SCS-C02 Practice Test 44 — 15 Questions

Question 1

A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?

Accepted Answer

Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.. Option C is correct because security groups are stateful and can reference other security groups, allowing you to allow inbound traffic from the web security group to the database security group without needing to manage IP addresses. Network ACLs are stateless and would require explicit allow rules for return traffic, increasing overhead. Options A and B use network ACLs for the database tier, which is less efficient. Option D is incorrect because it allows all traffic from the web security group, which is more permissive than necessary.

Answer

Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.

Question 2

Which TWO AWS services can be used to encrypt data at rest in an Amazon S3 bucket? (Choose two.)

Accepted Answer

SSE-KMS. Options A and B are correct. Server-Side Encryption with S3-Managed Keys (SSE-S3) and Server-Side Encryption with AWS KMS (SSE-KMS) are both options for encrypting data at rest. Option C (Client-side encryption) is also valid but is not an AWS service; it's done by the client. Option D (SSL/TLS) is for transit. Option E (AWS Shield) is for DDoS protection.

Answer

SSL/TLS

Answer

Client-side encryption

Answer

AWS Shield

Question 3

A company wants to allow an EC2 instance to access an S3 bucket without exposing the instance to the internet. Which AWS service should be used to achieve this?

Accepted Answer

VPC Endpoint (Gateway type) for S3. Option B is correct. A VPC endpoint for S3 allows private connectivity between the VPC and S3 without internet access. Option A (Internet Gateway) would expose the instance. Option C (NAT Gateway) is for outbound internet. Option D (VPN) is for on-premises connectivity.

Answer

NAT Gateway

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway

Question 4

A company wants to ensure that all data in transit between its EC2 instances and an RDS database is encrypted. The instances and the database are in the same VPC. Which configuration step is necessary to achieve this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL.. Option A is correct. To encrypt data in transit, you must enable SSL/TLS on the RDS instance and configure the client (EC2) to use SSL when connecting. Option B (enforcing encryption on the security group) is not a valid concept. Option C (using VPN) is unnecessary for intra-VPC traffic. Option D (enabling encryption at rest) does not cover transit encryption.

Answer

Enable encryption at rest for the RDS instance using AWS KMS.

Answer

Set up a VPN connection between the EC2 instances and the RDS database.

Answer

Configure the security group for the RDS instance to enforce encryption.

Question 5

Refer to the exhibit. A security engineer runs the command above and sees that the flow log status is ACTIVE. However, the engineer notices that no logs are appearing in the CloudWatch log group. What is the most likely cause?

Accepted Answer

The IAM role specified in DeliverLogsPermissionArn does not have permissions to PutLogEvents.. Option B is correct. If the flow logs are ACTIVE but no logs appear, the IAM role may not have sufficient permissions to publish logs to CloudWatch Logs. Option A is incorrect because the flow log is attached to an ENI, not a subnet. Option C is incorrect because the flow log can capture all traffic, but that would generate logs, not prevent them. Option D is incorrect because flow logs do not require encryption.

Answer

The TrafficType is set to ALL, which captures too much data and causes throttling.

Answer

The flow log is attached to an ENI instead of a subnet.

Answer

The flow log destination is set to CloudWatch Logs but the log group is encrypted with KMS.

Question 6

A company wants to allow a user to assume a role in another AWS account to access resources. Which AWS service should be used to create and manage the trust relationship between the accounts?

Accepted Answer

IAM roles with a trust policy that allows the external account.. Option C is correct. IAM roles have trust policies that define which accounts or users can assume the role. Option A (IAM users) are for individuals, not cross-account access. Option B (AWS Organizations) can help manage multiple accounts but does not directly create trust relationships. Option D (AWS STS) is used to request temporary credentials, but the trust policy is defined in the role itself.

Answer

AWS Security Token Service (STS) to generate tokens.

Answer

IAM users in the source account with cross-account permissions.

Answer

AWS Organizations service control policies.

Question 7

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The security group for the NAT gateway does not allow inbound traffic from the private subnets.. Option D is correct because the NAT gateway's security group must allow inbound traffic from the private subnets to receive return traffic. Option A is incorrect because the NAT gateway automatically responds. Option B is incorrect because network ACLs are stateless and require inbound rules for return traffic. Option C is incorrect because the private subnets' route table must have a route to the NAT gateway.

Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Answer

The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.

Question 8

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

Accepted Answer

Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.. Option C is correct. If an instance in a private subnet is assigned a public IP, it still cannot access the internet directly because the route table does not have a route to the Internet Gateway. The correct approach is to not assign a public IP and use a NAT gateway. Option A is wrong because the route table is correct for a private subnet. Option B is wrong because the security group is not the issue. Option D is wrong because the IGW is already attached.

Answer

Attach an Elastic IP to the instance.

Answer

Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.

Answer

Allow outbound traffic in the instance's security group.

