SCS-C03 Infrastructure Security — Timed 20 Questions

Question 1

A security engineer must monitor and record all rejected TCP connection attempts to a fleet of EC2 instances within a private subnet. The logs must be stored in a durable manner for three years to meet regulatory compliance. Which solution meets these requirements with the least operational overhead?

20 minute time limit — choose an answer to begin.

Accepted Answer

Enable VPC Flow Logs and configure the destination as an Amazon S3 bucket.. VPC Flow Logs must be specifically configured to capture 'REJECT' traffic (or 'ALL' traffic) to meet the requirement. Simply enabling Flow Logs is insufficient if the default 'ACCEPT' setting is used. The explanation should clarify that the log configuration must include the REJECT action.

Answer

Install the CloudWatch Logs agent on all instances to capture local kernel network logs.

Answer

Enable Amazon GuardDuty and review the 'UnauthorizedAccess:EC2/SSHBruteForce' findings.

Answer

Configure an AWS Config rule to monitor the state of all Security Group rules daily.

Question 2

A company uses an Application Load Balancer (ALB) to route traffic to EC2 instances. A security engineer needs to ensure that only traffic originating from a specific Amazon CloudFront distribution can reach the ALB. What is the most secure way to implement this restriction?

Accepted Answer

Use a Lambda@Edge function to sign all requests with an AWS Signature Version 4.. AWS supports SigV4 for requests from CloudFront to an Application Load Balancer. By configuring CloudFront to sign requests using AWS Signature Version 4 (SigV4), the ALB can natively authenticate that the traffic originates from the specified CloudFront distribution, without requiring custom header management or reliance on frequently changing IP ranges. While custom headers (Option C) were historically common, SigV4 is the most secure and modern native method for ALB origins.

Answer

Add the CloudFront IP ranges to the ALB's Security Group inbound rules.

Answer

Configure CloudFront to use an Origin Access Control (OAC) with the ALB as the target.

Answer

Configure the ALB to only accept traffic containing a custom header set by CloudFront.

Question 3

A financial services company is concerned about large-scale DDoS attacks affecting its public-facing DNS and web applications. Which TWO AWS services or features provide automatic protection or mitigation against Layer 3, Layer 4, and Layer 7 DDoS attacks? (Select TWO.)

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides managed protection for L3/L4 and L7 attacks. AWS WAF is specifically designed for L7 (application layer) protection. While they are often used together, AWS WAF does not provide L3/L4 protection. The question asks for services that provide protection against L3, L4, AND L7. Shield Advanced covers all three, while WAF covers L7. The combination is the correct answer, but the explanation should clarify that WAF is specifically for L7.

Answer

AWS Global Accelerator

Answer

Amazon Inspector

Answer

VPC Reachability Analyzer

Question 4

A security engineer is tasked with restricting access to Amazon S3 and Amazon DynamoDB so that traffic never leaves the AWS private network. Which TWO types of VPC endpoints should be used to achieve this for these specific services? (Select TWO.)

Accepted Answer

Gateway Endpoint for Amazon S3. While Gateway endpoints are the traditional and cost-effective way to access S3 and DynamoDB, both services now support Interface endpoints (AWS PrivateLink). The explanation incorrectly states that DynamoDB only supports Gateway endpoints, which is false. Furthermore, the stem asks for the two types of endpoints that ensure traffic never leaves the AWS private network; while both types achieve this, Gateway endpoints are the standard architectural recommendation for these specific services to avoid NAT Gateway costs.

Answer

Interface Endpoint for Amazon DynamoDB

Answer

Interface Endpoint for Amazon S3

Answer

Service Endpoint for Amazon Route 53

Question 5

A security engineer wants to ensure that all EC2 instances are launched only with approved, encrypted AMIs and that any instance with an unencrypted volume is automatically flagged. Which service is best suited for this continuous compliance monitoring?

Accepted Answer

AWS Config. AWS Config is the correct service for continuous compliance. The explanation should explicitly mention that AWS Config can evaluate EC2 instance configurations against custom or managed rules to verify that the AMI ID matches an approved list and that EBS volumes are encrypted.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Security Hub

Question 6

An organization is using AWS Direct Connect to link their on-premises data center to their AWS VPC. They have a strict requirement that all data in transit over the Direct Connect link must be encrypted at the network layer. Which solution should they implement?

