SCS-C03 Infrastructure Security — Timed 15 Questions

Question 1

A security engineer must monitor and record all rejected TCP connection attempts to a fleet of EC2 instances within a private subnet. The logs must be stored in a durable manner for three years to meet regulatory compliance. Which solution meets these requirements with the least operational overhead?

15 minute time limit — choose an answer to begin.

Accepted Answer

Enable VPC Flow Logs and configure the destination as an Amazon S3 bucket.. VPC Flow Logs must be specifically configured to capture 'REJECT' traffic (or 'ALL' traffic) to meet the requirement. Simply enabling Flow Logs is insufficient if the default 'ACCEPT' setting is used. The explanation should clarify that the log configuration must include the REJECT action.

Answer

Install the CloudWatch Logs agent on all instances to capture local kernel network logs.

Answer

Enable Amazon GuardDuty and review the 'UnauthorizedAccess:EC2/SSHBruteForce' findings.

Answer

Configure an AWS Config rule to monitor the state of all Security Group rules daily.

Question 2

A company uses an Application Load Balancer (ALB) to route traffic to EC2 instances. A security engineer needs to ensure that only traffic originating from a specific Amazon CloudFront distribution can reach the ALB. What is the most secure way to implement this restriction?

Accepted Answer

Use a Lambda@Edge function to sign all requests with an AWS Signature Version 4.. AWS supports SigV4 for requests from CloudFront to an Application Load Balancer. By configuring CloudFront to sign requests using AWS Signature Version 4 (SigV4), the ALB can natively authenticate that the traffic originates from the specified CloudFront distribution, without requiring custom header management or reliance on frequently changing IP ranges. While custom headers (Option C) were historically common, SigV4 is the most secure and modern native method for ALB origins.

Answer

Add the CloudFront IP ranges to the ALB's Security Group inbound rules.

Answer

Configure CloudFront to use an Origin Access Control (OAC) with the ALB as the target.

Answer

Configure the ALB to only accept traffic containing a custom header set by CloudFront.

Question 3

A financial services company is concerned about large-scale DDoS attacks affecting its public-facing DNS and web applications. Which TWO AWS services or features provide automatic protection or mitigation against Layer 3, Layer 4, and Layer 7 DDoS attacks? (Select TWO.)

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides managed protection for L3/L4 and L7 attacks. AWS WAF is specifically designed for L7 (application layer) protection. While they are often used together, AWS WAF does not provide L3/L4 protection. The question asks for services that provide protection against L3, L4, AND L7. Shield Advanced covers all three, while WAF covers L7. The combination is the correct answer, but the explanation should clarify that WAF is specifically for L7.

Answer

AWS Global Accelerator

Answer

Amazon Inspector

Answer

VPC Reachability Analyzer

Question 4

A security engineer is tasked with restricting access to Amazon S3 and Amazon DynamoDB so that traffic never leaves the AWS private network. Which TWO types of VPC endpoints should be used to achieve this for these specific services? (Select TWO.)

Accepted Answer

Gateway Endpoint for Amazon S3. While Gateway endpoints are the traditional and cost-effective way to access S3 and DynamoDB, both services now support Interface endpoints (AWS PrivateLink). The explanation incorrectly states that DynamoDB only supports Gateway endpoints, which is false. Furthermore, the stem asks for the two types of endpoints that ensure traffic never leaves the AWS private network; while both types achieve this, Gateway endpoints are the standard architectural recommendation for these specific services to avoid NAT Gateway costs.

Answer

Interface Endpoint for Amazon DynamoDB

Answer

Interface Endpoint for Amazon S3

Answer

Service Endpoint for Amazon Route 53

Question 5

A security engineer wants to ensure that all EC2 instances are launched only with approved, encrypted AMIs and that any instance with an unencrypted volume is automatically flagged. Which service is best suited for this continuous compliance monitoring?

Accepted Answer

AWS Config. AWS Config is the correct service for continuous compliance. The explanation should explicitly mention that AWS Config can evaluate EC2 instance configurations against custom or managed rules to verify that the AMI ID matches an approved list and that EBS volumes are encrypted.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Security Hub

Question 6

An organization is using AWS Direct Connect to link their on-premises data center to their AWS VPC. They have a strict requirement that all data in transit over the Direct Connect link must be encrypted at the network layer. Which solution should they implement?

