SCS-C02 Practice Test 40 — 15 Questions

Question 1

A company has an Amazon S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. However, users are still able to access the bucket from outside the VPC. Which THREE steps should the security engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Check the VPC endpoint policy to ensure it allows the actions the users are performing.. Option A is correct because the bucket policy must explicitly deny access from outside the VPC endpoint. Option C is correct because the VPC endpoint policy must allow the required actions. Option E is correct because the route table must include a route to the S3 endpoint. Option B is wrong because the VPC endpoint must be in the same region. Option D is wrong because security groups are not required for S3 endpoint access.

Answer

Verify that the security group associated with the VPC endpoint allows inbound traffic.

Answer

Ensure the VPC endpoint is in the same region as the S3 bucket.

Question 2

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

Accepted Answer

NAT gateway. The correct answer is A because a NAT gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option B is wrong because an internet gateway is for public subnets. Option C is wrong because a VPC peering connects VPCs. Option D is wrong because a VPN connection is for hybrid connectivity.

Answer

Internet gateway

Answer

VPN connection

Answer

VPC peering connection

Question 3

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

Accepted Answer

Allow inbound database port from the security group attached to the application instances in the public subnet.. Option B is correct because referencing the application security group as the source allows dynamic scaling. Option A is wrong because referencing the public subnet CIDR would allow any instance in that subnet, not just the application. Option C is wrong because allowing 0.0.0.0/0 would expose the database. Option D is wrong because network ACLs are stateless and cannot reference security groups.

Answer

Allow inbound database port from 0.0.0.0/0 in the database security group.

Answer

Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.

Answer

Allow inbound database port from the public subnet CIDR block in the database security group.

Question 4

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service provides a managed, highly available, and scalable solution for this requirement?

Accepted Answer

NAT Gateway in a public subnet. Option B is correct because a NAT Gateway provides outbound internet access for instances in private subnets and is managed by AWS. Option A is wrong because a NAT instance is not managed. Option C is wrong because an Internet Gateway is used for public subnets. Option D is wrong because a VPN connection is for hybrid networking, not internet access.

Answer

NAT instance in a public subnet

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 5

A company wants to ensure that all Amazon EC2 instances in a VPC can only be accessed via SSH from a specific IP address range (203.0.113.0/24). Which VPC component should be used to enforce this restriction?

Accepted Answer

Network ACL. Option A is correct because a network ACL is a stateless firewall that controls inbound and outbound traffic at the subnet level, and can restrict SSH access to a specific IP range. Option B is wrong because security groups are stateful and cannot deny traffic by IP in a single rule (they only allow). Option C is wrong because an internet gateway is not a security control. Option D is wrong because a route table only controls traffic routing, not filtering.

Answer

Security group

Answer

Route table

Answer

Internet gateway

Question 6

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are protected from unauthorized access and deletion. Which TWO actions should be taken?

Accepted Answer

Enable server-side encryption using AWS KMS (SSE-KMS) on the S3 bucket.. Option A (enable log file validation) ensures integrity, and Option C (enable SSE-KMS) ensures encryption at rest. Option B is wrong because MFA is not a native CloudTrail feature. Option D is wrong because S3 Versioning helps but does not prevent deletion of the bucket. Option E is wrong because S3 ACLs are not the best practice; bucket policies are preferred.

Answer

Use S3 bucket ACLs to restrict access.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) for CloudTrail.

Question 7

A company uses AWS Systems Manager Session Manager to manage EC2 instances without opening inbound ports. Which IAM policy is required for an EC2 instance to allow Session Manager to connect?

Accepted Answer

AmazonSSMManagedInstanceCore. Option C is correct because SSM Agent requires the AmazonSSMManagedInstanceCore policy to communicate with Systems Manager. Option A is wrong because it is for admin users. Option B is wrong because it allows EC2 actions, not SSM. Option D is wrong because it allows full SSM access, which is excessive.

Answer

AmazonSSMFullAccess

Answer

AmazonEC2FullAccess

Answer

AdministratorAccess

Question 8

A security engineer is designing a VPC with public and private subnets. The VPC will host web servers in public subnets and database servers in private subnets. The web servers need to send traffic to the database servers, and the database servers must not have direct internet access. Which TWO configurations should the engineer implement?

Accepted Answer

Configure security group rules to allow inbound traffic from the web server security group to the database security group.. Option A is correct because security group rules can allow traffic between web and database servers based on the security group ID. Option D is correct because a NAT gateway is not needed for private subnets that don't need internet access; however, the database servers must not have internet access, so a NAT gateway should not be used. Actually, the correct combination is A and C: Use security group rules (A) and ensure no route to an internet gateway for private subnets (C). Option E is also correct? No, E is about NAT gateway which would give internet access. So correct: A and C.

Answer

Use network ACLs to block all inbound traffic to the private subnets.

Answer

Attach an internet gateway to the VPC and route the private subnets to it.

