SCS-C03 Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A security auditor discovers that an S3 bucket is accessible to anyone with the account ID. What is the most likely cause of this configuration, and how should it be remediated?

Accepted Answer

The bucket policy allows 's3:ListBucket' to the 'AWS' principal, which is a reserved keyword.. The stem describes a scenario where access is granted to anyone with the account ID (often implying a misconfigured bucket policy with a wildcard principal or an overly broad condition), whereas the option focuses on public ACLs. Furthermore, IAM policies cannot be attached directly to S3 buckets (Option C is technically impossible). The explanation mentions 'S3 Block Public Access' which is the correct remediation for public access, but the stem's premise of 'anyone with the account ID' is distinct from 'public' access.

Answer

The bucket has an ACL allowing the 'Everyone' group, which should be replaced by a private bucket policy.

Answer

The bucket has an IAM policy attached directly to the bucket resource.

Answer

The VPC endpoint for S3 is allowing cross-account access by default.

Question 2

A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The security team must ensure that the website is only accessible to users in specific European countries and that users cannot bypass CloudFront to access the S3 bucket directly. Which configuration fulfills these requirements most securely?

Accepted Answer

Enable CloudFront geographic restriction and configure the S3 bucket policy to allow access only from the CloudFront service principal using Origin Access Control.. CloudFront geographic restrictions are a native feature of the distribution configuration. While WAF can also perform geo-blocking, Option B correctly identifies the native CloudFront geo-restriction feature and the use of Origin Access Control (OAC) to secure the S3 bucket, which is the standard and most secure implementation for this scenario.

Answer

Configure S3 bucket policies to allow access only from the IP ranges of the permitted countries and use Origin Access Identity.

Answer

Use AWS WAF on the S3 bucket to block non-European traffic and implement a VPC Endpoint for S3 to restrict access to CloudFront nodes.

Answer

Implement a Lambda@Edge function to check the viewer's IP address against a geo-database and use a signed URL strategy for all S3 objects.

Question 3

A company is evaluating AWS Shield to protect its public-facing web applications from Distributed Denial of Service (DDoS) attacks. Which TWO features are provided exclusively by AWS Shield Advanced that are not available in the Standard tier?

Accepted Answer

24x7 access to the AWS Shield Response Team (SRT) for manual mitigation during an active attack.. AWS Shield Standard provides automatic protection against common Layer 3 and 4 attacks. AWS Shield Advanced adds exclusive features including 24/7 access to the AWS Shield Response Team (SRT) and the ability to use AWS WAF at no additional cost for protected resources. The explanation should explicitly mention these two differentiators to justify the correct options.

Answer

Automatic mitigation of common infrastructure Layer 3 and Layer 4 DDoS attacks.

Answer

Inline mitigation using AWS global edge locations to reduce latency for legitimate users.

Answer

Real-time visibility into DDoS events via the AWS Management Console and CloudWatch metrics.

Question 4

Refer to the exhibit. A security engineer is configuring VPC Traffic Mirroring to inspect traffic for an application server. Based on the provided Traffic Mirror Filter configuration, what traffic will be mirrored to the target?

Accepted Answer

Only inbound HTTPS traffic from any source to the 10.0.1.0/24 destination subnet.. Traffic Mirroring filters define traffic based on the direction relative to the source network interface. If the filter rule is set to 'ingress', it captures traffic entering the network interface. If the destination CIDR is 10.0.1.0/24, it refers to the destination IP of the packet. Option B correctly identifies this as inbound traffic to that subnet.

Answer

All inbound and outbound TCP traffic on port 443 for the specified network interface.

Answer

All inbound traffic regardless of protocol, as long as it originates from 0.0.0.0/0.

Answer

Outbound traffic from the 10.0.1.0/24 subnet to any destination on TCP port 443.

Question 5

A large organization needs to connect its on-premises data center to 50 different VPCs across multiple AWS accounts. The solution must support encrypted transit, centralize outbound internet traffic through a security VPC for inspection, and minimize the number of VPN connections. Which TWO components are essential to this architecture?

