SCS-C02 Infrastructure Security Practice Test 11 — 15 Questions

Question 1

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

Accepted Answer

Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.. Option C is correct. If an instance in a private subnet is assigned a public IP, it still cannot access the internet directly because the route table does not have a route to the Internet Gateway. The correct approach is to not assign a public IP and use a NAT gateway. Option A is wrong because the route table is correct for a private subnet. Option B is wrong because the security group is not the issue. Option D is wrong because the IGW is already attached.

Answer

Attach an Elastic IP to the instance.

Answer

Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.

Answer

Allow outbound traffic in the instance's security group.

Question 2

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

Accepted Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.. Option D is correct. To encrypt traffic between ALB and EC2, you must use HTTPS listeners on both sides: the ALB listener for frontend and the target group protocol for backend. Option A uses TCP, which is not encrypted. Option B only encrypts the frontend. Option C uses HTTP, not encrypted.

Answer

Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.

Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.

Answer

Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.

Question 3

A company wants to allow an EC2 instance to access an S3 bucket without exposing the instance to the internet. Which AWS service should be used to achieve this?

Accepted Answer

VPC Endpoint (Gateway type) for S3. Option B is correct. A VPC endpoint for S3 allows private connectivity between the VPC and S3 without internet access. Option A (Internet Gateway) would expose the instance. Option C (NAT Gateway) is for outbound internet. Option D (VPN) is for on-premises connectivity.

Answer

NAT Gateway

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway

Question 4

A security engineer is reviewing the security group rules for a web server. The security group currently has the following inbound rules: allow HTTP from 0.0.0.0/0, allow HTTPS from 0.0.0.0/0, and allow SSH from 0.0.0.0/0. Which change should the engineer make to improve security?

Accepted Answer

Change the SSH rule to allow from a specific IP range used by the company's administrators.. Option D is correct. SSH should be restricted to specific IPs (e.g., corporate network) to prevent unauthorized access. Option A is unnecessary if the rules already exist. Option B would break functionality. Option C is not sufficient; SSH should be restricted.

Answer

Remove the HTTP rule and keep only HTTPS.

Answer

Change the SSH rule to allow from the VPC CIDR only.

Answer

Add a rule to allow ICMP from 0.0.0.0/0.

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16. They have two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). They have an Application Load Balancer in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access the internet for updates. The security engineer has set up a NAT gateway in each public subnet. The route table for the private subnets has a default route pointing to the NAT gateway in the same Availability Zone. However, the EC2 instances are unable to reach the internet. What is the most likely cause?

Accepted Answer

The route tables for the public subnets do not have a default route (0.0.0.0/0) to the Internet Gateway.. Option C is correct. Each NAT gateway must be in a public subnet with a route to the Internet Gateway. If the route table for the public subnet where the NAT gateway resides does not have a default route to the IGW, the NAT gateway cannot forward traffic. Option A is incorrect because each NAT gateway can be in a different AZ. Option B is incorrect because route propagation is for VPN. Option D is incorrect because security groups allow outbound by default.

Answer

The security groups for the EC2 instances do not allow outbound traffic.

Answer

The NAT gateways do not have route propagation enabled.

Answer

The NAT gateways are in the same Availability Zone.

Question 6

A company is using AWS Systems Manager Session Manager to provide secure shell access to EC2 instances without opening inbound ports. Which of the following is a requirement for this setup?

Accepted Answer

The EC2 instance must have an IAM role that allows SSM actions.. Option B is correct. Session Manager requires an SSM Agent installed on the EC2 instance and an IAM role that allows the agent to communicate with the Systems Manager service. Option A is not required; Session Manager works without SSH. Option C is not required; Session Manager uses the AWS API. Option D is not required; security groups can still be restrictive.

Answer

The EC2 instance must be in a public subnet.

Answer

The EC2 instance must have a public IP address.

Answer

The security group must allow inbound SSH from 0.0.0.0/0.

Question 7

A security engineer is configuring a VPC for a web application. The VPC has public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The engineer wants to ensure that the database servers are not accessible from the internet. Which two actions should the engineer take?

Accepted Answer

Ensure the route table for the database subnets does not have a default route to an Internet Gateway.. Option A and Option D are correct. The database subnets should not have a route to the Internet Gateway, and their security group should only allow traffic from the web servers' security group. Option B is unnecessary; network ACLs are stateless and can be used, but security groups are sufficient. Option C is incorrect because assigning public IPs would expose them. Option E is incorrect because a NAT gateway is for outbound internet access, not inbound.

Answer

Place the database instances in a public subnet with a NAT gateway.

Answer

Assign public IP addresses to the database instances.

Answer

Configure a network ACL on the database subnets to deny all inbound traffic.

Question 8

A security engineer is reviewing the security of an Amazon EKS cluster. The cluster is used to run containerized applications. Which three actions should the engineer take to improve the security of the cluster?

Accepted Answer

Restrict access to the cluster using AWS IAM authentication for kubectl.. Options A, C, and E are correct. Enabling audit logging helps monitor API calls. Restricting kubectl access via IAM ensures only authorized users can manage the cluster. Using a private endpoint for the API server prevents exposure to the internet. Option B is incorrect because using the default VPC is not inherently insecure; custom VPCs can be used. Option D is incorrect because cluster-admin is too permissive; least privilege should be applied.

Answer

Use the default VPC for the cluster.

Answer

Grant the cluster-admin role to all developers.