Accepted Answer

Enable MACsec encryption on the Direct Connect connection.. Both MACsec (IEEE 802.1AE) and IPsec (via Site-to-Site VPN) provide network-layer encryption. MACsec provides Layer 2 encryption for Direct Connect Dedicated Connections (10 Gbps or 100 Gbps), while IPsec provides Layer 3 encryption. Since the question asks for network-layer encryption without specifying the OSI layer or connection type, both are technically correct, but MACsec is often preferred for high-throughput, low-latency requirements on supported hardware.

Answer

Use TLS/SSL for all application-level communication over the link.

Answer

Configure a Transit Gateway with VPC Peering and enable default encryption.

Question 7

An enterprise organization runs critical databases in Amazon RDS within a private VPC. Compliance mandates that traffic traversing between the application servers and the database must be encrypted in transit using strict mutual TLS authentication and strong cipher suites. Which configuration should the security engineer implement?

Accepted Answer

Configure the RDS parameter group to enforce TLS, download the AWS root certificates onto application servers, and require SSL connections.. Standard RDS SSL/TLS configuration (Option B) only authenticates the server to the client. Mutual TLS (mTLS) requires the database to also verify the client's certificate. RDS does not natively support mTLS for standard database connections; this typically requires an intermediate proxy like AWS PrivateLink or an application-level proxy (e.g., Envoy/Istio) to handle the client certificate validation.

Answer

Enable transparent data encryption on the RDS instance and configure security groups to restrict traffic exclusively to application server IP addresses.

Answer

Implement AWS Shield Advanced on the database subnet to automatically encrypt all database packets traversing the internal VPC network interfaces.

Answer

Deploy a Network Load Balancer in front of the database and configure TLS termination listeners with self-signed cryptographic certificates.

Question 8

A security engineer must restrict access to an Amazon S3 bucket so that only requests originating from a specific VPC are permitted. Which policy approach should be implemented to ensure this constraint is enforced effectively?

Accepted Answer

Attach a bucket policy that denies all 's3:*' actions if the 'aws:SourceVpce' does not match the required VPC endpoint ID.. A bucket policy that denies access if the 'aws:SourceVpce' does not match will inadvertently deny all requests, including those from the VPC endpoint itself, because the condition evaluates to true for any request not originating from that specific endpoint. To correctly restrict access, the policy must use a 'Deny' effect with a 'StringNotEquals' condition on 'aws:SourceVpce', or more commonly, an 'Allow' effect with a 'StringEquals' condition. Furthermore, the explanation should clarify that 'aws:SourceVpce' is the correct key for VPC Endpoints.

Answer

Apply an IAM policy to all users that denies access to the bucket if the source IP is outside the VPC range.

Answer

Enable S3 Block Public Access at the bucket level and attach an ACL that restricts access to the VPC.

Answer

Configure a Security Group on the S3 bucket to allow traffic only from the VPC CIDR block.

Question 9

A company requires all traffic between two EC2 instances in different subnets to be encrypted in transit. Which solution provides the most secure and scalable way to achieve this at the infrastructure level?

Accepted Answer

Configure a Site-to-Site VPN tunnel between the two VPC subnets.. Option C specifies implementing TLS/SSL at the application layer, which contradicts the stem's requirement for a scalable infrastructure-level solution without modifying application code. Network-layer encryption solutions like Amazon VPC Traffic Mirroring combined with MACsec (where supported on Nitro instances), or IPsec tunnels/AWS PrivateLink, should be used for infrastructure-level encryption.

Answer

Use VPC Flow Logs to monitor and encrypt traffic between instances.

Answer

Implement TLS/SSL at the application layer for all inter-instance communication.

Answer

Enable Amazon S3 bucket encryption using a KMS customer-managed key.

Question 10

Which service should be used to protect a web application hosted on an Application Load Balancer from Layer 7 DDoS attacks and common web exploits like SQL injection?

Accepted Answer

AWS Shield Advanced. While AWS WAF protects against common web exploits like SQL injection, AWS Shield Advanced is the service specifically designed for comprehensive protection against Layer 7 DDoS attacks (along with integration with AWS WAF for custom rules). For an explicit question mentioning Layer 7 DDoS attacks and web exploits on an ALB, AWS Shield Advanced is the complete answer because it incorporates AWS WAF functionality while providing dedicated DDoS mitigation capabilities.

Answer

AWS WAF

Answer

Network ACLs

Answer

Security Groups

Question 11

A security auditor requires that all EBS volumes in an AWS account be encrypted. Which THREE actions should the security team perform to enforce this requirement effectively across the organization?

