SCS-C02 Infrastructure Security Practice Test 11 — 15 Questions

Question 1

A company uses AWS Systems Manager Session Manager to manage EC2 instances. The security team wants to ensure that all SSH sessions are logged and that commands are recorded. What should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable session logging in the Session Manager preferences to send logs to Amazon S3 and CloudWatch Logs. Session Manager preferences allow logging session activity to Amazon S3 and CloudWatch Logs, which records all commands run during SSH sessions. Option B is incorrect because security groups control network access, not logging. Option C is incorrect because CloudTrail logs API calls to Systems Manager, not the commands executed within a session. Option D is incorrect because an IAM policy only controls permissions to start sessions, not the logging of session activity.

Answer

Configure the security group to allow inbound SSH from the Session Manager service

Answer

Enable AWS CloudTrail to log Systems Manager API calls

Answer

Create an IAM policy that allows ssm:StartSession and attach it to the instance role

Question 2

A security engineer needs to ensure that an EC2 instance can only be accessed using SSH key pairs, not passwords. Which configuration is required?

Accepted Answer

Set 'PasswordAuthentication no' in /etc/ssh/sshd_config on the EC2 instance. SSH password authentication is controlled by the `PasswordAuthentication` directive in `/etc/ssh/sshd_config`. Setting it to `no` disables password-based logins, forcing users to authenticate using SSH key pairs (public-key cryptography). This is the standard, OS-level method to enforce key-only SSH access on an EC2 instance.

Answer

Use EC2 Instance Connect instead of SSH

Answer

Attach an IAM role to the instance that denies password-based access

Answer

Configure the security group to allow SSH only from specific IP addresses

Question 3

A company uses AWS WAF to protect a web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match rule. AWS WAF provides a dedicated SQL injection match rule that inspects incoming requests for SQL injection patterns in the URI, query string, or body. This rule uses a set of predefined SQL-like patterns (e.g., 'OR 1=1', 'UNION SELECT') to detect and block malicious input, directly addressing the security team's requirement.

Answer

IP set rule

Answer

Geographic match rule

Answer

Rate-based rule

Question 4

A company wants to allow cross-account access to an S3 bucket. The bucket owner (Account A) wants to grant read-only access to users in Account B. Which combination of policies is required?

Accepted Answer

A bucket policy in Account A granting s3:GetObject to Account B and an IAM policy in Account B allowing s3:GetObject. Cross-account access to S3 requires a resource-based policy (bucket policy) in the account that owns the bucket (Account A) granting the desired permissions to the principal in Account B, and an identity-based policy (IAM policy) in the accessing account (Account B) that allows the user or role to perform the action (s3:GetObject). Option A is incorrect because bucket ACLs are legacy and do not provide the same level of control; they cannot grant access to accounts in a way that works with IAM policies alone. Option C is incorrect because an IAM policy in Account A would only grant permissions to entities within Account A, not to users in Account B. Option D is incorrect because an IAM role in Account B would allow Account A to access Account B's resources, not the reverse; the role would need to be in Account A to be assumed by Account B users.

Answer

A bucket ACL in Account A granting READ access to Account B

Answer

An IAM policy in Account A that allows s3:GetObject

Answer

An IAM role in Account B that grants s3:GetObject to Account A

Question 5

A security engineer needs to audit all changes to AWS resources in an account. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and changes to AWS resources as events, providing an audit log of who made what change, when, and from where. This directly meets the requirement to audit all changes, as every AWS API call (e.g., CreateInstance, ModifySecurityGroup) is captured in a CloudTrail event history or delivered to an S3 bucket for long-term analysis.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

A company is designing a VPC with multiple subnets. The security team wants to ensure that traffic between the application tier and database tier is encrypted in transit. Which TWO actions should be taken?

Accepted Answer

Enable encryption on the database connections using TLS/SSL. The correct answers are B and D. Option B, enabling TLS/SSL for database connections, encrypts data in transit. Option D, configuring the application to use an encrypted protocol, ensures end-to-end encryption. Options A, C, and E are incorrect: attaching an internet gateway does not encrypt traffic; security group rules restrict access but do not encrypt; and VPC peering does not provide encryption by default.

Answer

Attach an internet gateway to the database subnet

Answer

Use security group rules to restrict traffic to the database port

Answer

Use VPC Peering to connect the subnets

Question 7

A security engineer is configuring an AWS WAF web ACL for an Application Load Balancer. The engineer wants to block requests that contain cross-site scripting (XSS) and also limit the rate of requests from a single IP. Which THREE rule groups should be added?

Accepted Answer

Rate-based rule. Options B, C, and D are correct. A Rate-based rule (B) limits the rate of requests from a single IP, meeting the rate-limiting requirement. The AWS Managed Rules for SQL injection (C) and Cross-site scripting (D) directly address the XSS and SQL injection threats. Option A (IP reputation) blocks based on known malicious IPs, not rate or XSS. Option E (Geographic match) restricts by location, not behavior.

