SCS-C02 Practice Test 38 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is configured to terminate SSL/TLS and forward traffic to the instances over HTTP. The security team wants to ensure that the instances only accept traffic from the ALB, not from any other source. How can this be achieved?

Accepted Answer

Configure the instance security group to allow HTTP traffic only from the ALB's security group.. Option C is correct because using the ALB's security group as the source in the instance security group ensures traffic only from the ALB. Option A is wrong because using the VPC CIDR would allow traffic from any resource in the VPC. Option B is wrong because using the subnet CIDR would allow traffic from any instance in that subnet. Option D is wrong because using a network ACL would affect all instances in the subnet and cannot differentiate by source.

Answer

Configure the instance security group to allow HTTP traffic only from the VPC CIDR block.

Answer

Configure the network ACL on the instance's subnet to allow HTTP traffic only from the ALB's private IP address.

Answer

Configure the instance security group to allow HTTP traffic only from the subnet CIDR block where the ALB resides.

Question 2

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group. Option C is correct because referencing the ALB security group as the source allows only traffic originating from the ALB, regardless of IP changes. Option A is wrong because a CIDR block is less dynamic and may not cover all ALB IPs. Option B is wrong because it allows all HTTP traffic from anywhere. Option D is wrong because the EC2 security group should not reference itself.

Answer

Allow inbound HTTP traffic from the EC2 instances' own security group

Answer

Allow inbound HTTP traffic from 0.0.0.0/0

Answer

Allow inbound HTTP traffic from the VPC CIDR block

Question 3

Which THREE of the following are best practices for securing an Amazon RDS database instance? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS. Options A, B, and E are correct because encryption at rest, private subnet, and strong passwords are security best practices. Option C is wrong because public accessibility should be disabled. Option D is wrong because default ports should be changed or firewalled, but this is not a primary best practice compared to the others.

Answer

Enable public accessibility for ease of management

Answer

Use the default database port

Question 4

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail.. Option B is correct because AWS CloudTrail records API calls, including changes to security group rules. Option A is wrong because CloudWatch Logs stores log data but does not record API calls. Option C is wrong because AWS Config records resource configuration changes but is not primarily for auditing API calls; CloudTrail is the correct service for API auditing. Option D is wrong because VPC Flow Logs captures network traffic, not configuration changes.

Answer

Amazon CloudWatch Logs.

Answer

VPC Flow Logs.

Answer

AWS Config.

Question 5

A company has a VPC with multiple subnets across multiple Availability Zones. The security team wants to inspect all traffic between subnets for malicious activity. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. Option D is correct because AWS Network Firewall can inspect traffic between subnets and provide intrusion prevention. Option A is wrong because VPC Flow Logs only provide metadata, not inspection. Option B is wrong because security groups are stateful firewalls but not for inspection. Option C is wrong because AWS WAF is for web application traffic, not for network-layer inspection.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Security groups

Question 6

A company is designing a multi-tier web application. The web servers must be accessible from the internet, but the application servers must only be accessible from the web servers. Which AWS feature should be used to meet these requirements?

Accepted Answer

Use security groups with rules that allow inbound traffic to the web servers from the internet, and allow inbound traffic to the application servers only from the web server security group.. The correct answer is B because security groups act as a virtual firewall for instances, and you can reference another security group as a source. Option A is wrong because a NACL is stateless and applied at the subnet level; it can be used but security groups are simpler for instance-level control. Option C is wrong because a VPC peering is for connecting VPCs. Option D is wrong because a VPN connection is for hybrid connectivity.

Answer

Use a VPC peering connection between the web tier and application tier subnets.

Answer

Use network ACLs to allow inbound traffic to the web tier from the internet and to the application tier only from the web tier.

Answer

Use a VPN connection to isolate the application tier from the web tier.

Question 7

A security engineer is designing a VPC with public and private subnets in two Availability Zones. The company requires that all outbound traffic from private subnets to the internet must go through a single, centrally managed NAT gateway. Which combination of resources and route table entries should be used?

Accepted Answer

A single NAT gateway in a public subnet, and a default route (0.0.0.0/0) in each private subnet route table pointing to that NAT gateway.. Option C is correct because placing a single NAT gateway in a public subnet and adding a default route to the NAT gateway in the private subnet route tables achieves the requirement. Option A is wrong because each private subnet needs its own route entry. Option B is wrong because using multiple NAT gateways defeats central management. Option D is wrong because NAT gateways cannot be placed in private subnets.

Answer

A single NAT gateway in a private subnet, and a default route in each private subnet pointing to the NAT gateway.

Answer

One NAT gateway per private subnet, each with a route to an internet gateway.

Answer

One NAT gateway per Availability Zone, with routes to the internet gateway.

Question 8

A company is using AWS Organizations to manage multiple accounts. The security team wants to restrict the use of specific instance types across all accounts. Which two AWS services can enforce this restriction? (Choose TWO.)

Accepted Answer

Service control policies (SCPs). Options B and D are correct. SCPs in AWS Organizations can deny specific instance types across all accounts. AWS Config rules can evaluate instance types and trigger remediation. Option A is wrong because IAM policies are per-account and cannot be applied across all accounts centrally. Option C is wrong because CloudTrail only logs. Option E is wrong because VPC flow logs monitor network traffic.