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16. They have two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). They have an Application Load Balancer in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access the internet for updates. The security engineer has set up a NAT gateway in each public subnet. The route table for the private subnets has a default route pointing to the NAT gateway in the same Availability Zone. However, the EC2 instances are unable to reach the internet. What is the most likely cause?

Accepted Answer

The route tables for the public subnets do not have a default route (0.0.0.0/0) to the Internet Gateway.. Option C is correct. Each NAT gateway must be in a public subnet with a route to the Internet Gateway. If the route table for the public subnet where the NAT gateway resides does not have a default route to the IGW, the NAT gateway cannot forward traffic. Option A is incorrect because each NAT gateway can be in a different AZ. Option B is incorrect because route propagation is for VPN. Option D is incorrect because security groups allow outbound by default.

Answer

The security groups for the EC2 instances do not allow outbound traffic.

Answer

The NAT gateways do not have route propagation enabled.

Answer

The NAT gateways are in the same Availability Zone.

Question 10

A company has the S3 bucket policy shown in the exhibit. The bucket contains sensitive data that should only be accessible from within the corporate network (10.0.0.0/16). However, users inside the corporate network report that they cannot access objects in the bucket. What is the most likely cause?

Accepted Answer

Users are accessing the bucket through a VPC endpoint, which changes the source IP.. Option B is correct because the condition uses IpAddress, which evaluates the source IP of the request. If users are accessing via a VPC endpoint, the source IP is not the client IP but the endpoint's private IP, which may not be in the specified range. Option A is wrong because a condition exists. Option C is wrong because IAM roles are not relevant to the public policy. Option D is wrong because SSL is not required by the policy.

Answer

Users do not have the appropriate IAM role assigned.

Answer

The policy does not have a Deny statement.

Answer

The bucket policy requires SSL but the connection is not using HTTPS.

Question 11

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?

Accepted Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}. Option C is correct because a VPC endpoint policy with aws:SourceVpce condition key restricts access to traffic coming through the specified VPC endpoint. Option A is wrong because aws:SourceVpc does not restrict to a specific endpoint. Option B is wrong because aws:SourceIp does not apply to VPC endpoint traffic. Option D is wrong because aws:VpcSourceIp is not a valid condition key for VPC endpoints.

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}

Question 12

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all Amazon S3 buckets across the organization are configured to block public access. Which solution should be used to centrally enforce this requirement?

Accepted Answer

Use a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action at the organization root.. Option B is correct because SCPs can be applied at the OU or account level to deny actions that allow public access to S3 buckets. Option A is wrong because IAM roles are for permissions within an account, not for cross-account enforcement. Option C is wrong because bucket policies are per-bucket and cannot be centrally enforced. Option D is wrong because Trusted Advisor provides recommendations but does not enforce policies.

Answer

Enable AWS Trusted Advisor to automatically remediate public buckets.

Answer

Create an IAM role in each account that denies the s3:PutBucketPublicAccessBlock action.

Answer

Apply a bucket policy to each bucket that blocks public access.

Question 13

A company uses AWS CloudFormation to deploy infrastructure. A security requirement states that no security group should allow inbound SSH access from 0.0.0.0/0. What is the best way to enforce this policy?

Accepted Answer

Use AWS Config with a managed rule to detect and automatically remediate non-compliant security groups.. Option D is correct because AWS Config can evaluate security group rules and trigger remediation. Option A is wrong because IAM policies cannot prevent resource creation based on configuration. Option B is wrong because SCPs cannot control CloudFormation template parameters. Option C is wrong because CloudFormation does not have built-in security checks.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.

Answer

Add an AWS::IAM::Policy resource in the CloudFormation template to deny the rule.

Answer

Use a service control policy (SCP) that denies the CreateStack action if the template contains SSH from 0.0.0.0/0.

Question 14

A company has a VPC with public and private subnets. The private sub host Amazon RDS instances. To allow the RDS instances to access the internet for software updates without exposing them to inbound internet traffic, what should be configured?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway in the private subnet route table.. Option B is correct because a NAT gateway allows outbound internet traffic from private subnets while blocking inbound. Option A is wrong because an internet gateway in a private subnet would expose the instance. Option C is wrong because VPC peering is for connecting VPCs, not internet access. Option D is wrong because a VPN does not provide internet access.

Answer

Use a VPN connection to an on-premises network that has internet access.

Answer

Set up a VPC peering connection to a VPC with internet access.

Answer

Attach an internet gateway to the private subnet route table.

Question 15

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, but the application and database tiers must not. Which VPC configuration should be used?

Accepted Answer

Place web tier in public subnets, app and database tiers in private subnets.. Option D is correct because public subnets for web tier and private subnets for app and database tiers meet the requirements. Option A is wrong because all public subnets expose all tiers. Option B is wrong because all private subnets block internet access to web tier. Option C is wrong because public subnets for app and database expose them.

Answer

Place web and app tiers in public subnets, database in private subnet.

Answer

Place all tiers in private subnets and use a VPN for external access.

Answer

Place all tiers in public subnets with security groups restricting access.