer wants to ensure that all EC2 instances are launched only with approved, encrypted AMIs and that any instance with an unencrypted volume is automatically flagged. Which service is best suited for this continuous compliance monitoring?

Accepted Answer

AWS Config. AWS Config is the correct service for continuous compliance. The explanation should explicitly mention that AWS Config can evaluate EC2 instance configurations against custom or managed rules to verify that the AMI ID matches an approved list and that EBS volumes are encrypted.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Security Hub

Question 6

An organization is using AWS Direct Connect to link their on-premises data center to their AWS VPC. They have a strict requirement that all data in transit over the Direct Connect link must be encrypted at the network layer. Which solution should they implement?

Accepted Answer

Enable MACsec encryption on the Direct Connect connection.. Both MACsec (IEEE 802.1AE) and IPsec (via Site-to-Site VPN) provide network-layer encryption. MACsec provides Layer 2 encryption for Direct Connect Dedicated Connections (10 Gbps or 100 Gbps), while IPsec provides Layer 3 encryption. Since the question asks for network-layer encryption without specifying the OSI layer or connection type, both are technically correct, but MACsec is often preferred for high-throughput, low-latency requirements on supported hardware.

Answer

Use TLS/SSL for all application-level communication over the link.

Answer

Configure a Transit Gateway with VPC Peering and enable default encryption.

Question 7

An enterprise organization runs critical databases in Amazon RDS within a private VPC. Compliance mandates that traffic traversing between the application servers and the database must be encrypted in transit using strict mutual TLS authentication and strong cipher suites. Which configuration should the security engineer implement?

Accepted Answer

Configure the RDS parameter group to enforce TLS, download the AWS root certificates onto application servers, and require SSL connections.. Standard RDS SSL/TLS configuration (Option B) only authenticates the server to the client. Mutual TLS (mTLS) requires the database to also verify the client's certificate. RDS does not natively support mTLS for standard database connections; this typically requires an intermediate proxy like AWS PrivateLink or an application-level proxy (e.g., Envoy/Istio) to handle the client certificate validation.

Answer

Enable transparent data encryption on the RDS instance and configure security groups to restrict traffic exclusively to application server IP addresses.

Answer

Implement AWS Shield Advanced on the database subnet to automatically encrypt all database packets traversing the internal VPC network interfaces.

Answer

Deploy a Network Load Balancer in front of the database and configure TLS termination listeners with self-signed cryptographic certificates.

Question 8

A security engineer must restrict access to an Amazon S3 bucket so that only requests originating from a specific VPC are permitted. Which policy approach should be implemented to ensure this constraint is enforced effectively?

Accepted Answer

Attach a bucket policy that denies all 's3:*' actions if the 'aws:SourceVpce' does not match the required VPC endpoint ID.. A bucket policy that denies access if the 'aws:SourceVpce' does not match will inadvertently deny all requests, including those from the VPC endpoint itself, because the condition evaluates to true for any request not originating from that specific endpoint. To correctly restrict access, the policy must use a 'Deny' effect with a 'StringNotEquals' condition on 'aws:SourceVpce', or more commonly, an 'Allow' effect with a 'StringEquals' condition. Furthermore, the explanation should clarify that 'aws:SourceVpce' is the correct key for VPC Endpoints.

Answer

Apply an IAM policy to all users that denies access to the bucket if the source IP is outside the VPC range.

Answer

Enable S3 Block Public Access at the bucket level and attach an ACL that restricts access to the VPC.

Answer

Configure a Security Group on the S3 bucket to allow traffic only from the VPC CIDR block.

Question 9

A company requires all traffic between two EC2 instances in different subnets to be encrypted in transit. Which solution provides the most secure and scalable way to achieve this at the infrastructure level?

Accepted Answer

Configure a Site-to-Site VPN tunnel between the two VPC subnets.. Option C specifies implementing TLS/SSL at the application layer, which contradicts the stem's requirement for a scalable infrastructure-level solution without modifying application code. Network-layer encryption solutions like Amazon VPC Traffic Mirroring combined with MACsec (where supported on Nitro instances), or IPsec tunnels/AWS PrivateLink, should be used for infrastructure-level encryption.

Answer

Use VPC Flow Logs to monitor and encrypt traffic between instances.

Answer

Implement TLS/SSL at the application layer for all inter-instance communication.

Answer

Enable Amazon S3 bucket encryption using a KMS customer-managed key.

Question 10

Which service should be used to protect a web application hosted on an Application Load Balancer from Layer 7 DDoS attacks and common web exploits like SQL injection?

Accepted Answer

AWS Shield Advanced. While AWS WAF protects against common web exploits like SQL injection, AWS Shield Advanced is the service specifically designed for comprehensive protection against Layer 7 DDoS attacks (along with integration with AWS WAF for custom rules). For an explicit question mentioning Layer 7 DDoS attacks and web exploits on an ALB, AWS Shield Advanced is the complete answer because it incorporates AWS WAF functionality while providing dedicated DDoS mitigation capabilities.

Answer

AWS WAF

Answer

Network ACLs

Answer

Security Groups