SCS-C02 Infrastructure Security — 100 Questions

Question 1

A company is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application and database tiers must be isolated. The security team requires that all traffic between tiers be encrypted and that the application tier can only be accessed by the web tier. Which architecture should be used?

Accepted Answer

Place the web tier in a public subnet with an internet gateway, and the app and database tiers in private subnets. Use separate security groups for each tier, allowing only necessary traffic.. Option B is correct because it places the web tier in a public subnet with an Internet Gateway (IGW) for internet-facing access, while the application and database tiers reside in private subnets with no direct internet path. Separate security groups enforce least-privilege: the web tier security group allows inbound HTTP/HTTPS (ports 80/443) from 0.0.0.0/0, the app tier security group allows inbound traffic only from the web tier security group (using a security group reference), and the database tier security group allows inbound traffic only from the app tier security group. This ensures encryption (e.g., TLS for web-to-app, and database-native encryption like TLS or AWS RDS encryption in transit) and complete isolation of the internal tiers.

Answer

Place all tiers in public subnets and use security groups to restrict traffic.

Answer

Place the web and app tiers in public subnets and the database in a private subnet.

Answer

Place all tiers in private subnets and use a single security group to allow traffic between them.

Question 2

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.. The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.

Answer

The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The security group does not allow inbound traffic from the on-premises server.

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all Amazon S3 buckets across the organization have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket if the bucket does not have encryption enabled.. Option D is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny API actions across all accounts. By creating an SCP that denies `s3:CreateBucket` unless the request includes encryption parameters (SSE-S3 or SSE-KMS), you enforce encryption at the point of bucket creation, preventing non-compliant buckets from ever being created. This is the only approach that proactively enforces the policy across the entire organization, rather than relying on detection or per-account configurations.

Answer

Create an S3 bucket policy in each account to deny access to unencrypted buckets.

Answer

Use AWS Config rules to detect buckets without encryption and send alerts.

Answer

Create an IAM role in each account that requires encryption when creating buckets.

Question 4

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

Accepted Answer

Create a security group for the web servers that allows outbound traffic on port 3306 to the database security group.. Option A is correct because security groups are stateful, so allowing outbound traffic on port 3306 from the web servers to the database security group automatically permits the corresponding return traffic. This adheres to the principle of least privilege by specifying the destination as the database security group ID rather than a broad CIDR range, ensuring only the intended web servers can initiate the connection.

Answer

Create a security group for the database servers that allows inbound traffic on port 3306 from the web subnet CIDR.

Answer

Place the database servers in a public subnet for easier connectivity.

Answer

Configure the network ACL for the database subnet to allow inbound traffic on port 3306 from the web subnet CIDR.

Question 5

A security engineer is reviewing the SQS queue policy shown in the exhibit. The queue is subscribed to an SNS topic in the same account. The security team has a requirement that only the SNS topic should be allowed to send messages to the queue. What is the issue with this policy?

Accepted Answer

The second statement allows any principal in the 10.0.0.0/8 range to receive messages from the queue.. Option A is correct because the second statement in the SQS queue policy allows any principal in the 10.0.0.0/8 IP range to receive messages from the queue, which violates the security requirement that only the SNS topic should be allowed to send messages. The policy should restrict the `sqs:SendMessage` action to the SNS topic using a condition like `aws:SourceArn` and should not include a broad `Effect: Allow` for `sqs:ReceiveMessage` without restricting the principal or source.

Answer

The policy does not specify a principal, so it will not work.

Answer

The aws:SourceArn condition uses ArnLike which is deprecated.

Answer

The aws:SourceIp condition cannot be used with SQS queue policies.

Question 6

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: 
- All EC2 instances are launched in private subnets. 
- The IAM roles used by EC2 instances follow the principle of least privilege. 
- Security groups restrict inbound and outbound traffic. 
- AWS Systems Manager Patch Manager is used to patch instances. 
- AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. 
- Amazon GuardDuty is enabled.

Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

Accepted Answer

Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.. Option B is correct because using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.

Answer

Enable VPC Flow Logs to monitor traffic to S3.

Answer

Deploy AWS WAF in front of the S3 bucket.

Answer

Create an AWS Config rule to detect S3 access from EC2 instances.

Question 7

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Accepted Answer

Add a route in the private subnet's route table pointing to the NAT gateway.. Option B is correct because a NAT gateway, when deployed in a public subnet with an associated Elastic IP and a route to an internet gateway, allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's private IP address to forward outbound traffic through it.