Question 9

A security engineer needs to protect an S3 bucket that contains sensitive data. Which two methods should the engineer use?

Accepted Answer

Apply an S3 bucket policy that restricts access to specific IAM users or roles.. Option C is correct because an S3 bucket policy is a resource-based policy that can explicitly restrict access to specific IAM users or roles, providing a direct mechanism to control who can access the bucket and its objects. This is essential for protecting sensitive data by ensuring only authorized principals can perform actions like s3:GetObject or s3:PutObject, regardless of other permissions.

Answer

Use Amazon CloudFront to serve the content.

Answer

Enable VPC Flow Logs on the bucket.

Answer

Enable S3 object ACLs.

Question 10

A company is considering using AWS Shield Advanced to protect against DDoS attacks. Which three features are included with AWS Shield Advanced? (Choose THREE.)

Accepted Answer

Cost protection against DDoS-related scaling charges. Options A, C, and E are correct. AWS Shield Advanced includes 24/7 access to the DDoS Response Team (DRT), cost protection against scaling charges, and integration with AWS WAF for web ACLs. Option B is incorrect because AWS Shield Advanced does not include a VPN. Option D is incorrect because dedicated IP addresses are not a feature of Shield Advanced.

Answer

Dedicated IP addresses for EC2 instances

Answer

AWS Site-to-Site VPN

Question 11

A company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Application Load Balancer (ALB) to distribute traffic. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0 and a security group for the EC2 instances that allows inbound HTTP from the ALB's security group. Recently, the company experienced a security incident where an attacker exploited a vulnerability in the application to gain access to an EC2 instance and then moved laterally to the database. The database is in a private subnet and uses a security group that allows inbound traffic from the EC2 instance security group on port 3306 (MySQL). The security team wants to prevent lateral movement in the future. Which of the following is the MOST effective course of action?

Accepted Answer

Implement a host-based firewall on each EC2 instance to restrict outbound connections to only the database endpoint.. Option C is correct because implementing a host-based firewall (e.g., AWS Systems Manager Agent with a firewall policy) on each EC2 instance can restrict outbound connections from the application to only necessary destinations, preventing lateral movement. Option A (network ACLs) can block traffic at the subnet level but are not as granular for individual instances. Option B (VPC peering) is not relevant. Option D (AWS WAF) protects against web exploits but does not prevent lateral movement after compromise.

Answer

Use VPC peering to isolate the database subnet from the application subnet.

Answer

Deploy AWS WAF in front of the ALB to block known malicious IPs.

Answer

Create a network ACL for the private subnet that denies outbound traffic from the EC2 instances to the database subnet.

Question 12

A company is migrating its on-premises data center to AWS. The company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect its on-premises network (192.168.0.0/16) to the VPC using an AWS Site-to-Site VPN. The security engineer has configured the virtual private gateway (VGW) and the customer gateway (CGW) with the correct settings. The VPN tunnel status is UP, but the on-premises servers cannot ping the EC2 instances in the VPC. The EC2 instances have security groups that allow ICMP traffic from the on-premises network. The VPC route table has a route for the on-premises network pointing to the VGW. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway.. Option A is correct. The VPC route table needs a route for the on-premises CIDR pointing to the VGW. If this route is missing, traffic from the VPC to on-premises will not be routed correctly. Option B is incorrect because security groups are stateful and allow return traffic. Option C is not required if the VPN is configured correctly. Option D is incorrect because the VGW is the correct target.

Answer

The customer gateway is not configured with the correct public IP address of the VGW.

Answer

The VPN tunnel is not configured with the correct pre-shared key.

Answer

The security group for the EC2 instances does not allow inbound ICMP from the on-premises network.

Question 13

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with server-side encryption (SSE-S3) and that no public access is allowed. The team has created an SCP that denies the s3:PutBucketPublicAccessBlock action and also denies s3:PutBucketPolicy if the policy would grant public access. However, the team discovers that some buckets in the production account still have public access enabled. The SCP is applied to the root OU, which includes the production account. What is the most likely reason that the SCP is not being enforced?

Accepted Answer

The production account is the management account of the organization, and SCPs do not affect the management account.. Option C is correct. SCPs do not affect the management account; they only apply to member accounts. If the production account is the management account, SCPs will not apply. Option A is incorrect because SCPs don't require explicit allow; they deny by default if not allowed. Option B is incorrect because SCPs affect all IAM principals in the account. Option D is incorrect because SCPs can be applied to OUs.

Answer

The SCP does not have an explicit allow for the actions it denies; SCPs require an explicit allow to take effect.

Answer

The SCP only applies to IAM users and roles, not to the root user.

Answer

The SCP is not attached to the production account's OU; it is attached to the root OU.

Question 14

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?

Accepted Answer

There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.. Option D is correct. AWS WAF evaluates rules in order, and if a rule with a higher priority allows the request, it will not be blocked by a lower priority rule. The team may have an allow rule with higher priority that allows all requests. Option A is incorrect because WAF can inspect headers. Option B is incorrect because WAF can be used with ALB. Option C is incorrect because WAF can handle regex.

Answer

AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.

Answer

AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.

Answer

The regex pattern for the token is too complex for AWS WAF to process.

Question 15

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

Accepted Answer

Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.. Option B is correct. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Answer

Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.

Answer

Add a network ACL to the private subnet that denies inbound HTTP traffic.