SCS-C02 Infrastructure Security Practice Questions

Question 1

A company is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application and database tiers must be isolated. The security team requires that all traffic between tiers be encrypted and that the application tier can only be accessed by the web tier. Which architecture should be used?

Accepted Answer

Place the web tier in a public subnet with an internet gateway, and the app and database tiers in private subnets. Use separate security groups for each tier, allowing only necessary traffic.. This architecture places the web tier in a public subnet with an Internet Gateway (IGW) for internet-facing access, while the application and database tiers reside in private subnets with no direct internet path. Separate security groups enforce least-privilege: the web tier security group allows inbound HTTP/HTTPS (ports 80/443) from 0.0.0.0/0, the app tier security group allows inbound traffic only from the web tier security group (using a security group reference), and the database tier security group allows inbound traffic only from the app tier security group. This enforces isolation and ensures that the application tier can only be accessed by the web tier. To satisfy the encryption requirement, you must explicitly implement encryption between tiers (e.g., TLS for web-to-app, and database-native encryption like TLS or AWS RDS encryption in transit).

Answer

Place all tiers in public subnets and use security groups to restrict traffic.

Answer

Place the web and app tiers in public subnets and the database in a private subnet.

Answer

Place all tiers in private subnets and use a single security group to allow traffic between them.

Question 2

Refer to the exhibit. A security engineer finds the above IAM policy attached to an IAM group. The policy is intended to allow all EC2 actions only from the corporate network (10.0.0.0/8). However, users report that they can perform EC2 actions from outside the corporate network. What is the MOST likely reason?

Accepted Answer

The IAM group has an additional policy that allows all EC2 actions without conditions.. The policy grants access to EC2 actions only when the source IP is in the 10.0.0.0/8 range. If a user attempts an action from outside that range, the condition is not met and the Allow statement does not apply. With no other applicable policies, the action would be denied. The fact that users can perform EC2 actions from outside the corporate network indicates that another policy is granting them access without IP restrictions. The `aws:SourceIp` condition key is available for both API and console requests; for console requests, it reflects the user's client IP. Therefore, if a user accesses from outside, the condition would not be satisfied, and the allow would not apply. So the most likely explanation is an additional IAM policy allowing all EC2 actions.

Answer

The policy allows access to all EC2 actions, but the condition only applies to the ec2:* actions, which includes all EC2 actions.

Answer

The aws:SourceIp condition key does not apply to API calls made through the AWS Management Console; the console uses AWS IP addresses.

Answer

The policy should use a NotIpAddress condition instead of IpAddress.

Question 3

Match each AWS Storage service encryption feature to its description.

Accepted Answer

SSE-S3: Encryption keys are managed by Amazon S3.. AWS storage services offer various encryption options. S3 SSE-S3 and SSE-KMS are server-side encryption methods with different key management approaches. Client-side encryption occurs before data upload. EBS encryption is transparent block-level encryption, and Glacier automatically encrypts data at rest.

Answer

EBS encryption: Encryption is applied at the application level.

Answer

Glacier encryption: Encryption is optional for data at rest.

Question 4

A company uses Network Load Balancer (NLB) in front of a fleet of EC2 instances in private subnets. Security team requires that the source IP addresses of clients be preserved in the access logs of the backend instances. Which configuration should the security engineer verify?

Accepted Answer

Configure proxy protocol v2 on the target group. Network Load Balancer (NLB) preserves the client source IP by default when forwarding traffic to targets in the same VPC. No special configuration is required. Proxy protocol v2 is an optional feature that adds a header with client IP and port, but it does not 'enable' source IP preservation. In fact, enabling proxy protocol v2 without backend application support would cause the source IP in TCP packets to be the NLB's IP, not the client's. None of the listed options are correct for ensuring source IP preservation in this scenario; the security engineer should verify that no explicit override is in place (there is no disable option).

Answer

Ensure the NLB is configured with a subnet from each Availability Zone and the targets are in the same subnets

Answer

Enable target group stickiness

Answer

Enable cross-zone load balancing on the NLB

Question 5

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. Option C (NAT Gateway in a public subnet) is correct because instances in private subnets can route outbound internet traffic through a NAT Gateway, which performs source NAT and allows responses to return while preventing unsolicited inbound connections from the internet. Option E (S3 Gateway Endpoint in the VPC) is correct because a gateway endpoint provides private, cost-free access to S3 within the same region via the AWS private network, avoiding the need to traverse the internet or a NAT Gateway for S3 traffic. Option A is incorrect because an S3 Interface Endpoint (powered by PrivateLink) is not the standard, cost-effective choice for same-region S3 access; the gateway endpoint is the intended solution for S3. Option B is incorrect because VPC Peering to a shared services VPC does not by itself provide internet egress or S3 access for this scenario. Option D is incorrect because an Internet Gateway alone would require the application subnets to be public and would not block inbound internet traffic; the requirement is outbound-only access from private subnets.