Accepted Answer

Enable MACsec encryption on the Direct Connect connection.. Both MACsec (IEEE 802.1AE) and IPsec (via Site-to-Site VPN) provide network-layer encryption. MACsec provides Layer 2 encryption for Direct Connect Dedicated Connections (10 Gbps or 100 Gbps), while IPsec provides Layer 3 encryption. Since the question asks for network-layer encryption without specifying the OSI layer or connection type, both are technically correct, but MACsec is often preferred for high-throughput, low-latency requirements on supported hardware.

Answer

Use TLS/SSL for all application-level communication over the link.

Answer

Configure a Transit Gateway with VPC Peering and enable default encryption.

Question 7

An enterprise organization runs critical databases in Amazon RDS within a private VPC. Compliance mandates that traffic traversing between the application servers and the database must be encrypted in transit using strict mutual TLS authentication and strong cipher suites. Which configuration should the security engineer implement?

Accepted Answer

Configure the RDS parameter group to enforce TLS, download the AWS root certificates onto application servers, and require SSL connections.. Standard RDS SSL/TLS configuration (Option B) only authenticates the server to the client. Mutual TLS (mTLS) requires the database to also verify the client's certificate. RDS does not natively support mTLS for standard database connections; this typically requires an intermediate proxy like AWS PrivateLink or an application-level proxy (e.g., Envoy/Istio) to handle the client certificate validation.

Answer

Enable transparent data encryption on the RDS instance and configure security groups to restrict traffic exclusively to application server IP addresses.

Answer

Implement AWS Shield Advanced on the database subnet to automatically encrypt all database packets traversing the internal VPC network interfaces.

Answer

Deploy a Network Load Balancer in front of the database and configure TLS termination listeners with self-signed cryptographic certificates.

Question 8

A security engineer must restrict access to an Amazon S3 bucket so that only requests originating from a specific VPC are permitted. Which policy approach should be implemented to ensure this constraint is enforced effectively?

Accepted Answer

Attach a bucket policy that denies all 's3:*' actions if the 'aws:SourceVpce' does not match the required VPC endpoint ID.. A bucket policy that denies access if the 'aws:SourceVpce' does not match will inadvertently deny all requests, including those from the VPC endpoint itself, because the condition evaluates to true for any request not originating from that specific endpoint. To correctly restrict access, the policy must use a 'Deny' effect with a 'StringNotEquals' condition on 'aws:SourceVpce', or more commonly, an 'Allow' effect with a 'StringEquals' condition. Furthermore, the explanation should clarify that 'aws:SourceVpce' is the correct key for VPC Endpoints.

Answer

Apply an IAM policy to all users that denies access to the bucket if the source IP is outside the VPC range.

Answer

Enable S3 Block Public Access at the bucket level and attach an ACL that restricts access to the VPC.

Answer

Configure a Security Group on the S3 bucket to allow traffic only from the VPC CIDR block.

Question 9

A company requires all traffic between two EC2 instances in different subnets to be encrypted in transit. Which solution provides the most secure and scalable way to achieve this at the infrastructure level?

Accepted Answer

Configure a Site-to-Site VPN tunnel between the two VPC subnets.. Option C specifies implementing TLS/SSL at the application layer, which contradicts the stem's requirement for a scalable infrastructure-level solution without modifying application code. Network-layer encryption solutions like Amazon VPC Traffic Mirroring combined with MACsec (where supported on Nitro instances), or IPsec tunnels/AWS PrivateLink, should be used for infrastructure-level encryption.

Answer

Use VPC Flow Logs to monitor and encrypt traffic between instances.

Answer

Implement TLS/SSL at the application layer for all inter-instance communication.

Answer

Enable Amazon S3 bucket encryption using a KMS customer-managed key.

Question 10

Which service should be used to protect a web application hosted on an Application Load Balancer from Layer 7 DDoS attacks and common web exploits like SQL injection?

Accepted Answer

AWS Shield Advanced. While AWS WAF protects against common web exploits like SQL injection, AWS Shield Advanced is the service specifically designed for comprehensive protection against Layer 7 DDoS attacks (along with integration with AWS WAF for custom rules). For an explicit question mentioning Layer 7 DDoS attacks and web exploits on an ALB, AWS Shield Advanced is the complete answer because it incorporates AWS WAF functionality while providing dedicated DDoS mitigation capabilities.

Answer

AWS WAF

Answer

Network ACLs

Answer

Security Groups

Question 11

A security auditor requires that all EBS volumes in an AWS account be encrypted. Which THREE actions should the security team perform to enforce this requirement effectively across the organization?