Accepted Answer

Enable the 'Encrypt all EBS volumes' setting in the EC2 console for every region.. To enforce EBS encryption effectively across an organization, you should enable 'Encrypt all EBS volumes' by default in each region (Option A) and use Service Control Policies (SCPs) to deny the creation of unencrypted volumes (Option B). Option D suggests deleting volumes automatically via Lambda, which is destructive and not a recommended best practice for initial enforcement. Option C is impractical and difficult to manage at scale. Therefore, the three best actions would typically include automated remediation rather than destructive deletion, but since we need three actions, let's look at the standard AWS security pattern: 1. Enable EBS encryption by default, 2. Use SCPs to prevent creation, 3. Use AWS Config to detect and remediate unencrypted volumes.

Answer

Attach an IAM policy to all users to deny 'ec2:CreateVolume' without an encryption key.

Answer

Deploy a Lambda function that monitors for unencrypted volumes and deletes them automatically.

Answer

Require users to manually select an AWS KMS key for every volume they create.

Question 12

An organization uses AWS PrivateLink to connect VPCs. A security engineer wants to ensure that the interface VPC endpoint is only accessible from within the local VPC. How should the engineer configure the endpoint policy?

Accepted Answer

Attach an endpoint policy to the VPC endpoint allowing access only from specified IAM roles.. To restrict access to the local VPC using an endpoint policy, the policy must use the 'aws:SourceVpc' condition key. Option B focuses on IAM roles, which does not inherently restrict access to the local VPC. Option A is a valid network-level control, but the question asks how to configure the 'endpoint policy'. The correct approach is to use a policy with a condition that checks for the VPC ID.

Answer

Apply a Security Group to the VPC endpoint that restricts inbound traffic to the local VPC CIDR.

Answer

Modify the route table to deny traffic from outside the VPC to the endpoint.

Answer

Use a Network ACL to block all traffic to the VPC endpoint subnet except for the local VPC.

Question 13

An application is experiencing unauthorized access via an Elastic Load Balancer (ELB). The security team wants to restrict access so that only requests originating from a specific CloudFront distribution are accepted. How should this be implemented?

Accepted Answer

Add a rule to the ALB's Security Group to allow traffic only from CloudFront's public IP range.. While using WAF to check a custom header is a valid workaround, the standard, recommended AWS practice for restricting access to an ALB from CloudFront is to use Managed Prefix Lists in the ALB Security Group. AWS publishes the 'CLOUDFRONT_ORIGIN_FACING' prefix list, which is automatically updated. Option A is technically the correct architectural approach, but the provided option A text is slightly misleading by implying manual IP management. However, Option B is a common 'trap' answer because it introduces unnecessary complexity and cost (WAF) for a task that should be handled by Security Groups.

Answer

Use AWS WAF on the ALB to enforce a header check for a secret value passed by CloudFront.

Answer

Set up a Network ACL to permit only traffic arriving from CloudFront's edge locations.

Answer

Configure the ELB to only accept connections using an SSL certificate issued by CloudFront.

Question 14

A company is migrating to a multi-VPC architecture. To ensure secure cross-VPC communication, the company wants to use a Transit Gateway. What is the most appropriate configuration to minimize the risk of unauthorized lateral movement?

Accepted Answer

Use separate Transit Gateway route tables to isolate VPC traffic segments.. Segmenting VPCs using Transit Gateway route tables is the most effective way to control traffic flow. By creating separate route tables for different environments (e.g., prod vs. dev), you can enforce traffic isolation at the network level. This prevents direct communication between segments, effectively containing lateral movement and ensuring that traffic only travels along explicitly defined paths, which is critical for robust infrastructure security.

Answer

Enable Transit Gateway peering for all VPCs to ensure full connectivity.

Answer

Disable the default route table and rely on Network ACLs for isolation.

Answer

Attach all VPCs to the same route table and use Security Groups for filtering.

Question 15

An organization requires that their API Gateway instances only accept requests from a specific private VPC. Which strategy should be used to enforce this network-level constraint?

Accepted Answer

Configure the API Gateway with a resource policy that restricts access by 'aws:SourceVpce'.. To restrict access to a private VPC for an API Gateway, you use an API Gateway Resource Policy. The policy uses the 'aws:SourceVpce' condition key to allow traffic only from the specific VPC Endpoint ID. The explanation provided incorrectly focuses on VPC Endpoint policies rather than the API Gateway Resource Policy mentioned in the correct option.

Answer

Place the API Gateway in a private subnet and attach an Internet Gateway for internal traffic.

Answer

Use a Network ACL to block all IP addresses from the public internet to the API Gateway.

Answer

Set up a CloudFront distribution and point it to the API Gateway's public IP address.