Answer

AWS Managed Rules - IP reputation rule group

Answer

Geographic match rule

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation have encryption enabled by default. Which TWO approaches can achieve this?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket encryption and auto-remediates. An AWS Config rule can check that S3 buckets have encryption enabled and automatically remediate any non-compliant buckets. Option C is correct because a service control policy (SCP) can be attached to the root OU to deny the creation of S3 buckets without encryption, using a condition on the s3:x-amz-server-side-encryption header. Option B is incorrect because S3 Block Public Access does not enforce encryption. Option D is incorrect because attaching an IAM role to CloudFormation only grants permissions but does not enforce encryption. Option E is incorrect because CloudFormation stack policies only protect existing resources from updates and cannot enforce conditions on bucket creation.

Answer

Enable S3 Block Public Access at the account level

Answer

Attach an IAM role to the CloudFormation service that grants permissions to encrypt buckets

Answer

Use a CloudFormation stack policy to deny creation of S3 buckets without encryption

Question 9

A company is designing a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates but cannot be directly accessed from the internet. Which AWS service or feature should be used to meet this requirement?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound traffic from the internet. An Internet Gateway (option D) would allow inbound traffic, which is not allowed. VPC Peering (option B) and AWS VPN (option C) do not provide internet access.

Answer

VPC Peering

Answer

AWS VPN

Answer

Internet Gateway

Question 10

A security engineer is troubleshooting connectivity issues from an EC2 instance in a private subnet to an S3 bucket. The instance has a security group allowing outbound HTTPS (443) to 0.0.0.0/0, and the subnet's network ACL allows outbound HTTPS to 0.0.0.0/0. However, requests to S3 are timing out. Which additional configuration is most likely required?

Accepted Answer

Add a VPC Gateway Endpoint for S3 and update the route table. S3 can be reached privately from a VPC by creating a VPC Gateway Endpoint for S3 and adding a route to the S3 prefix list in the subnet's route table. A private subnet without a NAT gateway or internet gateway route cannot reach the public S3 endpoint, causing timeouts. Option A is wrong because an IAM role grants authorization; missing S3 permissions would cause Access Denied, not a timeout. Option B is wrong because S3 is not accessed by manually adding region-specific IP ranges to a security group, and the security group already permits all outbound HTTPS. Option D is wrong because a TLS termination proxy does not provide network connectivity or routing to S3.

Answer

Attach an IAM role to the EC2 instance with S3 permissions

Answer

Modify the security group to allow traffic to the S3 region-specific IP range

Answer

Configure a TLS termination proxy

Question 11

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should be used?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. S3 bucket policies support the `aws:SourceVpc` condition key, which allows you to restrict access to requests originating from a specific VPC. This works by evaluating the VPC ID from which the request was made, using the source VPC information that AWS automatically includes in requests from VPC endpoints. No other mechanism (security groups, IAM source IP conditions, or network ACLs) can directly enforce VPC-level access control on S3.

Answer

Security group assigned to the S3 bucket

Answer

IAM policy with aws:SourceIp condition

Answer

Network ACL attached to the S3 bucket

Question 12

A company wants to allow an EC2 instance to access a DynamoDB table without traversing the internet. Which AWS feature should be used?

Accepted Answer

VPC Gateway Endpoint for DynamoDB. A VPC Gateway Endpoint for DynamoDB allows EC2 instances within a VPC to access DynamoDB without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, ensuring low latency and enhanced security by keeping traffic within the AWS backbone.

Answer

VPC Peering

Answer

ClassicLink

Answer

NAT Gateway

Question 13

A company has a requirement to log all network traffic flowing through a VPC, including traffic between EC2 instances within the same subnet. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs is the correct service to log all network traffic flowing through a VPC, including traffic between EC2 instances within the same subnet. It captures IP traffic information at the VPC, subnet, or elastic network interface level. Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs and other data sources but does not log traffic itself. AWS Config records resource configuration changes and evaluates them against desired configurations, not network traffic. AWS CloudTrail logs API calls made within the AWS environment, not network traffic.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 14

A security engineer is configuring a security group for a web server that should only accept HTTPS traffic from the internet. Which inbound rule should be set?

Accepted Answer

TCP port 443 from 0.0.0.0/0. HTTPS uses TCP port 443, which must be open to the internet (0.0.0.0/0) for web traffic. Option A is incorrect because port 3389 is used by RDP, not HTTPS. Option B is incorrect because port 22 is used by SSH for secure shell access, not web traffic. Option C is incorrect because port 80 is used by HTTP, not HTTPS.

Answer

TCP port 3389 from 0.0.0.0/0

Answer

TCP port 22 from 0.0.0.0/0

Answer

TCP port 80 from 0.0.0.0/0

Question 15

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be used?

Accepted Answer

Set up an IPsec VPN over the Direct Connect connection. Direct Connect does not natively encrypt traffic; it provides a private, low-latency connection but the data traverses it in cleartext. By establishing an IPsec VPN tunnel over the Direct Connect link (often called a 'Direct Connect VPN' or using a virtual private gateway with a VPN attachment), you encrypt all traffic between on-premises and the VPC at the network layer, meeting the security team's requirement for encryption.

Answer

Enable encryption on the Direct Connect virtual interface

Answer

Use VPC Peering with encryption

Answer

Configure TLS on all applications