Answer

Add a NAT gateway in the public subnet and route the private subnets to it.

Question 9

A security engineer is configuring a new VPC with public and private subnets. The application servers in the private subnet need to download patches from the internet. Which component is required?

Accepted Answer

NAT gateway. A NAT gateway or NAT instance in a public subnet allows instances in private subnets to initiate outbound traffic to the internet and receive responses. Internet gateway alone is for public subnets. VPC endpoints are for specific services, not general internet access.

Answer

VPC endpoint

Answer

Direct Connect

Answer

Internet gateway

Question 10

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. A user from IP address 203.0.113.10 tries to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because HTTP is used.. Option D is correct because the first statement denies all S3 actions when HTTPS is not used. Since the request uses HTTP, the condition aws:SecureTransport is false, so the request is denied. The second statement allows GetObject from the specified IP, but the deny statement takes precedence. Option A is wrong because the deny applies. Option B is wrong because the deny overrides the allow. Option C is wrong because the condition is evaluated correctly.

Answer

The request is allowed because the IP address matches the allow statement.

Answer

The request is denied because the IP is not in the allowed range.

Answer

The request is allowed because the user is using a valid IP.

Question 11

A security engineer needs to ensure that an Amazon S3 bucket blocks all public access. Which S3 block public access settings should be enabled?

Accepted Answer

Block all public access. The correct answer is D because enabling all four block public access settings provides the most restrictive public access controls. Option A is wrong because it only blocks access that is granted to the public via bucket policies or ACLs, but not all public access. Option B is wrong because it only blocks access that is granted to the public via ACLs. Option C is wrong because it only blocks access that is granted to the public via bucket policies.

Answer

Block public access to buckets and objects granted through new public bucket policies

Answer

Block public access to buckets and objects granted through new access control lists (ACLs)

Answer

Block public access to buckets and objects granted through any access control lists (ACLs)

Question 12

An organization uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which approach would enforce this across all accounts?

Accepted Answer

Apply a Service Control Policy that denies PutBucketPolicy or PutBucketEncryption without encryption.. Option D is correct because a Service Control Policy (SCP) can deny actions that create or modify S3 buckets without encryption. Option A is wrong because AWS Config is detective. Option B is wrong because IAM roles in each account require manual setup. Option C is wrong because S3 Bucket Policies are per-bucket and not centralized.

Answer

Create IAM roles in each account to enforce encryption.

Answer

Apply an S3 bucket policy to each bucket requiring encryption.

Answer

Use AWS Config rules to detect unencrypted buckets.

Question 13

A security engineer needs to ensure that all data stored in an Amazon S3 bucket is encrypted at rest. The bucket must use server-side encryption with a key managed by the customer (SSE-C). What must the engineer include in the PUT request to enforce this?

Accepted Answer

x-amz-server-side-encryption-customer-algorithm and x-amz-server-side-encryption-customer-key. Option B is correct because SSE-C requires the encryption key to be provided in the request headers. Option A is wrong because SSE-S3 uses AWS-managed keys. Option C is wrong because SSE-KMS uses KMS keys. Option D is wrong because bucket policies can enforce encryption but the key must still be provided in the request.

Answer

x-amz-server-side-encryption: AES256

Answer

x-amz-server-side-encryption: aws:kms

Answer

x-amz-server-side-encryption-bucket-key-enabled: true

Question 14

A company is designing a security group for a web server that must allow HTTP (80) and HTTPS (443) traffic from the internet. The server also needs to make outbound connections to an Amazon RDS database on port 3306 and to the internet for software updates. Which THREE rules should be included in the security group? (Select THREE.)

Accepted Answer

Inbound: HTTPS (443) from 0.0.0.0/0. Option A (inbound HTTP from 0.0.0.0/0) and Option B (inbound HTTPS from 0.0.0.0/0) are correct for web traffic. Option E (outbound HTTPS to 0.0.0.0/0) is correct for software updates. Option C is wrong because outbound to RDS should be to the database security group, not VPC CIDR. Option D is wrong because inbound MySQL from VPC CIDR is not needed; the web server initiates. Option F is wrong because outbound HTTP to VPC CIDR is not needed.

Answer

Inbound: MySQL (3306) from the VPC CIDR block

Answer

Outbound: MySQL (3306) to the VPC CIDR block

Answer

Outbound: HTTP (80) to the VPC CIDR block

Question 15

A security engineer needs to ensure that all traffic between two EC2 instances in different subnets is encrypted in transit. What is the most secure and efficient solution?

Accepted Answer

Set up an IPsec VPN between the instances. Option A is correct because an IPSec VPN provides encryption in transit. Option B is wrong because VPC Peering does not encrypt traffic. Option C is wrong because security groups do not encrypt. Option D is wrong because NACLs do not encrypt.

Answer

Configure network ACLs to allow traffic

Answer

Use VPC Peering

Answer

Configure security groups to allow traffic