SCS-C02 Practice Test 36 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy a multi-tier application. The security team requires that the database tier (RDS) be deployed in private subnets that are not directly routable from the application tier (EC2). The application tier must communicate with the database using an internal network path. Which solution meets these requirements?

Accepted Answer

Deploy the RDS instance in private subnets and use an RDS VPC Endpoint (Interface) in the application subnets. Option C (VPC Endpoint for RDS) is correct because it provides private connectivity without routing through subnets. Option A is wrong because direct routing would require routes. Option B is wrong because ClassicLink is legacy. Option D is wrong because a proxy is not needed.

Answer

Place the RDS instance in the same subnet as the application tier and use security groups

Answer

Use ClassicLink to connect the application tier to the RDS instance

Answer

Use a NAT Gateway in the application subnet to route traffic to the RDS instance

Question 2

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

Accepted Answer

AWS WAF. Option D (AWS WAF) is correct because it integrates with Shield Advanced for application layer DDoS mitigation. Option A (AWS Firewall Manager) is for managing rules. Option B (AWS Network Firewall) is for network layer. Option C (AWS GuardDuty) is for threat detection.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 3

A company wants to deploy a web application that must be accessible over HTTPS only. The application runs behind an Application Load Balancer (ALB). The security team wants to enforce HTTP Strict Transport Security (HSTS) to prevent downgrade attacks. Which configuration achieves this?

Accepted Answer

Configure the ALB to redirect HTTP traffic to HTTPS and have the application set the Strict-Transport-Security header in the response. Option C (Configure ALB to redirect HTTP to HTTPS and set the Strict-Transport-Security header) is correct. Option A is wrong because HSTS is a header, not a listener rule. Option B is wrong because HSTS is not a CloudFront feature. Option D is wrong because ALB can add custom headers.

Answer

Use AWS CloudFront with a custom header that enforces HSTS

Answer

Configure the ALB listener to use HTTPS only and set a custom header via a listener rule

Answer

Enable HSTS on the ALB via the AWS Management Console

Question 4

A company has an Amazon S3 bucket that stores sensitive data. The security team wants to ensure that all access to the bucket is made only via HTTPS. Which policy should be used?

Accepted Answer

Add a bucket policy that denies access when aws:SecureTransport is false.. Option D is correct because a bucket policy with a condition that denies access if aws:SecureTransport is false ensures HTTPS only. Option A is wrong because CloudFront does not enforce HTTPS for S3 origin. Option B is wrong because S3 does not have an HTTPS-only bucket policy setting; it requires a custom policy. Option C is wrong because a VPC endpoint does not enforce HTTPS.

Answer

Enable CloudFront with HTTPS-only viewer protocol policy.

Answer

Use a VPC endpoint for S3 with a bucket policy that restricts access to the VPC endpoint.

Answer

Enable 'Block public access' on the bucket.

Question 5

Refer to the exhibit. A security engineer runs the CLI command and receives the output shown. The engineer expects to see flow logs for a specific subnet, but the output shows the resource ID as a VPC. What is the most likely reason?

Accepted Answer

The flow log was created at the VPC level, not at the subnet level.. Option A is correct because the filter is by log group name, and the flow log created is for the entire VPC, not a subnet. The engineer may have created the flow log at the VPC level. Option B is wrong because the CLI command shows the flow log status as ACTIVE. Option C is wrong because the role is valid. Option D is wrong because the flow log is delivering to CloudWatch Logs, which is a valid destination.

Answer

The flow log is not active; it shows ACTIVE, so that's not the issue.

Answer

The flow log is configured to deliver to CloudWatch, but the log group name is incorrect.

Answer

The IAM role does not have permissions to deliver logs for subnets.

Question 6

A company uses an AWS Transit Gateway to connect multiple VPCs and on-premises networks. A security engineer needs to ensure that traffic between VPCs is inspected by a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Attach the firewall appliance to a dedicated inspection VPC and route traffic from other VPCs through the inspection VPC using transit gateway route tables.. The correct answer is D because by attaching the firewall appliance in a dedicated inspection VPC and using route tables to direct traffic through it, you can inspect inter-VPC traffic. Option A is wrong because security groups are instance-level firewalls and cannot inspect all traffic in a transit gateway. Option B is wrong because network ACLs are stateless and applied at subnet level, not at transit gateway level. Option C is wrong because VPC endpoints are for accessing AWS services privately, not for traffic inspection.

Answer

Configure security groups on the transit gateway to inspect traffic.

Answer

Create VPC endpoints for each VPC to route traffic through the firewall.

Answer

Use network ACLs on the transit gateway to filter traffic.

Question 7

A company has a VPC with multiple subnets. The security team wants to control traffic between subnets using a stateful firewall that can automatically allow return traffic. Which AWS service should be used?

Accepted Answer

Security groups. Option B is correct because security groups are stateful and can be used to control traffic between subnets when attached to ENIs. Option A is wrong because network ACLs are stateless. Option C is wrong because AWS WAF is for web traffic at the application layer. Option D is wrong because AWS Firewall Manager is a policy management service, not a firewall itself.

Answer

Network ACLs

Answer

AWS Firewall Manager

Answer

AWS WAF

Question 8

A company is designing a network architecture for a multi-tier web application. The application consists of a public-facing ALB, web servers in private subnets, and an RDS database in isolated subnets. The security team requires that the web servers have no direct internet access. Which VPC configuration meets this requirement?

Accepted Answer

Private subnets with a NAT Gateway in a public subnet.. Option B is correct because private subnets with a NAT Gateway allow outbound internet access for updates while preventing inbound internet traffic. Option A is wrong because public subnets have direct internet access. Option C is wrong because isolated subnets cannot access the internet even for updates. Option D is wrong because a VPN does not provide internet access.