Accepted Answer

AWS Transit Gateway to interconnect VPCs and the on-premises environment.. AWS Transit Gateway acts as a central hub, simplifying the management of multiple VPC connections. A Site-to-Site VPN attached to the Transit Gateway provides the required encrypted transit for on-premises connectivity. This hub-and-spoke model allows for centralized inspection of outbound traffic via a security VPC, meeting all requirements.

Answer

VPC Peering between all 50 VPCs and a centralized shared services VPC.

Answer

A separate Virtual Private Gateway (VGW) for each of the 50 VPCs.

Answer

AWS Direct Connect with a Public Virtual Interface for encrypted data transfer.

Question 6

Refer to the exhibit. A user is attempting to connect to a web server from the IP address 203.0.113.5 on port 80. Based on the provided Network ACL and Security Group configurations, what will be the result of this connection attempt?

Accepted Answer

The connection will be denied because the NACL Rule 100 is evaluated first.. Network ACLs (NACLs) are processed before Security Groups for inbound traffic entering a subnet. NACLs are stateless and process rules in numerical order. In this scenario, Rule 100 in the NACL explicitly denies traffic from the specific IP address, so the packet is dropped before it can be evaluated by the Security Group.

Answer

The connection will be allowed because the Security Group permits all traffic on port 80.

Answer

The connection will be allowed because NACL Rule 200 permits all traffic on port 80.

Answer

The connection will be denied because Security Groups take precedence over NACLs.

Question 7

A company requires all outbound internet traffic from its VPC to be inspected by a fleet of third-party firewall appliances. The solution must scale horizontally and ensure that traffic is symmetric, meaning requests and responses pass through the same firewall instance. Which architecture should the security engineer implement?

Accepted Answer

Deploy a Gateway Load Balancer and create a GWLB endpoint in the traffic-originating subnets.. Gateway Load Balancer (GWLB) is designed for deploying, scaling, and managing third-party virtual appliances. It uses the GENEVE protocol to wrap packets and maintain flow affinity, ensuring that both directions of a traffic flow are handled by the same appliance, which is critical for stateful inspection and security monitoring.

Answer

Deploy the firewalls behind an Application Load Balancer and use host-based routing.

Answer

Use a Transit Gateway with VPC Peering and ECMP enabled for load balancing.

Answer

Set up a Network Load Balancer with Proxy Protocol enabled for the firewall instances.

Question 8

A company wants to eliminate the need for managing SSH keys and bastion hosts while still allowing administrators to securely access EC2 instances in private subnets. Which AWS service provides this capability and allows for centralized IAM-based access control?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager provides a secure way to manage EC2 instances without needing to open inbound ports like 22 (SSH) or 3389 (RDP). It uses the SSM Agent to establish a secure tunnel, and access is controlled entirely through IAM policies, providing a robust audit trail of all commands.

Answer

Amazon EC2 Instance Connect

Answer

AWS CloudShell

Answer

AWS Directory Service

Question 9

A security engineer is configuring AWS Network Firewall to protect a VPC. They need to implement a rule that inspects the 'Host' header of HTTP traffic to block specific unauthorized domains. Which type of rule group should be used?

Accepted Answer

Stateful rule group with domain list filtering.. AWS Network Firewall supports both stateless and stateful rule groups. Stateful rule groups use the Suricata compatible engine, which allows for deep packet inspection (DPI) of application-layer protocols like HTTP. This enables the firewall to inspect headers, such as the 'Host' header, to enforce domain-based filtering policies.

Answer

Stateless rule group with 5-tuple filtering.

Answer

AWS WAF with a web ACL associated with the VPC.

Answer

VPC Endpoint Policy associated with an S3 gateway.

Question 10

A company is designing a hub-and-spoke network architecture using AWS Transit Gateway. They want to centralize inbound and outbound internet traffic inspection using a fleet of firewalls in a dedicated 'Security VPC'. Which TWO steps are required to ensure traffic is correctly routed for inspection? (Select TWO.)

