SCS-C02 Infrastructure Security Practice Test 10 — 15 Questions

Question 1

A company needs to enforce that all Amazon S3 buckets are encrypted at rest. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use bucket policies to deny write operations without encryption.. Enabling default encryption on each S3 bucket ensures that any object uploaded without explicit encryption headers is automatically encrypted at rest. Option B is correct because a bucket policy can deny s3:PutObject requests that do not include the required encryption header (e.g., x-amz-server-side-encryption), thereby enforcing encryption at rest for all uploads. Option E is incorrect because an SCP that denies s3:PutBucketPublicAccessBlock controls public access, not encryption at rest.

Answer

Enable AWS CloudTrail to log S3 API calls.

Answer

Create a KMS key and apply it to all buckets.

Answer

Use a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action.

Question 2

A company is using an Application Load Balancer (ALB) to distribute traffic to EC2 instances in a VPC. The Security Engineer notices that the ALB health checks are failing. Which configuration change should the Engineer make to resolve the issue?

Accepted Answer

Add a rule to the target instances' security group to allow inbound traffic from the VPC CIDR on the health check port.. The ALB health checks originate from private IP addresses within the VPC subnet, not from the internet. Therefore, the target instances' security group must allow inbound traffic from the VPC CIDR (or the ALB subnet CIDR) on the health check port. Option B correctly configures this, enabling the ALB to successfully reach the health check endpoint on the EC2 instances.

Answer

Add a rule to the target instances' security group to allow inbound traffic from 0.0.0.0/0 on the health check port.

Answer

Add a rule to the ALB's security group to allow inbound traffic from the internet on the health check port.

Answer

Add a rule to the ALB's security group to allow outbound traffic to the target instances on the health check port.

Question 3

A company has an AWS Direct Connect connection to its on-premises data center. The company wants to ensure that all traffic between the data center and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Use a Direct Connect gateway with a public virtual interface and an IPsec VPN.. It combines a Direct Connect public virtual interface with an IPsec VPN to encrypt all traffic between the on-premises data center and AWS. The public VIF provides a private, low-latency connection to AWS public services, while the IPsec VPN (typically using IKEv2 and ESP) adds encryption over that physical link, ensuring confidentiality and integrity. This meets the requirement of encrypting all traffic without relying on the public internet.

Answer

Use a Site-to-Site VPN connection over the internet.

Answer

Use AWS PrivateLink with TLS termination.

Answer

Use Direct Connect as is because it is already encrypted.

Question 4

An application running on EC2 instances needs to access an S3 bucket. The Security Engineer wants to ensure that the EC2 instances do not have access keys and that the access is restricted to only the required bucket. What is the most secure way to provide this access?

Accepted Answer

Create an IAM role with a policy that allows access to the specific S3 bucket, and attach the role to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary security credentials from AWS STS (Security Token Service) without storing any long-term access keys. The role's policy can be scoped to grant access only to the specific S3 bucket, ensuring least privilege. This approach eliminates the risk of key exposure and is the AWS-recommended best practice for granting EC2 instances access to AWS services.

Answer

Generate an access key for an IAM user with permissions to the S3 bucket and store it in the EC2 instance.

Answer

Create an S3 bucket policy that allows the EC2 instance's public IP address to access the bucket.

Answer

Use the root user's access keys to configure the application.

Question 5

A company is using AWS WAF to protect a web application behind an Application Load Balancer. The Security Engineer wants to block requests that contain SQL injection attacks. Which action should the Engineer take?

Accepted Answer

Create a WAF rule with a SQL injection match condition and set the action to block.. AWS WAF is the native service for filtering web traffic to Application Load Balancers, and it includes a managed rule set specifically for SQL injection (SQLi) detection. By creating a custom WAF rule with a SQL injection match condition and setting the action to 'Block', the Engineer directly instructs WAF to inspect incoming requests for SQLi patterns and drop matching traffic before it reaches the ALB. This is the correct, service-native approach for blocking SQL injection attacks at the application layer.

Answer

Enable AWS Shield Advanced to automatically block SQL injection attacks.

Answer

Use Amazon GuardDuty to detect and block SQL injection attempts.

Answer

Configure the security group of the EC2 instances to block traffic containing SQL injection patterns.

Question 6

A company wants to enforce encryption in transit for all traffic between its VPC and on-premises data center over AWS Direct Connect. Which TWO configurations can achieve this?