Answer

Public subnets with an Internet Gateway.

Answer

Isolated subnets with no route to the internet.

Answer

Private subnets with a VPN connection to the corporate network.

Question 9

A company has deployed a multi-tier web application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The security team wants to ensure that the application servers cannot initiate outbound connections to the internet. What should the team do?

Accepted Answer

Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.. Option C is correct because a route table with only a local route and no internet gateway or NAT gateway prevents outbound internet traffic. Option A is wrong because security groups are stateful and allowing inbound traffic may inadvertently allow outbound responses. Option B is wrong because network ACLs are stateless and need explicit deny rules, but a route-based approach is simpler. Option D is wrong because an egress-only internet gateway is for IPv6, not IPv4.

Answer

Add a deny rule for all outbound traffic in the network ACL of the private subnet.

Answer

Modify the security group of the application servers to deny all outbound traffic.

Answer

Attach an egress-only internet gateway to the private subnet.

Question 10

Refer to the exhibit. The bucket policy allows access from a specific IP range and denies access over HTTP. A user from IP 198.51.100.5 makes a GET request over HTTPS. What will happen?

Accepted Answer

Denied because no explicit allow matches the request.. Option C is correct because the Allow statement requires the source IP to be in 203.0.113.0/24, but the user's IP is 198.51.100.5, so the Allow does not apply. The Deny statement only applies if aws:SecureTransport is false, but the request uses HTTPS, so Deny does not apply. The result is implicit deny (no explicit allow), so access is denied. Option A is wrong because the condition is not met. Option B is wrong because the Deny condition is not triggered. Option D is wrong because explicit deny would apply if the condition matched.

Answer

Denied because of the explicit Deny statement.

Answer

Allowed because the request is over HTTPS.

Answer

Allowed because the Deny condition is not satisfied.

Question 11

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which solution should be used?

Accepted Answer

Use AWS Firewall Manager to define security group policies and enforce them across accounts.. Option B is correct because AWS Firewall Manager allows centralized management of security group rules across accounts and resources. Option A is wrong because AWS Config can evaluate compliance but not enforce rules. Option C is wrong because Service Control Policies (SCPs) control permissions at the account level, not network rules. Option D is wrong because AWS Network Firewall is for network traffic inspection, not security group management.

Answer

Use AWS Organizations Service Control Policies to restrict security group modifications.

Answer

Use AWS Config rules to automatically remediate non-compliant security groups.

Answer

Use AWS Network Firewall to inspect traffic and block unauthorized connections.

Question 12

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to an S3 bucket. What does this policy allow?

Accepted Answer

Allows a role to describe, start, and stop EC2 instances in the account.. Option C is correct because the policy allows ec2:DescribeInstances, ec2:StartInstances, and ec2:StopInstances actions. The resource is '*', so all EC2 instances in the account are affected. Option A is wrong because the actions are not S3. Option B is wrong because the policy allows start and stop. Option D is wrong because the principal is a role, not all users.

Answer

Allows a role from another account to describe, start, and stop EC2 instances in the current account.

Answer

Allows all IAM users in the account to view EC2 instances.

Answer

Allows an IAM user to list and manage objects in the S3 bucket.

Question 13

Which TWO actions are valid ways to restrict access to an Amazon S3 bucket using a bucket policy? (Choose two.)

Accepted Answer

Use the aws:SourceIp condition key to allow access only from a specific IP range.. The correct answers are A and C. Option A is correct because you can use the aws:SourceIp condition key to restrict by IP address. Option C is correct because you can use the aws:Referer condition key to restrict by HTTP referer. Option B is wrong because aws:SourceVpce is for VPC endpoints, but it is used in bucket policies to restrict access to a specific VPC endpoint, not a VPC ID. Option D is wrong because IAM roles are not used directly in bucket policies; you use the IAM role's ARN with the aws:PrincipalArn condition, but not with kms:EncryptionContext. Option E is wrong because kms:EncryptionContext is used in KMS key policies, not S3 bucket policies.

Answer

Use the iam:RoleName condition key to allow access only from a specific IAM role.

Answer

Use the aws:SourceVpce condition key to allow access only from a specific VPC.

Answer

Use the kms:EncryptionContext condition key to require that objects are encrypted with a specific KMS key.

Question 14

A security engineer is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. Both instances have security groups that allow all traffic from each other's security group. However, traffic is still blocked. What is the most likely cause?

Accepted Answer

The network ACL for one or both subnets is blocking the traffic.. Option C is correct because network ACLs are stateless and must allow both inbound and outbound traffic for the connection. Even if security groups allow traffic, a network ACL can block it. Option A is wrong because route tables handle routing, not filtering. Option B is wrong because VPC flow logs only monitor traffic, not block it. Option D is wrong because the default VPC has a default network ACL that allows all traffic, but custom ACLs may have restrictive rules.

Answer

The instances are in different VPCs.

Answer

The route tables do not have a route between the subnets.

Answer

VPC Flow Logs are not enabled.

Question 15

A company wants to use AWS WAF to protect its web application from common web exploits. Which AWS service must be integrated with AWS WAF to provide this protection?

Accepted Answer

Application Load Balancer or Amazon CloudFront. Option B is correct because AWS WAF is integrated with CloudFront and ALB to filter requests. Option A is wrong because Network ACLs are stateless and not application-layer. Option C is wrong because Security Groups are stateful firewalls at the instance level. Option D is wrong because Route 53 is DNS, not a web traffic endpoint.

Answer

Security Groups

Answer

Amazon Route 53

Answer

Network ACLs