SCS-C02 Infrastructure Security Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. A security engineer is reviewing this CloudFormation template. What security risk is present in this configuration?

Accepted Answer

SSH access is allowed from a large internal CIDR block (10.0.0.0/8) which could expose the instance to unnecessary internal threats.. Option C is correct. The SSH port (22) is open to the internal CIDR block 10.0.0.0/8, which is unnecessarily broad. It should be restricted to specific IPs or a security group. Option A is incorrect because HTTP (80) to 0.0.0.0/0 is common for web servers. Option B is incorrect because the template uses a SecurityGroup property, not a SecurityGroupIds property. Option D is incorrect because the template does reference a security group.

Answer

The template does not associate the security group with the instance, so the instance has no security group.

Answer

HTTP access is allowed from all IP addresses (0.0.0.0/0) which is a security risk.

Answer

The template uses SecurityGroups property instead of SecurityGroupIds, which is deprecated.

Question 2

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all access to the bucket is encrypted in transit. Which policy should be attached to the bucket to enforce this?

Accepted Answer

Attach a bucket policy that denies requests when aws:SecureTransport is false.. Option D is correct. An S3 bucket policy with a condition that denies access if the request does not use aws:SecureTransport (HTTPS) ensures encryption in transit. Option A (enable default encryption) is for at-rest encryption. Option B (require encryption using SSE-S3) is also at-rest. Option C (use CloudFront) does not enforce HTTPS for direct access.

Answer

Configure a bucket policy that denies requests that do not include the x-amz-server-side-encryption header.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Use Amazon CloudFront to serve the content and require HTTPS.

Question 3

A company's security engineer is configuring a web application firewall (WAF) to protect a public-facing Application Load Balancer (ALB). The application is vulnerable to SQL injection attacks. Which AWS WAF rule should be used to mitigate this threat?

Accepted Answer

Add a rule from the AWS Managed Rules for SQL injection.. Option A is correct. AWS WAF has a managed rule group called SQLi that specifically blocks SQL injection attempts. Option B (Rate-based rule) is for DDoS. Option C (Cross-site scripting) is for XSS. Option D (Geographic match) is for geo-blocking.

Answer

Add a rule to block cross-site scripting (XSS) attacks.

Answer

Add a rate-based rule to limit requests per IP.

Answer

Add a geographic match rule to block traffic from specific countries.

Question 4

Refer to the exhibit. A security engineer runs the command above and sees that the flow log status is ACTIVE. However, the engineer notices that no logs are appearing in the CloudWatch log group. What is the most likely cause?

Accepted Answer

The IAM role specified in DeliverLogsPermissionArn does not have permissions to PutLogEvents.. Option B is correct. If the flow logs are ACTIVE but no logs appear, the IAM role may not have sufficient permissions to publish logs to CloudWatch Logs. Option A is incorrect because the flow log is attached to an ENI, not a subnet. Option C is incorrect because the flow log can capture all traffic, but that would generate logs, not prevent them. Option D is incorrect because flow logs do not require encryption.

Answer

The TrafficType is set to ALL, which captures too much data and causes throttling.

Answer

The flow log is attached to an ENI instead of a subnet.

Answer

The flow log destination is set to CloudWatch Logs but the log group is encrypted with KMS.

Question 5

A company wants to allow a user to assume a role in another AWS account to access resources. Which AWS service should be used to create and manage the trust relationship between the accounts?

Accepted Answer

IAM roles with a trust policy that allows the external account.. Option C is correct. IAM roles have trust policies that define which accounts or users can assume the role. Option A (IAM users) are for individuals, not cross-account access. Option B (AWS Organizations) can help manage multiple accounts but does not directly create trust relationships. Option D (AWS STS) is used to request temporary credentials, but the trust policy is defined in the role itself.

Answer

AWS Security Token Service (STS) to generate tokens.

Answer

IAM users in the source account with cross-account permissions.

Answer

AWS Organizations service control policies.

Question 6

Which TWO actions should a security engineer take to protect an Amazon EC2 instance from unauthorized access? (Choose two.)

Accepted Answer

Configure security groups to allow only necessary inbound traffic.. Options A and C are correct. Using security groups to restrict inbound traffic to necessary ports and placing the instance in a private subnet without direct internet access are fundamental security best practices. Option B (disabling termination protection) does not prevent unauthorized access. Option D (using a public subnet) increases exposure. Option E (enabling detailed billing) is cost-related, not security.

Answer

Place the instance in a public subnet and rely solely on security groups.

