SCS-C02 Infrastructure Security Practice Test 11 — 15 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The security team wants to inspect all traffic between VPCs before it reaches its destination. Which architecture should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Transit Gateway with a central inspection VPC that hosts security appliances and route all inter-VPC traffic through it.. AWS Transit Gateway can route inter-VPC traffic through a central inspection VPC that hosts security appliances (e.g., firewalls, IDS/IPS). By attaching the Transit Gateway to the inspection VPC and configuring route tables to force all traffic between VPCs to pass through the inspection VPC, the security team can inspect all traffic before it reaches its destination. This architecture provides centralized, scalable traffic inspection without requiring traffic to leave the AWS network.

Answer

Use a VPN CloudHub to connect VPCs and inspect traffic at the VPN endpoint.

Answer

Use AWS Direct Connect to connect VPCs and inspect traffic on-premises.

Answer

Use VPC Peering and configure security groups on each VPC to allow only necessary traffic.

Question 2

A company wants to allow only specific IP addresses to access an S3 bucket. Which two methods can achieve this? (Choose TWO.)

Accepted Answer

Use an IAM policy with a condition that limits access to specific IP addresses.. Option A is correct because an IAM policy can include a Condition element using the aws:SourceIp (or aws:SourceIp with NotIpAddress) key to allow or deny requests based on the requester's IP address, effectively restricting access to specific IPs for the identities the policy is attached to. Option E is correct because an S3 bucket policy is a resource-based policy that can also use the aws:SourceIp condition key to allow only specified IP addresses to access the bucket, which is the most direct way to enforce IP restrictions on the bucket itself. Option B is not correct because a network ACL operates at the subnet level and filters traffic by IP/port for resources in a VPC, but it cannot govern access to an S3 bucket endpoint (especially public S3 endpoints) and does not apply to bucket-level authorization. Option C is not correct because VPC Flow Logs only capture and record IP traffic metadata for monitoring; they do not filter or block traffic. Option D is not correct because security groups are attached to network interfaces (such as EC2 instances) and cannot be attached to an S3 bucket, and S3 does not use security groups for access control.

Answer

Configure a network ACL on the subnet that blocks traffic from all but specific IPs.

Answer

Enable VPC Flow Logs to filter traffic from specific IPs.

Answer

Attach a security group to the S3 bucket that allows traffic only from specific IPs.

Question 3

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Accepted Answer

An internet gateway attached to the VPC.. Option B is correct because an internet gateway (IGW) attached to the VPC is the fundamental component that enables any communication between the VPC and the internet; the NAT gateway itself requires an IGW to forward traffic outbound. Option E is correct because a NAT gateway must be deployed in a public subnet (one whose route table points to the IGW) so it can translate private subnet traffic to the internet while preventing inbound connections to the databases. Option C is correct because the private subnet route tables must contain a default route (0.0.0.0/0) targeting the NAT gateway, which is how the databases' outbound packets are directed to the NAT for translation. Option A is not required because AWS WAF is a layer 7 web application firewall that protects web applications and does not enable or provide outbound internet access. Option D is not required because a VPC gateway endpoint for S3 only provides private connectivity to Amazon S3 and does not provide general outbound internet access.

Answer

AWS WAF attached to the NAT gateway.

Answer

A VPC gateway endpoint for S3.

Question 4

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Use an HTTPS listener on the ALB and configure the target group with HTTPS.. It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Answer

Use a TCP listener on the ALB and a TCP target group.

Answer

Configure security group inbound rules to allow only HTTPS traffic.

Answer

Use an HTTP listener on the ALB and HTTP on the target group.

Question 5

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service provides a managed, highly available, and scalable solution for this requirement?

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway is a managed AWS service that provides outbound-only internet access for instances in private subnets. It is highly available within an Availability Zone (AZ) and scales automatically up to 45 Gbps, making it the ideal solution for private subnet internet access without the management overhead of a NAT instance.