Answer

Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.

Answer

Attach an internet gateway to the private subnet's route table.

Answer

Create a VPC gateway endpoint for Amazon S3.

Question 8

Refer to the exhibit. A security engineer finds the above IAM policy attached to an IAM group. The policy is intended to allow all EC2 actions only from the corporate network (10.0.0.0/8). However, users report that they can perform EC2 actions from outside the corporate network. What is the MOST likely reason?

Accepted Answer

The aws:SourceIp condition key does not apply to API calls made through the AWS Management Console; the console uses AWS IP addresses.. Option C is correct because the `aws:SourceIp` condition key does not evaluate the source IP of requests made through the AWS Management Console. When a user signs in to the console, the console makes API calls on their behalf using AWS service endpoints, which have AWS-owned IP addresses, not the user's corporate IP. Therefore, the condition `IpAddress` fails, and the policy denies console-based EC2 actions from the corporate network, but the policy actually allows all EC2 actions (since the default effect is Allow) when the condition is not met? Wait—the policy has an Allow effect with a condition; if the condition is not met, the Allow does not apply, but there is no explicit Deny, so other policies or the default implicit Deny would block the action. However, the question states users can perform EC2 actions from outside the corporate network, meaning the policy is not blocking them. The most likely reason is that the console uses AWS IP addresses, so the condition never matches, and the Allow never applies, but users are still able to perform actions because they are using the console? Actually, the console uses AWS IPs, so the condition `IpAddress` would not match, and the Allow would not apply, leading to implicit Deny—but users report they can perform actions. This indicates that the policy is not the only one; perhaps there is another policy allowing EC2 actions without conditions (Option A). But the question asks for the MOST likely reason given the exhibit and the intent. The trap is that the `aws:SourceIp` condition does not work for console-based API calls because the console uses AWS IP addresses, so the condition is effectively ignored for console users, allowing them to bypass the intended restriction. This is a well-known limitation documented by AWS.

Answer

The IAM group has an additional policy that allows all EC2 actions without conditions.

Answer

The policy allows access to all EC2 actions, but the condition only applies to the ec2:* actions, which includes all EC2 actions.

Answer

The policy should use a NotIpAddress condition instead of IpAddress.

Question 9

A company runs a web application on EC2 instances in an Auto Scaling group across two Availability Zones. The instances are behind an Application Load Balancer. The security team wants to ensure that only the ALB can send traffic to the instances. The instances are in a security group named 'app-sg'. Currently, 'app-sg' has an inbound rule allowing HTTP traffic from 0.0.0.0/0. The team wants to restrict access to only the ALB's security group. The ALB is in a security group named 'alb-sg'. Which course of action should the security engineer take to meet the requirement with minimal disruption?

Accepted Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from security group 'alb-sg'.. Option D is correct because security groups can reference each other by ID, allowing traffic from any instance associated with the source security group (alb-sg) without needing to know the ALB's IP addresses. This ensures that only the ALB can send HTTP traffic to the EC2 instances, as the rule dynamically applies to all ALB nodes across Availability Zones. It also minimizes disruption because no IP changes are required, and the rule automatically scales with the ALB.

Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from the private IP addresses of the ALB nodes.

Answer

Modify the inbound rule of 'app-sg' to allow HTTPS traffic from 0.0.0.0/0 and remove the HTTP rule.

Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from the ALB's elastic network interface (ENI).

Question 10

Drag and drop the steps to set up AWS Certificate Manager (ACM) for a custom domain in the correct order.

Question 11

Match each AWS Storage service encryption feature to its description.

Question 12

A company uses Network Load Balancer (NLB) in front of a fleet of EC2 instances in private subnets. Security team requires that the source IP addresses of clients be preserved in the access logs of the backend instances. Which configuration should the security engineer verify?

Accepted Answer

Ensure the NLB is configured with a subnet from each Availability Zone and the targets are in the same subnets. NLB preserves source IP by default, so no special configuration is needed. Option C is correct. Option A is wrong because NLB uses the client IP directly. Option B is wrong because proxy protocol is an alternative but not required for NLB. Option D is wrong because target group stickiness does not affect source IP preservation.

Answer

Configure proxy protocol v2 on the target group

Answer

Enable target group stickiness

Answer

Enable cross-zone load balancing on the NLB

Question 13

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Accepted Answer

NAT Gateway in a public subnet. Option A (NAT Gateway in public subnet) allows outbound internet. Option C (S3 Gateway Endpoint) provides private access to S3. Option B is wrong because Internet Gateway alone would allow inbound. Option D is wrong because VPC Peering is not needed. Option E is wrong because VPC Endpoint (Interface) for S3 is not supported; S3 uses Gateway Endpoint.