Accepted Answer

Enable the 'Encrypt all EBS volumes' setting in the EC2 console for every region.. To enforce EBS encryption effectively across an organization, you should enable 'Encrypt all EBS volumes' by default in each region (Option A) and use Service Control Policies (SCPs) to deny the creation of unencrypted volumes (Option B). Option D suggests deleting volumes automatically via Lambda, which is destructive and not a recommended best practice for initial enforcement. Option C is impractical and difficult to manage at scale. Therefore, the three best actions would typically include automated remediation rather than destructive deletion, but since we need three actions, let's look at the standard AWS security pattern: 1. Enable EBS encryption by default, 2. Use SCPs to prevent creation, 3. Use AWS Config to detect and remediate unencrypted volumes.

Answer

Attach an IAM policy to all users to deny 'ec2:CreateVolume' without an encryption key.

Answer

Deploy a Lambda function that monitors for unencrypted volumes and deletes them automatically.

Answer

Require users to manually select an AWS KMS key for every volume they create.

Question 12

An organization uses AWS PrivateLink to connect VPCs. A security engineer wants to ensure that the interface VPC endpoint is only accessible from within the local VPC. How should the engineer configure the endpoint policy?

Accepted Answer

Attach an endpoint policy to the VPC endpoint allowing access only from specified IAM roles.. To restrict access to the local VPC using an endpoint policy, the policy must use the 'aws:SourceVpc' condition key. Option B focuses on IAM roles, which does not inherently restrict access to the local VPC. Option A is a valid network-level control, but the question asks how to configure the 'endpoint policy'. The correct approach is to use a policy with a condition that checks for the VPC ID.

Answer

Apply a Security Group to the VPC endpoint that restricts inbound traffic to the local VPC CIDR.

Answer

Modify the route table to deny traffic from outside the VPC to the endpoint.

Answer

Use a Network ACL to block all traffic to the VPC endpoint subnet except for the local VPC.

Question 13

An application is experiencing unauthorized access via an Elastic Load Balancer (ELB). The security team wants to restrict access so that only requests originating from a specific CloudFront distribution are accepted. How should this be implemented?

Accepted Answer

Add a rule to the ALB's Security Group to allow traffic only from CloudFront's public IP range.. While using WAF to check a custom header is a valid workaround, the standard, recommended AWS practice for restricting access to an ALB from CloudFront is to use Managed Prefix Lists in the ALB Security Group. AWS publishes the 'CLOUDFRONT_ORIGIN_FACING' prefix list, which is automatically updated. Option A is technically the correct architectural approach, but the provided option A text is slightly misleading by implying manual IP management. However, Option B is a common 'trap' answer because it introduces unnecessary complexity and cost (WAF) for a task that should be handled by Security Groups.

Answer

Use AWS WAF on the ALB to enforce a header check for a secret value passed by CloudFront.

Answer

Set up a Network ACL to permit only traffic arriving from CloudFront's edge locations.

Answer

Configure the ELB to only accept connections using an SSL certificate issued by CloudFront.

Question 14

A company is migrating to a multi-VPC architecture. To ensure secure cross-VPC communication, the company wants to use a Transit Gateway. What is the most appropriate configuration to minimize the risk of unauthorized lateral movement?

Accepted Answer

Use separate Transit Gateway route tables to isolate VPC traffic segments.. Segmenting VPCs using Transit Gateway route tables is the most effective way to control traffic flow. By creating separate route tables for different environments (e.g., prod vs. dev), you can enforce traffic isolation at the network level. This prevents direct communication between segments, effectively containing lateral movement and ensuring that traffic only travels along explicitly defined paths, which is critical for robust infrastructure security.

Answer

Enable Transit Gateway peering for all VPCs to ensure full connectivity.

Answer

Disable the default route table and rely on Network ACLs for isolation.

Answer

Attach all VPCs to the same route table and use Security Groups for filtering.

Question 15

An organization requires that their API Gateway instances only accept requests from a specific private VPC. Which strategy should be used to enforce this network-level constraint?

Accepted Answer

Configure the API Gateway with a resource policy that restricts access by 'aws:SourceVpce'.. To restrict access to a private VPC for an API Gateway, you use an API Gateway Resource Policy. The policy uses the 'aws:SourceVpce' condition key to allow traffic only from the specific VPC Endpoint ID. The explanation provided incorrectly focuses on VPC Endpoint policies rather than the API Gateway Resource Policy mentioned in the correct option.

Answer

Place the API Gateway in a private subnet and attach an Internet Gateway for internal traffic.

Answer

Use a Network ACL to block all IP addresses from the public internet to the API Gateway.

Answer

Set up a CloudFront distribution and point it to the API Gateway's public IP address.

Question 16

A security auditor discovers that an S3 bucket is accessible to anyone with the account ID. What is the most likely cause of this configuration, and how should it be remediated?