Answer

Disable termination protection so the instance can be easily terminated if compromised.

Answer

Enable detailed billing to monitor instance usage.

Question 7

Which THREE measures can be taken to secure a VPC's network boundary? (Choose three.)

Accepted Answer

Use security groups to control inbound and outbound traffic at the instance level.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level (stateful). They are a fundamental measure for securing the VPC network boundary by allowing only specified traffic to reach the instances, based on rules that evaluate source/destination IP, protocol, and port. This provides a critical layer of defense directly at the compute resource.

Answer

Attach an S3 bucket policy to restrict access to the bucket.

Answer

Attach an internet gateway to the VPC.

Question 8

Which TWO AWS services can be used to encrypt data at rest in an Amazon S3 bucket? (Choose two.)

Accepted Answer

SSE-KMS. Options A and B are correct. Server-Side Encryption with S3-Managed Keys (SSE-S3) and Server-Side Encryption with AWS KMS (SSE-KMS) are both options for encrypting data at rest. Option C (Client-side encryption) is also valid but is not an AWS service; it's done by the client. Option D (SSL/TLS) is for transit. Option E (AWS Shield) is for DDoS protection.

Answer

SSL/TLS

Answer

Client-side encryption

Answer

AWS Shield

Question 9

A company runs a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) in a public subnet, EC2 instances in private subnets for the web tier, and an RDS MySQL database in a private subnet. The security team has noticed that the EC2 instances are receiving traffic from unexpected IP addresses on port 22 (SSH). The instances were launched with a default security group that allowed SSH from 0.0.0.0/0. The security engineer has corrected the security group to allow SSH only from the company's bastion host security group. However, the engineer also wants to implement defense-in-depth by adding a network ACL to the private subnet to block SSH from all sources except the bastion host's private IP (10.0.1.10). The private subnet's current network ACL allows all inbound and outbound traffic. The engineer creates a new network ACL with the following rules: Inbound: Rule 100: Allow SSH from 10.0.1.10/32; Rule 200: Deny SSH from 0.0.0.0/0; Rule *: Deny all. Outbound: Rule 100: Allow all. After associating this new NACL with the private subnet, the engineer finds that SSH connections from the bastion host are still being blocked. What is the most likely cause?

Accepted Answer

The new network ACL was not associated with the private subnet.. Option B is correct. Network ACLs are stateless, meaning that return traffic must be explicitly allowed. The outbound rule only allows all traffic, but the inbound rule denies SSH from 0.0.0.0/0, which would block the return traffic for the SSH session because the source of the response is the instance, not the bastion host. Actually, the issue is that the inbound rule denies SSH from all, but the allow rule for the bastion host should work. However, because NACLs are stateless, the response from the instance to the bastion host would be considered outbound traffic, which is allowed. The real issue is that the NACL rules are evaluated in order; the deny rule (200) might block the bastion host if the allow rule (100) is not matched correctly. But the more likely cause is that the network ACL does not allow ephemeral ports for the return traffic. When the bastion host initiates SSH (source port 22, destination port 22), the response from the instance uses an ephemeral port (1024-65535) as source. The outbound rule allows all traffic, so that should be fine. However, the inbound rule for the ephemeral ports is missing. But the question says the inbound rule denies all SSH, which would block the initial connection from the bastion host? Wait, the inbound rule allows SSH from 10.0.1.10/32, so that should work. The deny rule would block other SSH. The problem might be that the network ACL is not associated correctly. But the most common mistake is forgetting that NACLs are stateless and need rules for ephemeral ports. However, the outbound rule allows all, so that should not be an issue. Let's think: The inbound rule allows SSH from bastion host; the outbound rule allows all. So why would it be blocked? Possibly because the inbound deny rule for SSH from 0.0.0.0/0 also matches the bastion host if the allow rule is not evaluated first? But NACLs are evaluated in order; rule 100 is evaluated before rule 200. So the allow should take precedence. Maybe the issue is that the network ACL is not associated with the subnet, or the bastion host's IP is not exactly 10.0.1.10. However, the most plausible answer among the options is that the network ACL is not associated with the subnet, but the question says the engineer associated it. Option B says the network ACL is not associated with the subnet, which could be the case if the engineer forgot to associate it. Option A (security group still allows SSH from 0.0.0.0/0) would not cause blocking. Option C (outbound rule denies ephemeral ports) is incorrect because outbound is allow all. Option D (NACL rules are out of order) is plausible but the order is correct. Given typical exam logic, the most common mistake is forgetting to associate the NACL. So I'll go with B.