Accepted Answer

Use a public virtual interface with Direct Connect and configure an IPsec VPN over it.. A public virtual interface over Direct Connect provides connectivity to public AWS endpoints, and by layering an IPsec VPN on top, you encrypt all traffic between your VPC and on-premises data center. This ensures encryption in transit while leveraging the low latency and reliability of Direct Connect. Option C is correct because a Direct Connect Gateway allows you to connect multiple VPCs to a Direct Connect private virtual interface, and configuring an IPsec VPN over that private virtual interface encrypts traffic end-to-end, meeting the encryption requirement.

Answer

Use a Site-to-Site VPN connection over the internet.

Answer

Use a Transit VPC architecture with VPN attachments.

Answer

Use a private virtual interface with Direct Connect.

Question 7

A Security Engineer is designing a secure VPC architecture. Which THREE components are essential for creating a public subnet that can host a web server accessible from the internet?

Accepted Answer

Route table with a default route (0.0.0.0/0) pointing to the IGW. A public subnet requires a route table that directs traffic destined for 0.0.0.0/0 to an Internet Gateway (IGW). Without this default route, instances in the subnet cannot send or receive traffic from the internet, even if they have public IP addresses. The IGW acts as the target for this route, enabling bidirectional communication between the VPC and the internet.

Answer

VPN connection to on-premises

Answer

NAT Gateway

Question 8

A company wants to ensure that all traffic to and from an Amazon RDS instance is encrypted in transit. Which solution should the security engineer implement?

Accepted Answer

Configure the database to require SSL/TLS connections and modify clients to connect using SSL.. Encrypting data in transit for Amazon RDS requires enabling SSL/TLS on the database instance and configuring client connections to use SSL/TLS. This ensures that all traffic between the client and the RDS instance is encrypted using TLS protocols, protecting against eavesdropping and man-in-the-middle attacks. Amazon RDS supports SSL/TLS for all database engines, and you can enforce SSL connections by setting the 'require_secure_transport' parameter (MySQL) or similar parameters for other engines.

Answer

Enable encryption at rest using AWS KMS.

Answer

Use an S3 bucket policy to enforce encryption in transit for all S3 traffic.

Answer

Use an AWS Transit Gateway to route traffic through a central VPC.

Question 9

A company has multiple AWS accounts and wants to centralize VPC flow log analysis. Flow logs are enabled for all VPCs and are published to Amazon S3 buckets in each account. A security engineer needs to aggregate these logs into a single S3 bucket in the centralized logging account. What should the security engineer do?

Accepted Answer

Create an S3 bucket policy on the centralized bucket that allows the source accounts to write objects.. An S3 bucket policy on the centralized logging account can grant the s3:PutObject permission to the source accounts' VPC flow log delivery service (or their root accounts), allowing them to write objects directly into the centralized bucket. This approach avoids data duplication, reduces costs, and simplifies management by eliminating the need for replication or streaming services.

Answer

Set up VPC peering between each account and the centralized logging account, then configure flow logs to write directly to the centralized bucket.

Answer

Configure S3 Replication between each account's flow log bucket and the centralized bucket.

Answer

Use Amazon CloudWatch Logs to stream flow logs to the centralized S3 bucket.

Question 10

A security engineer notices that an Amazon EC2 instance is sending suspicious outbound traffic to an unknown IP address. The instance is part of an Auto Scaling group. The engineer needs to immediately stop the traffic without affecting the availability of the application. What should the engineer do?

Accepted Answer

Update the security group attached to the instance to deny outbound traffic to the suspicious IP address.. Modifying the security group's outbound rules to remove the rule that allows traffic to the suspicious IP address effectively blocks the traffic at the instance level without terminating the instance. Security groups are stateful and allow-only; they do not support explicit deny rules. By removing the allow rule, the traffic is implicitly denied. This approach maintains application availability because the instance remains in the Auto Scaling group and continues to serve legitimate traffic.

Answer

Add a network ACL rule to deny outbound traffic to the suspicious IP address.

Answer

Terminate the instance immediately.

Answer

Detach the instance from the Auto Scaling group.

