SCS-C02 Practice Test 46 — 15 Questions

Question 1

A security engineer notices that an Amazon EC2 instance is sending suspicious outbound traffic to an unknown IP address. The instance is part of an Auto Scaling group. The engineer needs to immediately stop the traffic without affecting the availability of the application. What should the engineer do?

Accepted Answer

Update the security group attached to the instance to deny outbound traffic to the suspicious IP address.. Option B is correct because modifying the security group to deny outbound traffic to the specific IP is immediate and reversible. Option A is wrong because terminating the instance would affect availability. Option C is wrong because a NACL would affect all instances in the subnet. Option D is wrong because detaching the instance from the ASG does not stop the traffic.

Answer

Add a network ACL rule to deny outbound traffic to the suspicious IP address.

Answer

Terminate the instance immediately.

Answer

Detach the instance from the Auto Scaling group.

Question 2

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

Accepted Answer

Create an Origin Access Control (OAC) for the S3 bucket origin. Option C is correct because an Origin Access Control (OAC) prevents direct access to the S3 bucket. Option A is wrong because the alias record already points to CloudFront. Option B is wrong because CloudFront signed URLs are for user authentication, not origin access. Option D is wrong because security groups are for EC2, not S3.

Answer

Create a Route 53 health check to verify CloudFront availability

Answer

Configure CloudFront signed URLs to restrict access

Answer

Attach a security group to the S3 bucket

Question 3

Which THREE components are required to set up a client VPN for remote access to a VPC? (Choose 3.)

Accepted Answer

Client VPN endpoint. Options A, C, and E are correct. A Client VPN endpoint is the VPN server. A target network association connects the endpoint to subnets. An authorization rule grants access to specific network paths. Option B is wrong because a Virtual Private Gateway is used for site-to-site VPN. Option D is wrong because a Customer Gateway is for site-to-site VPN.

Answer

Virtual Private Gateway

Answer

Customer Gateway

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize costs and avoid NAT Gateway or NAT Instance charges. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and configure the instance to download patches from S3.. Option C is correct because a VPC Gateway Endpoint is used for S3 and DynamoDB, not for general internet access. For general internet access, a NAT device is required. However, if the patches are hosted on S3, a Gateway Endpoint is free. Option A is wrong because an internet gateway alone cannot be used from private subnets. Option B is wrong because an egress-only internet gateway is for IPv6. Option D is wrong because a proxy instance incurs costs.

Answer

Deploy a proxy instance in a public subnet and configure the private instance to use the proxy.

Answer

Use an egress-only internet gateway for the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table pointing to the internet gateway.

Question 5

A company is running a critical application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB reaches the EC2 instances. How can this be achieved?

Accepted Answer

Reference the ALB's security group in the EC2 security group inbound rule.. Option D is correct because referencing the ALB's security group in the EC2 security group ensures only traffic from the ALB is allowed. Option A is wrong because the ALB's private IP can change. Option B is wrong because public IPs are not used. Option C is wrong because a Network ACL would affect all instances in the subnet.

Answer

Use the ALB's private IP address in the EC2 security group.

Answer

Configure a Network ACL to allow only the ALB's subnet.

Answer

Use the ALB's public IP address in the EC2 security group.

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that can protect against common web exploits. Option A is correct. Option B is for network firewall. Option C is for DDoS protection at layer 3/4. Option D is for traffic inspection at the network level.

Answer

AWS Network Firewall

Answer

AWS Firewall Manager

Answer

AWS Shield Advanced

Question 7

A company has an AWS Direct Connect connection to its on-premises data center. The company wants to ensure that all traffic between the data center and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Use a Direct Connect gateway with a public virtual interface and an IPsec VPN.. Option C is correct because IPsec VPN over Direct Connect provides encryption for the traffic. Option A is wrong because Direct Connect is a private connection but not encrypted by default. Option B is wrong because Site-to-Site VPN over the internet does not use Direct Connect. Option D is wrong because TLS is for application-level encryption, not for the network layer.

Answer

Use a Site-to-Site VPN connection over the internet.

Answer

Use AWS PrivateLink with TLS termination.

Answer

Use Direct Connect as is because it is already encrypted.

Question 8

Refer to the exhibit. A security engineer reviews this CloudFormation template snippet. What is the security concern with this configuration?

Accepted Answer

The security group allows SSH access from any IP address.. The security group allows SSH from anywhere (0.0.0.0/0), which is a security risk. Option A is correct. Option B is incorrect because the AMI is not necessarily public. Option C is incorrect because the instance type is not a security concern. Option D is incorrect because the template is valid.

Answer

The AMI ID is hardcoded.

Answer

The template does not specify a VPC.

Answer

The instance type is too small.