Answer

NAT instance in a public subnet

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 6

A company is designing a network architecture for a multi-tier web application. The application consists of a public-facing ALB, web servers in private subnets, and an RDS database in isolated subnets. The security team requires that the web servers have no direct internet access. Which VPC configuration meets this requirement?

Accepted Answer

Private subnets with a NAT Gateway in a public subnet.. Placing web servers in private subnets with a NAT Gateway in a public subnet allows them to initiate outbound connections to the internet (e.g., for software updates) while preventing any inbound internet traffic from reaching them directly. The NAT Gateway translates private IPs to the public IP of the gateway, and the private subnets' route table points 0.0.0.0/0 to the NAT Gateway, not an Internet Gateway, ensuring no direct internet access.

Answer

Public subnets with an Internet Gateway.

Answer

Isolated subnets with no route to the internet.

Answer

Private subnets with a VPN connection to the corporate network.

Question 7

A company wants to use AWS WAF to protect its web application from common web exploits. Which AWS service must be integrated with AWS WAF to provide this protection?

Accepted Answer

Application Load Balancer or Amazon CloudFront. AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at Layer 7. It must be integrated with a service that can terminate HTTP/HTTPS connections and forward the traffic to WAF for inspection. Both Application Load Balancer (ALB) and Amazon CloudFront support this integration, allowing WAF to filter requests based on rules such as SQL injection or cross-site scripting. Security Groups and Network ACLs operate at the network and transport layers (Layers 3/4) and cannot provide Layer 7 inspection.

Answer

Security Groups

Answer

Amazon Route 53

Answer

Network ACLs

Question 8

A security engineer is designing a network segmentation strategy for a VPC that hosts sensitive data. The engineer needs to ensure that EC2 instances in a private subnet can communicate with an RDS database in a different private subnet, but cannot communicate with any other resources in the same VPC. Which configuration should be used?

Accepted Answer

Configure security groups for the EC2 instances that only allow outbound traffic to the RDS security group, and RDS security group allows inbound from the EC2 security group.. Security groups act as a virtual firewall at the instance level, allowing stateful traffic filtering. By configuring the EC2 security group to allow outbound traffic only to the RDS security group (using the security group ID as the destination), and the RDS security group to allow inbound traffic only from the EC2 security group, you create a precise, bidirectional allowlist. This ensures that EC2 instances can communicate exclusively with the RDS database, blocking all other traffic within the VPC without relying on IP addresses or subnet CIDRs.

Answer

Create a VPC peering connection between the subnets.

Answer

Assign the same security group to both the EC2 instances and the RDS database.

Answer

Use network ACLs with deny rules for all traffic except between the two subnets.

Question 9

A company uses AWS CloudFormation to deploy infrastructure. The security team needs to ensure that all CloudFormation stacks include a specific tag with a value that complies with corporate policies. Which AWS service can enforce this requirement?

Accepted Answer

AWS Service Catalog. AWS Service Catalog allows administrators to create and manage a portfolio of approved products (e.g., CloudFormation templates) with predefined constraints. One such constraint is a tag option, which enforces that every provisioned product (i.e., CloudFormation stack) includes a specific tag key and value, ensuring compliance with corporate policies. This is the only service among the options that can directly enforce mandatory tagging on CloudFormation stacks at provisioning time.

Answer

AWS Config

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Question 10

A company uses AWS Organizations and wants to restrict the use of specific instance types across all accounts. Which TWO actions should be taken to enforce this restriction?

Accepted Answer

Apply a Service Control Policy (SCP) that denies ec2:RunInstances with noncompliant instance types.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By applying an SCP that denies ec2:RunInstances when the instance type does not match an allowed list, you can effectively prevent any user or role in any account from launching noncompliant instance types, even if they have full IAM permissions to do so.

Answer

Restrict instance types at the VPC level using network ACLs.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Create an IAM role that denies launch of noncompliant instances.

Question 11

A security engineer is designing a secure VPC architecture for a web application that must be accessible from the internet. The application runs on EC2 instances in private subnets. Which THREE components are required to provide secure internet connectivity?