Question 11

A company wants to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile applications. Which AWS service should the company use?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service because it enables the generation of temporary, limited-privilege credentials (access key, secret key, and session token) that can be used to access AWS resources. These credentials are ideal for mobile applications where long-term keys are a security risk, as they can be scoped with an IAM role and have a configurable expiration (default 1 hour, max 36 hours). STS supports the AWS Signature Version 4 signing process and can be called via the AssumeRole or GetFederationToken APIs to provide federated access.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Identity and Access Management (IAM) users

Answer

Amazon Cognito user pools

Question 12

A security engineer needs to ensure that all Amazon S3 buckets in an AWS account have server-side encryption (SSE) enabled. The engineer wants to automatically remediate any bucket that is created without SSE. Which solution should the engineer implement?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action.. The correct solution is to use AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` and an automatic remediation action. AWS Config continuously evaluates S3 buckets against this rule and can trigger a remediation action (e.g., enabling default encryption) when a non-compliant bucket is created. Option A is incorrect because a bucket policy can deny access to objects without encryption but does not prevent creation of buckets without SSE. Option B is incorrect because an IAM policy can require SSE for actions performed by users, but it cannot enforce encryption on the bucket itself at creation time. Option D is incorrect because a service control policy (SCP) applies to all accounts in an organization but requires careful configuration and does not directly enable SSE on the bucket; it can only deny actions that do not include encryption parameters, which is more complex and less straightforward than the AWS Config remediation approach.

Answer

Use S3 bucket policies to deny access to objects without encryption.

Answer

Apply an IAM policy that requires SSE for all S3 actions.

Answer

Create a service control policy (SCP) that denies creation of buckets without encryption.

Question 13

A company wants to use AWS CloudTrail to log all API calls in an AWS account. The security engineer needs to ensure that the logs are encrypted at rest and are accessible only to authorized personnel. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Enable server-side encryption on the S3 bucket that stores CloudTrail logs.. Options B, D, and E are correct. Enabling server-side encryption on the S3 bucket (B) ensures logs are encrypted at rest. Creating an IAM policy that grants access only to specific users or roles (D) ensures only authorized personnel can access logs. Configuring the S3 bucket policy to require encrypted connections (E) enforces encryption in transit. Option A is incorrect because MFA delete does not encrypt logs; it adds an extra authentication step for delete operations. Option C is incorrect because service control policies (SCPs) apply at the organization level and are not used to control access to individual S3 buckets in this context.

Answer

Enable MFA delete on the S3 bucket.

Answer

Attach a service control policy (SCP) to the root account.

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all new member accounts automatically deny public access to S3 buckets. Which policy should be attached to the root organizational unit?

Accepted Answer

Attach a service control policy (SCP) to the root OU. An SCP attached to the root OU can deny public access to S3 buckets across all accounts in the organization. Option A is incorrect because an S3 bucket policy applies only to individual buckets, not across accounts. Option B is incorrect because an IAM policy attached to the root user applies only to that user and does not affect S3 bucket policies. Option C is incorrect because a trust policy is used for IAM role trust relationships, not for controlling S3 bucket access.

Answer

Attach an S3 bucket policy to each bucket

Answer

Attach an IAM policy to the root user

Answer

Attach a trust policy to the OrganizationAccountAccessRole

Question 15

A company wants to host a static website in an Amazon S3 bucket. The bucket must be private and accessible only through an Amazon CloudFront distribution. Which configuration ensures that CloudFront can access the S3 bucket while blocking direct access via S3 URL?

Accepted Answer

Create an Origin Access Control (OAC) and update the bucket policy to allow access only to the CloudFront distribution. An Origin Access Control (OAC) allows CloudFront to access an S3 bucket securely. You create an OAC, associate it with the CloudFront distribution, and update the bucket policy to grant s3:GetObject permissions only from that OAC. This blocks direct S3 URL access because the bucket policy denies access to any other principal. Option A is incorrect because CloudFront signed URLs are for end-user access control, not for origin authentication. Option B is incorrect because enabling S3 Block Public Access alone does not grant CloudFront access; you must also configure a bucket policy that allows CloudFront. Option C is incorrect because using the CloudFront service principal (OAI) is an older method; while it can work, OAC is the current recommended approach with enhanced security.

Answer

Use CloudFront signed URLs and configure the bucket policy to allow access from CloudFront IP ranges

Answer

Enable S3 Block Public Access and configure CloudFront to use the bucket as an origin

Answer

Configure the bucket policy to allow s3:GetObject from the CloudFront service principal