SCS-C02 Practice Test 39 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. The public subnet hosts a NAT instance (Amazon Linux) that provides internet access to instances in the private subnet. The security team notices that the NAT instance is receiving high inbound traffic on port 22 from an external IP address. The team wants to block this traffic at the network layer without affecting other traffic. What is the most effective solution?

Accepted Answer

Add a network ACL rule on the public subnet to deny inbound traffic from the specific IP on port 22.. Option D is correct because a network ACL on the public subnet can explicitly deny inbound SSH from the specific IP address while allowing all other traffic. Option A is wrong because modifying the security group of the NAT instance to deny the IP would require a deny rule, but security groups only support allow rules; blocking SSH from all sources would prevent legitimate access. Option B is wrong because moving the NAT instance to a private subnet would break internet connectivity. Option C is wrong because AWS WAF is for web application layer (HTTP/HTTPS), not SSH.

Answer

Move the NAT instance to a private subnet and use a NAT gateway instead.

Answer

Modify the security group attached to the NAT instance to block inbound SSH from the specific IP.

Answer

Use AWS WAF to block the IP address.

Question 2

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Use an HTTPS listener on the ALB and configure the target group with HTTPS.. Option D is correct because HTTPS listeners on the ALB terminate the client's TLS connection and establish a new TLS connection to the target group, ensuring encryption. Option A is wrong because HTTP does not encrypt traffic. Option B is wrong because security group rules do not enforce encryption. Option C is wrong because TCP listeners do not provide encryption.

Answer

Use a TCP listener on the ALB and a TCP target group.

Answer

Configure security group inbound rules to allow only HTTPS traffic.

Answer

Use an HTTP listener on the ALB and HTTP on the target group.

Question 3

A security engineer is designing a secure VPC architecture for a web application that must be accessible from the internet. The application runs on EC2 instances in private subnets. Which THREE components are required to provide secure internet connectivity?

Accepted Answer

Public subnets with routes to the IGW. Options A, C, and D are correct. An Internet Gateway is needed for public subnets, a NAT Gateway in a public subnet provides outbound access for private instances, and public subnets host the NAT Gateway and potentially an ALB. Option B is wrong because a Virtual Private Gateway is for VPN connections. Option E is wrong because a Transit Gateway is not required.

Answer

Virtual Private Gateway (VGW)

Answer

Transit Gateway

Question 4

A company wants to allow a developer to launch EC2 instances only in a specific subnet. The developer should not be able to use any other subnet. Which IAM policy action should be used to enforce this?

Accepted Answer

ec2:RunInstances. Option A is correct because 'ec2:RunInstances' is the action for launching instances, and a condition on 'ec2:Subnet' can restrict the subnet. Option B is wrong because 'ec2:CreateTags' is for tagging. Option C is wrong because 'ec2:DescribeSubnets' is read-only. Option D is wrong because 'ec2:ModifySubnetAttribute' is for modifying subnets.

Answer

ec2:ModifySubnetAttribute

Answer

ec2:CreateTags

Answer

ec2:DescribeSubnets

Question 5

A company wants to allow an EC2 instance in a VPC to download patches from the internet but block all other outbound traffic. Which configuration should be used?

Accepted Answer

Place a NAT Gateway in a public subnet and route the EC2 instance's traffic through it. Option A is correct because a NAT Gateway in a public subnet allows outbound internet access while blocking inbound. Option B is wrong because an Internet Gateway directly attached would allow bidirectional traffic. Option C is wrong because a VPN does not provide internet access. Option D is wrong because VPC Peering does not provide internet access.

Answer

Use a Virtual Private Gateway and connect to a VPN

Answer

Attach an Internet Gateway and add a route 0.0.0.0/0 to the EC2 instance's route table

Answer

Use a VPC Peering connection to an external VPC with internet access

Question 6

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

Accepted Answer

Inbound rule: Allow HTTP/HTTPS from the ALB's security group.. Option A is correct because allowing inbound traffic from the ALB's security group ensures only ALB traffic reaches the instances. Option D is correct because blocking all outbound traffic to 0.0.0.0/0 prevents instances from initiating internet connections. Option B is wrong because allowing inbound from 0.0.0.0/0 would permit direct access to instances. Option C is wrong because allowing outbound to 0.0.0.0/0 would allow internet connections. Option E is wrong because allowing outbound only to the ALB does not prevent instances from reaching the internet via other paths.

Answer

Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.

Answer

Outbound rule: Allow all traffic to the ALB's security group only.

Answer

Outbound rule: Allow all traffic to 0.0.0.0/0.

Question 7

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Accepted Answer

Enable MACsec on the Direct Connect connection.. Option A is correct because IPsec VPN can be established over the private VIF to encrypt traffic. Option B is correct because MACsec can be enabled at the physical layer for encryption. Option C is wrong because SSL/TLS is application-level encryption, not for the link. Option D is wrong because AWS KMS does not encrypt network traffic. Option E is wrong because AWS Certificate Manager does not encrypt traffic.

Answer

Use AWS KMS to encrypt the traffic.