Accepted Answer

Public subnets with routes to the IGW. A is correct because public subnets require routes to the Internet Gateway (IGW) in their route tables to allow traffic from the internet to reach resources in those subnets. For the web application's EC2 instances in private subnets to initiate outbound internet connectivity (e.g., for software updates), a NAT Gateway must be placed in a public subnet with a route to the IGW, and the private subnet's route table must point 0.0.0.0/0 traffic to the NAT Gateway. The IGW attached to the VPC is the foundational component that enables bidirectional internet traffic for the VPC, but it must be explicitly associated with route tables of public subnets.

Answer

Virtual Private Gateway (VGW)

Answer

Transit Gateway

Question 12

A security engineer needs to ensure that all data stored in an Amazon S3 bucket is encrypted at rest. The bucket must use server-side encryption with a key managed by the customer (SSE-C). What must the engineer include in the PUT request to enforce this?

Accepted Answer

x-amz-server-side-encryption-customer-algorithm and x-amz-server-side-encryption-customer-key. SSE-C requires the client to provide both the encryption algorithm and the encryption key in the PUT request headers. The `x-amz-server-side-encryption-customer-algorithm` header must be set to `AES256`, and the `x-amz-server-side-encryption-customer-key` header must contain the base64-encoded 256-bit key. Without these headers, S3 will not apply customer-provided encryption keys, and the object will not be encrypted with SSE-C.

Answer

x-amz-server-side-encryption: AES256

Answer

x-amz-server-side-encryption: aws:kms

Answer

x-amz-server-side-encryption-bucket-key-enabled: true

Question 13

A company has deployed a multi-tier web application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The security team wants to ensure that the application servers cannot initiate outbound connections to the internet. What should the team do?

Accepted Answer

Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.. Removing the default route (0.0.0.0/0) from the private subnet's route table ensures that any traffic destined for the internet has no valid path, effectively preventing application servers from initiating outbound internet connections. Network ACLs and security groups are stateful or stateless filters but do not control routing; without a route, packets cannot leave the subnet regardless of allow rules. This aligns with the principle of using route tables to enforce network segmentation in a multi-tier architecture.

Answer

Add a deny rule for all outbound traffic in the network ACL of the private subnet.

Answer

Modify the security group of the application servers to deny all outbound traffic.

Answer

Attach an egress-only internet gateway to the private subnet.

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that no sensitive data, such as database passwords, is exposed in plaintext in the CloudFormation templates. What is the MOST secure way to handle secrets?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager with dynamic references in the template.. AWS Systems Manager Parameter Store and AWS Secrets Manager support dynamic references in CloudFormation templates, allowing you to reference secret values without exposing them in plaintext. CloudFormation resolves these references at deployment time, retrieving the actual secret value from the secure store, and never stores the secret in the template or stack metadata. This approach ensures secrets are managed, rotated, and audited centrally, adhering to security best practices.

Answer

Use AWS KMS to encrypt the secrets and include the ciphertext in the template.

Answer

Store the secrets in an encrypted S3 bucket and include the S3 URL in the template.

Answer

Pass the secrets as plaintext parameters to the stack at launch time.

Question 15

A company's security team discovers that an Amazon EC2 instance has been compromised and is sending outbound traffic to a known malicious IP address. The instance is in a VPC with a security group that allows all outbound traffic. What is the FASTEST way to stop the outbound traffic without affecting other instances?

Accepted Answer

Modify the security group attached to the instance to revoke all outbound rules.. Security groups are stateful and act as a virtual firewall at the instance level. By revoking all outbound rules in the security group attached to the compromised EC2 instance, you immediately block all outbound traffic from that specific instance without affecting any other instances in the VPC. This is the fastest and most targeted action because it requires no changes to subnet-level configurations or instance termination.

Answer

Modify the network ACL of the subnet to deny outbound traffic to the malicious IP.

Answer

Change the route table of the subnet to route traffic to a blackhole.

Answer

Terminate the compromised EC2 instance immediately.