Answer

IAM policies

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 9

A company uses AWS Organizations and wants to restrict the use of specific instance types across all accounts. Which TWO actions should be taken to enforce this restriction?

Accepted Answer

Apply a Service Control Policy (SCP) that denies ec2:RunInstances with noncompliant instance types.. Options B and D are correct. SCPs can deny actions based on instance type, and AWS Config can detect noncompliant instances. Option A is wrong because IAM roles do not restrict resource types. Option C is wrong because CloudTrail does not enforce. Option E is wrong because VPC does not relate to instance types.

Answer

Restrict instance types at the VPC level using network ACLs.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Create an IAM role that denies launch of noncompliant instances.

Question 10

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

Accepted Answer

Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.. Option C is correct because adding a deny condition with a source IP that doesn't exist effectively blocks all access. Option A is wrong because deleting the role would affect other resources. Option B is wrong because modifying the bucket policy might be reverted if the role has permissions. Option D is wrong because blocking at the network layer does not prevent access from within AWS.

Answer

Delete the IAM role that is allowed access to the bucket.

Answer

Use AWS WAF to block the IP addresses of the compromised role.

Answer

Modify the bucket policy to deny all principals.

Question 11

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team suspects that a DDoS attack is targeting the application. Which AWS service can be used to absorb and mitigate the attack at the network layer before traffic reaches the ALB?

Accepted Answer

AWS Shield Advanced. Option C is correct because AWS Shield Advanced provides enhanced DDoS mitigation for ALB. Option A is wrong because IAM is for access management. Option B is wrong because WAF is for application layer. Option D is wrong because NACLs are stateless and not designed for DDoS mitigation.

Answer

AWS WAF

Answer

AWS Identity and Access Management (IAM)

Answer

Network ACLs

Question 12

A company is using AWS WAF to protect a web application. The security team notices that a specific IP address is generating a high volume of requests and triggering the WAF rate-based rule. However, the IP address is a legitimate partner's static IP. What should the security team do to allow this IP while still protecting against other malicious traffic?

Accepted Answer

Add a rule with an IP set condition that allows the partner's IP as an exception to the rate-based rule.. Option C is correct because adding a WAF IP set condition that allows the partner's IP as an exception to the rate-based rule ensures that legitimate traffic is not blocked while other traffic is still subject to the rule. Option A is wrong because whitelisting the IP in the web ACL would bypass all rules, not just the rate-based rule. Option B is wrong because increasing the rate limit would affect all traffic, potentially allowing malicious traffic. Option D is wrong because WAF rate-based rules cannot be disabled for a specific IP directly; an IP set condition is needed.

Answer

Create an IP set and whitelist the IP address in the web ACL default action.

Answer

Increase the rate limit for the rate-based rule to accommodate the partner's traffic.

Answer

Disable the rate-based rule for the partner's IP by modifying the rule scope.

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to inspect all traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Use Transit Gateway with appliance mode and route tables to direct traffic through a firewall appliance in a central VPC.. Centralized inspection using a Transit Gateway with appliance mode and appropriate route tables allows traffic to be forwarded to the firewall VPC for inspection. VPC peering does not support central inspection, and network ACLs are not suitable for inter-VPC traffic. Direct Connect alone does not provide inspection.

Answer

Set up AWS Direct Connect and route all traffic through the on-premises firewall.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Answer

Configure network ACLs in each VPC to block traffic unless it comes from the firewall.

Question 14

A security engineer is configuring a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which TWO security group configurations should be used? (Choose TWO.)

Accepted Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0 on the web tier security group.. Option A is correct because the web tier security group should allow HTTP/HTTPS from the internet. Option D is correct because the application tier security group should allow traffic from the web tier security group. Option B is wrong because the database tier should not allow traffic from the web tier. Option C is wrong because the web tier should not allow SSH from the internet. Option E is wrong because the database tier should not allow traffic from the internet.

Answer

Allow inbound SSH from 0.0.0.0/0 on the web tier security group.

Answer

Allow inbound HTTP/HTTPS from the web tier security group on the database tier security group.

Answer

Allow inbound HTTP/HTTPS from the internet on the database tier security group.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. A security engineer needs to ensure that all CloudFormation stacks use a specific AWS KMS key for encrypting resources that support encryption. Which approach should be used?

Accepted Answer

Use AWS CloudFormation StackSets with a service-managed permission model to deploy stacks from a centrally managed template that includes the KMS key.. The correct answer is D because AWS CloudFormation StackSets can be used with a service-managed permission model to centrally manage stacks across accounts and enforce policies. Option A is wrong because you cannot enforce encryption at the template level; users can modify templates. Option B is wrong because a service control policy (SCP) can deny actions, but CloudFormation does not have a direct condition key to enforce KMS key usage for all resources. Option C is wrong because while you can use a parameter, users can override it with a different key.

Answer

Use a CloudFormation template that includes the KMS key ID as a hardcoded value.

Answer

Use a CloudFormation parameter to accept the KMS key ID and validate it with a rule.

Answer

Use an AWS Organizations service control policy (SCP) to deny all CloudFormation actions unless a specific KMS key is used.