Accepted Answer

Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.. In a centralized inspection model, Transit Gateway (TGW) acts as the hub. Traffic from spoke VPCs must be routed to the TGW, which then uses a specific route table to forward traffic to the Security VPC. Appliance Mode must be enabled on the TGW attachment to ensure session stickiness for stateful firewalls.

Answer

Disable 'Source/Destination Check' on all Transit Gateway attachments.

Answer

Use VPC Peering between all spoke VPCs and the Security VPC to bypass the Transit Gateway.

Answer

Create a separate NAT Gateway in every spoke VPC to handle the inspection traffic locally.

Question 11

Refer to the exhibit. This policy is applied to an Amazon S3 bucket named 'sensitive-data'. What is the security implication of this policy configuration?

Accepted Answer

It prevents any access to the bucket from outside the specified VPC endpoint.. This bucket policy uses an explicit 'Deny' with a 'StringNotEquals' condition. This pattern is a powerful security control that implements a 'perimeter' around the bucket. It ensures that any request not originating from the specified VPC Endpoint (vpce-1a2b3c4d) is rejected, regardless of any other 'Allow' permissions the user might have.

Answer

It allows all users in the VPC to access the bucket if they use the specified VPC endpoint.

Answer

It only denies access to the bucket if the user is using a different VPC endpoint, but allows public access.

Answer

It restricts access to the bucket to only the root user of the account via the VPC endpoint.

Question 12

A company needs to log all DNS queries made by EC2 instances within their VPC to identify potential data exfiltration via DNS tunneling. Which feature should the security engineer enable?

Accepted Answer

Route 53 Resolver Query Logging.. Route 53 Resolver Query Logging allows you to log all DNS queries made by resources within your VPC. This includes queries for public domain names, internal VPC domain names, and even queries made via Route 53 Resolver DNS Firewall, providing the visibility needed to detect anomalies like DNS tunneling.

Answer

VPC Flow Logs for all subnets.

Answer

CloudTrail management events.

Answer

Amazon GuardDuty DNS Security.

Question 13

Refer to the exhibit. A security engineer has deployed this AWS WAF rule. If a single IP address sends 1,500 requests in a 5-minute window, what will happen according to this configuration?

Accepted Answer

The first 1,000 requests will be allowed, and the subsequent 500 requests will be blocked.. AWS WAF rate-based rules track the number of requests from each IP address over a sliding 5-minute window. If the number of requests exceeds the defined limit (1,000 in this case), the action (Block) is triggered. The IP will remain blocked until its request rate falls below the threshold.

Answer

All 1,500 requests will be blocked immediately by the WAF.

Answer

The IP will be added to a permanent blocklist until manually removed by an administrator.

Answer

The WAF will allow all traffic but send an alert to CloudWatch when the limit is exceeded.

Question 14

A security engineer must protect a multi-tier web application hosted in Amazon EC2 instances inside a private subnet. The application requires outbound internet access to download software updates, but malicious actors must never be able to initiate inbound connections to the instances. Which architecture satisfies these requirements securely?

Accepted Answer

Provision a NAT Gateway in a public subnet, and configure the private subnet route table to direct 0.0.0.0/0 traffic to that NAT Gateway.. Routing outbound traffic through a NAT Gateway ensures that instances can initiate communication with external endpoints while remaining entirely unreachable from the outside. NAT Gateways do not support inbound traffic initiation, providing a robust boundary. This design prevents direct exposure of private workloads, aligning with defense-in-depth principles for infrastructure security in AWS environments.

Answer

Attach an Elastic IP directly to each EC2 instance and remove the default route pointing to the internet gateway in the route table.

Answer

Deploy an Internet Gateway in the private subnet and associate it with the route table used by the application instances.

Answer

Configure a VPC endpoint for every external repository and remove all internet route entries from the VPC route tables entirely.

Question 15

A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)

Accepted Answer

Amazon VPC security groups. Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon Route 53 Resolver DNS Firewall