Answer

Use AWS Certificate Manager to issue certificates for the connection.

Answer

Use SSL/TLS to encrypt the traffic between on-premises and AWS.

Question 8

A company wants to audit all API calls made to Amazon S3 within a specific AWS account. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs.. The correct answer is C because AWS CloudTrail logs API calls, and Amazon CloudWatch Logs can be used to store and monitor those logs. Option A is wrong because Amazon Inspector is a vulnerability assessment service, not an audit logging service. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service; it does not log API calls.

Answer

Amazon Inspector and Amazon CloudWatch Logs.

Answer

Amazon GuardDuty and Amazon CloudWatch Logs.

Answer

AWS Config and Amazon CloudWatch Logs.

Question 9

A company is using AWS CloudFormation to deploy a web application. The template includes an EC2 instance with a security group that allows inbound HTTP traffic from 0.0.0.0/0. The security team wants to ensure that this security group is never used in production. Which AWS service can automatically remediate this noncompliant configuration?

Accepted Answer

AWS Config. Option D is correct because AWS Config can evaluate rules and trigger auto-remediation via Systems Manager Automation or Lambda. Option A is wrong because IAM is for access control, not resource configuration. Option B is wrong because CloudTrail logs API calls but does not remediate. Option C is wrong because GuardDuty is a threat detection service, not configuration compliance.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 10

A security engineer needs to ensure that an EC2 instance can only be launched using an approved Amazon Machine Image (AMI) from a specific AWS account. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Service Catalog. Option A is correct because AWS Service Catalog allows organizations to create and manage a catalog of approved products, including EC2 instances with specific AMIs. Option B is wrong because AWS Config can detect noncompliant instances but does not prevent launch. Option C is wrong because IAM policies can restrict actions but not specific AMIs. Option D is wrong because EC2 Image Builder builds images but does not enforce their use.

Answer

IAM policies

Answer

AWS Config

Answer

AWS Image Builder

Question 11

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Accepted Answer

AWS WAF. Options B and C are correct. AWS WAF provides application-layer protection (e.g., SQL injection), and Security Groups act as a virtual firewall for network-layer protection. Option A is wrong because NACLs are network-layer but stateless and less granular. Option D is wrong because GuardDuty is a threat detection service, not a prevention firewall. Option E is wrong because Shield Advanced provides DDoS protection but is not a firewall.

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 12

A security engineer is designing a VPC with public and private subnets. The private subnets must be able to download software updates from the internet. Which TWO components can provide this functionality without exposing the private instances to inbound internet traffic?

Accepted Answer

NAT gateway. Option A (NAT gateway) and Option C (NAT instance) are correct because they allow outbound traffic to the internet and block unsolicited inbound traffic. Option B is wrong because an internet gateway allows bidirectional traffic. Option D (egress-only internet gateway) is for IPv6. Option E (VPC endpoint) is for AWS services, not general internet.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Egress-only internet gateway

Question 13

A company has a security group that allows inbound SSH from a specific IP range. A security engineer notices that the security group rule is not being applied to a newly launched EC2 instance. What is the most likely cause?

Accepted Answer

The new EC2 instance was not launched with the correct security group. Option B is correct because security groups are attached at the instance level; a new instance must have the security group assigned. Option A is wrong because security groups are stateful. Option C is wrong because NACLs are subnet-level, not instance-level. Option D is wrong because the default security group does not automatically include custom rules.

Answer

The security group is using the default VPC security group

Answer

The security group is configured as stateless

Answer

The network ACL is blocking SSH traffic to the subnet

Question 14

A company wants to restrict access to an Amazon S3 bucket so that only users from a specific AWS account can upload objects. Which policy mechanism should be used?

Accepted Answer

Create a bucket policy with a condition that checks the aws:SourceAccount condition key.. Option D is correct because a bucket policy with a condition that checks the aws:SourceAccount condition key ensures that only requests originating from the specified account are allowed. Option A is wrong because IAM policies are attached to users/groups/roles, not to the bucket itself. Option B is wrong because S3 access control lists (ACLs) can grant access to other AWS accounts but do not support condition keys to restrict based on source account. Option C is wrong because a pre-signed URL grants time-limited access but does not restrict to a specific account.

Answer

Attach an IAM policy to the bucket that denies access to all users except those from the allowed account.

Answer

Generate a pre-signed URL for each upload request.

Answer

Configure the bucket ACL to grant access only to the allowed account's canonical user ID.

Question 15

A company has an Amazon S3 bucket that stores sensitive data. The security team needs to ensure that all access to the bucket is encrypted in transit. Which condition should be added to the bucket policy?

Accepted Answer

aws:SecureTransport. Option B is correct because the condition aws:SecureTransport checks whether the request was sent using SSL/TLS. Option A is wrong because aws:SourceIp checks IP address, not encryption. Option C is wrong because s3:x-amz-server-side-encryption checks encryption at rest, not in transit. Option D is wrong because aws:UserAgent checks the user agent string.

Answer

aws:SourceIp

Answer

s3:x-amz-server-side-encryption

Answer

aws:UserAgent