Answer

The outbound rule of the network ACL does not allow ephemeral ports for return traffic.

Answer

The security group on the EC2 instances still allows SSH from 0.0.0.0/0.

Answer

The network ACL rules are out of order; the deny rule should be before the allow rule.

Question 10

A company is using AWS CloudTrail to monitor API activity in their account. They have enabled CloudTrail in all regions and are logging to an S3 bucket. The security team wants to ensure that log files are not tampered with after delivery. They enable CloudTrail log file integrity validation. Which additional step must be taken to verify the integrity of the log files?

Accepted Answer

Use the AWS CLI to run the validate-logs command against the log files.. Option A is correct. CloudTrail log file integrity validation uses digital signatures (SHA-256 hashing and signing with a private key). To verify, you must use the AWS CLI command 'aws cloudtrail validate-logs' or download the public key and verify manually. Option B (enable S3 versioning) helps with object versioning but does not verify integrity. Option C (use KMS to encrypt logs) protects confidentiality but not integrity. Option D (use S3 Object Lock) prevents deletion but not tampering detection.

Answer

Enable S3 versioning on the log bucket.

Answer

Configure the S3 bucket to use server-side encryption with AWS KMS.

Answer

Enable S3 Object Lock on the log bucket.

Question 11

A company has a requirement to block traffic from specific IP addresses known to be malicious. The company has an Application Load Balancer (ALB) that fronts a web application. The security engineer needs to implement a solution that can block these IP addresses at the edge before they reach the ALB. Which AWS service should be used?

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. Option B is correct. AWS WAF can be attached to an ALB and can block traffic based on IP addresses using IP match conditions. Option A (Security groups) are for instance-level and cannot be attached to ALB. Option C (Network ACLs) are for subnets, not ALB. Option D (AWS Shield Advanced) provides DDoS protection but not IP-based blocking.

Answer

Configure security groups on the ALB to deny traffic from those IP addresses.

Answer

Enable AWS Shield Advanced and configure rate-based rules.

Answer

Add a network ACL rule to the ALB's subnet to deny the IP addresses.

Question 12

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can download objects. Which combination of actions should the company take? (Choose TWO.)

Accepted Answer

Create an S3 bucket policy that allows access only from the VPC using the aws:SourceVpc condition.. Option A (S3 bucket policy with aws:SourceVpc condition) and Option C (VPC endpoint for S3) are correct. The bucket policy with the aws:SourceVpc condition restricts access to requests originating from the specified VPC, and the VPC endpoint allows private connectivity to S3 from that VPC. Option B (Internet gateway) would allow public access. Option D (NAT gateway) is for outbound traffic. Option E (Security group on S3) is not applicable.

Answer

Attach an Internet gateway to the VPC and route traffic through it.

Answer

Attach a security group to the S3 bucket.

Answer

Create a NAT gateway in the VPC for outbound traffic.

Question 13

A security engineer is designing a multi-tier web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The engineer needs to ensure that the EC2 instances only accept traffic from the ALB and not from any other source. Which security group configuration should the engineer use?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group on the EC2 instances' security group.. Option B is correct because referencing the ALB's security group as the source allows inbound traffic only from the ALB. Option A allows all HTTP traffic. Option C uses the VPC CIDR, which is too broad. Option D uses the ALB's public IP, which is not static and not recommended.

Answer

Allow inbound HTTP traffic from the ALB's public IP address on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from the VPC CIDR range on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 instances' security group.

Question 14

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The security group for the NAT gateway does not allow inbound traffic from the private subnets.. Option D is correct because the NAT gateway's security group must allow inbound traffic from the private subnets to receive return traffic. Option A is incorrect because the NAT gateway automatically responds. Option B is incorrect because network ACLs are stateless and require inbound rules for return traffic. Option C is incorrect because the private subnets' route table must have a route to the NAT gateway.

Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Answer

The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.

Question 15

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?

Accepted Answer

AWS Key Management Service (KMS). Option A is correct. AWS KMS is used to manage encryption keys for RDS encryption at rest. Option B (SSL/TLS) is for data in transit. Option C (RDS encryption) is a feature but uses KMS. Option D (S3 server-side encryption) is for S3, not RDS.

Answer

Amazon S3 server-side encryption

Answer

RDS encryption feature

Answer

SSL/TLS certificates

SCS-C02 Infrastructure Security Practice Test 10 — 15 Questions

Exhibit

SCS-C02 Infrastructure Security Practice Test 10 — 15 Questions

Exhibit