Answer

S3 Interface Endpoint in the VPC

Answer

VPC Peering to a shared services VPC

Answer

Internet Gateway attached to the VPC

Question 6

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

Accepted Answer

The NAT Gateway's security group is blocking outbound traffic to the internet. The NAT Gateway's security group must allow outbound traffic to the internet for the patches to be retrieved. Even though the NAT Gateway allows inbound HTTPS from the private subnet, it also needs an outbound rule permitting HTTPS traffic to 0.0.0.0/0 so that response packets from the internet can flow back through the NAT Gateway to the instance. Without this outbound rule, the NAT Gateway drops the return traffic, preventing the download.

Answer

The network ACL for the private subnet is blocking outbound traffic

Answer

The private subnet route table does not have a route to the NAT Gateway

Answer

The security group attached to the EC2 instance is blocking inbound traffic

Question 7

A company is using AWS CloudFormation to deploy a multi-tier application. The security team requires that the database tier (RDS) be deployed in private subnets that are not directly routable from the application tier (EC2). The application tier must communicate with the database using an internal network path. Which solution meets these requirements?

Accepted Answer

Deploy the RDS instance in private subnets and use an RDS VPC Endpoint (Interface) in the application subnets. None of the provided options correctly meet the requirement. Option D is incorrect because RDS VPC Interface Endpoints are for the RDS API, not for database connections (e.g., MySQL, PostgreSQL). They do not allow EC2 instances to connect to the RDS database engine. The correct solution would involve VPC peering or Transit Gateway to connect the application VPC to the database VPC, ensuring private network path without direct routing. Options A, B, and C are also invalid: A places the database in the same subnet violating the requirement, B (ClassicLink) is deprecated and not applicable, and C (NAT Gateway) provides outbound internet access only.

Answer

Place the RDS instance in the same subnet as the application tier and use security groups

Answer

Use ClassicLink to connect the application tier to the RDS instance

Answer

Use a NAT Gateway in the application subnet to route traffic to the RDS instance

Question 8

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Accepted Answer

Create an S3 Gateway Endpoint in the VPC. Option A is correct because an S3 Gateway Endpoint is a VPC endpoint that provides private connectivity to Amazon S3 by adding a prefix-list route to the route table, so traffic from the private subnet reaches S3 without traversing the internet. Option B is correct because attaching a VPC Endpoint Policy to the Gateway Endpoint lets the security team restrict access to the specific S3 bucket, enforcing least privilege while keeping the traffic private. Option C is incorrect because an Internet Gateway enables internet connectivity and would not keep S3 traffic off the internet. Option D is incorrect because S3 uses a Gateway Endpoint, not an Interface Endpoint (Interface Endpoints are for services like KMS, Secrets Manager, and other AWS services via PrivateLink). Option E is incorrect because a NAT Gateway routes traffic to the internet, which violates the requirement that traffic must not traverse the internet.

Answer

Attach an Internet Gateway to the VPC

Answer

Create an S3 Interface Endpoint in the VPC

Answer

Use a NAT Gateway to route the traffic to the internet

Question 9

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are encrypted at rest and that access to the logs is controlled. Which actions should be taken? (Choose two.)

Accepted Answer

Enable default encryption on the S3 bucket where CloudTrail logs are stored. Option B is correct because enabling default encryption (SSE-S3 or SSE-KMS) on the S3 bucket that receives CloudTrail logs ensures all delivered log objects are encrypted at rest automatically. Option C is correct because an S3 bucket policy is the mechanism that enforces access control on the log bucket, restricting GetObject/PutObject and similar actions to authorized IAM principals and services. Option A is incorrect here because log file validation only provides integrity checking via digest files, not encryption or access control. Option D is incorrect as stated because CloudTrail log file encryption is configured through S3 bucket encryption (SSE-KMS), not by directly invoking KMS on the trail. Option E is incorrect because CloudWatch Logs is a separate delivery target and does not satisfy the requirement to encrypt the CloudTrail logs stored in S3.

Answer

Enable CloudTrail log file validation

Answer

Use AWS KMS to encrypt the CloudTrail log files

Answer

Store logs in Amazon CloudWatch Logs with encryption enabled

Question 10

A security engineer is designing a VPC with private subnets for an application that must access the internet for software updates. The VPC has a NAT gateway in a public subnet. The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT gateway. Which additional security measure should be implemented to ensure that only the application instances can use the NAT gateway, and not any other resources in the VPC?

Accepted Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the NAT gateway's private IP address.. A network ACL (NACL) on the private subnet restricts outbound traffic from that subnet to only the NAT gateway's private IP address. This ensures that instances in the private subnet (the application instances) can only reach the internet via the NAT gateway. However, this does not by itself block resources in other subnets from using the NAT gateway; those subnets are prevented from using it because they do not have a route to the NAT gateway in their route tables. The NACL adds a defense-in-depth layer by restricting the destination of outbound traffic from the application subnet.

Answer

Enable VPC Flow Logs on the NAT gateway to detect unauthorized usage.

Answer

Create an IAM policy that allows only the application instances to use the NAT gateway.

Answer

Configure a security group for the NAT gateway that allows only the application instances' security group as source.

Infrastructure Security

SCS-C02 Infrastructure Security — Key Topics

Where candidates lose marks on Infrastructure Security