Accepted Answer

The bucket policy allows 's3:ListBucket' to the 'AWS' principal, which is a reserved keyword.. The stem describes a scenario where access is granted to anyone with the account ID (often implying a misconfigured bucket policy with a wildcard principal or an overly broad condition), whereas the option focuses on public ACLs. Furthermore, IAM policies cannot be attached directly to S3 buckets (Option C is technically impossible). The explanation mentions 'S3 Block Public Access' which is the correct remediation for public access, but the stem's premise of 'anyone with the account ID' is distinct from 'public' access.

Answer

The bucket has an ACL allowing the 'Everyone' group, which should be replaced by a private bucket policy.

Answer

The bucket has an IAM policy attached directly to the bucket resource.

Answer

The VPC endpoint for S3 is allowing cross-account access by default.

Question 17

A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The security team must ensure that the website is only accessible to users in specific European countries and that users cannot bypass CloudFront to access the S3 bucket directly. Which configuration fulfills these requirements most securely?

Accepted Answer

Enable CloudFront geographic restriction and configure the S3 bucket policy to allow access only from the CloudFront service principal using Origin Access Control.. CloudFront geographic restrictions are a native feature of the distribution configuration. While WAF can also perform geo-blocking, Option B correctly identifies the native CloudFront geo-restriction feature and the use of Origin Access Control (OAC) to secure the S3 bucket, which is the standard and most secure implementation for this scenario.

Answer

Configure S3 bucket policies to allow access only from the IP ranges of the permitted countries and use Origin Access Identity.

Answer

Use AWS WAF on the S3 bucket to block non-European traffic and implement a VPC Endpoint for S3 to restrict access to CloudFront nodes.

Answer

Implement a Lambda@Edge function to check the viewer's IP address against a geo-database and use a signed URL strategy for all S3 objects.

Question 18

A company is evaluating AWS Shield to protect its public-facing web applications from Distributed Denial of Service (DDoS) attacks. Which TWO features are provided exclusively by AWS Shield Advanced that are not available in the Standard tier?

Accepted Answer

24x7 access to the AWS Shield Response Team (SRT) for manual mitigation during an active attack.. AWS Shield Standard provides automatic protection against common Layer 3 and 4 attacks. AWS Shield Advanced adds exclusive features including 24/7 access to the AWS Shield Response Team (SRT) and the ability to use AWS WAF at no additional cost for protected resources. The explanation should explicitly mention these two differentiators to justify the correct options.

Answer

Automatic mitigation of common infrastructure Layer 3 and Layer 4 DDoS attacks.

Answer

Inline mitigation using AWS global edge locations to reduce latency for legitimate users.

Answer

Real-time visibility into DDoS events via the AWS Management Console and CloudWatch metrics.

Question 19

Refer to the exhibit. A security engineer is configuring VPC Traffic Mirroring to inspect traffic for an application server. Based on the provided Traffic Mirror Filter configuration, what traffic will be mirrored to the target?

Accepted Answer

Only inbound HTTPS traffic from any source to the 10.0.1.0/24 destination subnet.. Traffic Mirroring filters define traffic based on the direction relative to the source network interface. If the filter rule is set to 'ingress', it captures traffic entering the network interface. If the destination CIDR is 10.0.1.0/24, it refers to the destination IP of the packet. Option B correctly identifies this as inbound traffic to that subnet.

Answer

All inbound and outbound TCP traffic on port 443 for the specified network interface.

Answer

All inbound traffic regardless of protocol, as long as it originates from 0.0.0.0/0.

Answer

Outbound traffic from the 10.0.1.0/24 subnet to any destination on TCP port 443.

Question 20

A large organization needs to connect its on-premises data center to 50 different VPCs across multiple AWS accounts. The solution must support encrypted transit, centralize outbound internet traffic through a security VPC for inspection, and minimize the number of VPN connections. Which TWO components are essential to this architecture?

Accepted Answer

AWS Transit Gateway to interconnect VPCs and the on-premises environment.. AWS Transit Gateway acts as a central hub, simplifying the management of multiple VPC connections. A Site-to-Site VPN attached to the Transit Gateway provides the required encrypted transit for on-premises connectivity. This hub-and-spoke model allows for centralized inspection of outbound traffic via a security VPC, meeting all requirements.

Answer

VPC Peering between all 50 VPCs and a centralized shared services VPC.

Answer

A separate Virtual Private Gateway (VGW) for each of the 50 VPCs.

Answer

AWS Direct Connect with a Public Virtual Interface for encrypted data transfer.