Question 9

A company has multiple AWS accounts and wants to centrally manage access using IAM Identity Center (AWS SSO). Which feature allows the company to define permissions once and reuse them across multiple accounts?

Accepted Answer

Permission sets. Option B is correct because permission sets in IAM Identity Center define collections of policies that can be assigned to users and groups across accounts. Option A is for managing access to external applications. Option C is for federation. Option D is for account management.

Answer

Application assignments

Answer

Identity providers

Answer

Account assignments

Question 10

A security engineer is designing a network architecture for a web application that must be highly available and secure. The application uses an Application Load Balancer (ALB) in front of EC2 instances. Which architecture meets these requirements?

Accepted Answer

Place the ALB in public subnets and EC2 instances in private subnets across two Availability Zones.. Placing ALB in public subnets and EC2 instances in private subnets provides security (instances not directly exposed) and high availability across AZs. Option C is correct. All in public (A) exposes instances. All in private (B) blocks internet traffic. ALB in private (D) cannot receive internet traffic.

Answer

Place both the ALB and EC2 instances in private subnets across two Availability Zones.

Answer

Place the ALB in private subnets and EC2 instances in public subnets across two Availability Zones.

Answer

Place both the ALB and EC2 instances in public subnets across two Availability Zones.

Question 11

A company is designing a network architecture for a critical application that must be highly available and secure. Which TWO actions should be taken to ensure high availability of the network infrastructure?

Accepted Answer

Deploy resources across multiple Availability Zones.. Deploying resources across multiple Availability Zones (A) and using Elastic IP addresses for failover (C) improve availability. Option A and C are correct. Single AZ (B) is not high availability. Internet gateway (D) is a single point of failure if not redundant. Public subnet (E) doesn't guarantee availability.

Answer

Use a single internet gateway for the VPC.

Answer

Use a single Availability Zone for all resources to reduce complexity.

Answer

Place all instances in a public subnet for easy access.

Question 12

A security engineer is reviewing the following IAM policy attached to an S3 bucket: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

Accepted Answer

The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.. Option B is correct because the policy allows anonymous access; any user from the specified IP range can access objects. Option A is wrong because the condition does restrict by IP. Option C is wrong because the bucket policy does not block public access if the bucket policy explicitly allows it. Option D is wrong because the policy does not open the entire bucket; it only allows GetObject.

Answer

The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

Answer

The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

Answer

The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.

Question 13

Which TWO of the following are valid use cases for IAM permissions boundaries? (Choose TWO.)

Accepted Answer

To prevent an IAM user from escalating privileges. Options A and D are valid uses. Option B is incorrect because permissions boundaries don't delegate administration. Option C is incorrect because boundaries are applied to IAM entities, not resource-based policies. Option E is incorrect because cross-account access is governed by trust policies, not boundaries.

Answer

To allow cross-account access to an S3 bucket

Answer

To delegate permission management to non-administrators

Answer

To restrict access to an S3 bucket based on IP address

Question 14

A security engineer needs to ensure that all traffic to an EC2 instance in a VPC is inspected by a network firewall appliance. The firewall is deployed in a separate subnet. What is the MOST secure and scalable way to route traffic through the firewall?

Accepted Answer

Use a Gateway Load Balancer with a Gateway Load Balancer endpoint in each subnet.. Option B is correct because a Gateway Load Balancer with a Gateway Load Balancer endpoint in each subnet allows scaling and transparent inspection. Option A is wrong because a NAT gateway only handles outbound traffic. Option C is wrong because an ALB is for load balancing at layer 7, not for traffic inspection routing. Option D is wrong because a transit gateway is for connecting VPCs, not for routing traffic through a firewall.

Answer

Configure a NAT gateway in the firewall subnet and route all traffic through it.

Answer

Use an Application Load Balancer in front of the firewall.

Answer

Create a transit gateway and route traffic through the firewall subnet.

Question 15

An application running on EC2 instances needs to access an S3 bucket. The Security Engineer wants to ensure that the EC2 instances do not have access keys and that the access is restricted to only the required bucket. What is the most secure way to provide this access?

Accepted Answer

Create an IAM role with a policy that allows access to the specific S3 bucket, and attach the role to the EC2 instance profile.. Option A is correct because an IAM role with a policy that grants access to the specific bucket and attached to an instance profile is the most secure and scalable method. Option B is wrong because storing access keys in the instance is insecure. Option C is wrong because using the root user's credentials is highly insecure. Option D is wrong because a bucket policy alone does not grant access to EC2 instances; the instances need credentials to sign requests.

Answer

Generate an access key for an IAM user with permissions to the S3 bucket and store it in the EC2 instance.

Answer

Create an S3 bucket policy that allows the EC2 instance's public IP address to access the bucket.

Answer

Use the root user's access keys to configure the application.