Answer

S3 Interface Endpoint in the VPC

Answer

VPC Peering to a shared services VPC

Answer

Internet Gateway attached to the VPC

Question 14

A company is using AWS WAF to protect its Application Load Balancer (ALB). The security team wants to block requests that do not contain a valid API key in the HTTP header 'X-API-Key'. Which WAF rule type should be used?

Accepted Answer

Regex pattern set. A regex pattern set rule is the correct choice because it allows you to define a regular expression pattern that matches the expected format of valid API keys in the 'X-API-Key' header. AWS WAF regex pattern sets can be used in a rule to inspect the header value and block requests that do not match the pattern, providing flexible and precise validation beyond simple string matching.

Answer

String match condition

Answer

Rate-based rule

Answer

IP set

Question 15

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

Accepted Answer

The NAT Gateway's security group is blocking outbound traffic to the internet. NAT Gateway's security group must allow inbound HTTPS from the private subnet CIDR. The problem statement says it does, so that is not the issue. The most likely issue is that the NAT Gateway's security group must also allow outbound HTTPS to 0.0.0.0/0 for the return traffic. Option D is correct. Option A is wrong because NACL is stateless but default NACL allows all. Option B is wrong because the security group allows outbound. Option C is wrong because the route is present.

Answer

The network ACL for the private subnet is blocking outbound traffic

Answer

The private subnet route table does not have a route to the NAT Gateway

Answer

The security group attached to the EC2 instance is blocking inbound traffic

Question 16

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The connection is set up with a private VIF to a VPC using a virtual private gateway. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be implemented?

Accepted Answer

Set up an IPsec VPN over the Direct Connect private VIF. Option B (IPsec VPN over Direct Connect) is correct because it encrypts the traffic over the private VIF. Option A is wrong because Direct Connect itself does not encrypt. Option C is wrong because using a VPN over the internet is less secure and not over Direct Connect. Option D is wrong because TLS is for application layer, not network layer.

Answer

Configure TLS on the applications

Answer

Use a site-to-site VPN over the internet instead of Direct Connect

Answer

Enable encryption on the Direct Connect private VIF

Question 17

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. To restrict access to an S3 bucket so that only requests originating from a specific VPC endpoint are allowed, you must use the `aws:SourceVpce` condition key in the S3 bucket policy. This key evaluates the VPC endpoint ID (e.g., `vpce-1a2b3c4d`) of the request, ensuring that only traffic routed through that specific endpoint is granted access. The `aws:SourceVpc` key is used to restrict access based on the VPC ID, not the endpoint ID, and `aws:SourceIp` and `aws:VpcSourceIp` are not valid condition keys for VPC endpoint-based restrictions.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 18

A company is using AWS CloudFormation to deploy a multi-tier application. The security team requires that the database tier (RDS) be deployed in private subnets that are not directly routable from the application tier (EC2). The application tier must communicate with the database using an internal network path. Which solution meets these requirements?

Accepted Answer

Deploy the RDS instance in private subnets and use an RDS VPC Endpoint (Interface) in the application subnets. Option C (VPC Endpoint for RDS) is correct because it provides private connectivity without routing through subnets. Option A is wrong because direct routing would require routes. Option B is wrong because ClassicLink is legacy. Option D is wrong because a proxy is not needed.

Answer

Place the RDS instance in the same subnet as the application tier and use security groups

Answer

Use ClassicLink to connect the application tier to the RDS instance

Answer

Use a NAT Gateway in the application subnet to route traffic to the RDS instance

Question 19

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

Accepted Answer

AWS WAF. Option D (AWS WAF) is correct because it integrates with Shield Advanced for application layer DDoS mitigation. Option A (AWS Firewall Manager) is for managing rules. Option B (AWS Network Firewall) is for network layer. Option C (AWS GuardDuty) is for threat detection.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 20

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Accepted Answer

Create an S3 Gateway Endpoint in the VPC. A VPC Gateway Endpoint (option A) allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. This is the correct foundational component because it uses prefix lists in the route table to direct S3 traffic to the endpoint, bypassing the need for an Internet Gateway or NAT Gateway.

Answer

Attach an Internet Gateway to the VPC

Answer

Create an S3 Interface Endpoint in the VPC

Answer

Use a NAT Gateway to route the traffic to the internet