SCS-C02 Infrastructure Security Practice Test 12 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is configured to terminate SSL/TLS and forward traffic to the instances over HTTP. The security team wants to ensure that the instances only accept traffic from the ALB, not from any other source. How can this be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the instance security group to allow HTTP traffic only from the ALB's security group.. Referencing the ALB's security group in the instance security group rule allows traffic only from the ALB, regardless of the ALB's IP address changes. This leverages AWS security group referencing, which is a managed and scalable way to restrict traffic to a specific source security group. The ALB's security group acts as a logical identifier, ensuring that only traffic forwarded by the ALB reaches the instances.

Answer

Configure the instance security group to allow HTTP traffic only from the VPC CIDR block.

Answer

Configure the network ACL on the instance's subnet to allow HTTP traffic only from the ALB's private IP address.

Answer

Configure the instance security group to allow HTTP traffic only from the subnet CIDR block where the ALB resides.

Question 2

A company is designing a network architecture for a critical application that must meet strict compliance requirements. The application consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The instances need to access an Amazon RDS database in a different VPC. The company wants to minimize exposure to the internet. Which solution should the company use?

Accepted Answer

Use a VPC Peering connection between the two VPCs.. VPC Peering establishes a private, direct network connection between two VPCs using AWS's internal infrastructure, with no exposure to the internet. Traffic stays within the AWS global network, meeting strict compliance requirements for minimizing internet exposure. This allows EC2 instances in the application VPC to communicate with the RDS database in the database VPC securely and with low latency, using private IP addresses.

Answer

Use a site-to-site VPN connection between the VPCs.

Answer

Use a NAT gateway in the database VPC and route traffic through it.

Answer

Use an internet gateway and route traffic over the internet with security groups.

Question 3

A company wants to allow a developer to launch EC2 instances only in a specific subnet. The developer should not be able to use any other subnet. Which IAM policy action should be used to enforce this?

Accepted Answer

ec2:RunInstances. The ec2:RunInstances action is the correct IAM action to control EC2 instance launches. By attaching a condition key such as ec2:SubnetId to the ec2:RunInstances action in an IAM policy, you can restrict the developer to launching instances only in a specific subnet. Other actions like ModifySubnetAttribute, CreateTags, or DescribeSubnets do not govern the launch of new instances.

Answer

ec2:ModifySubnetAttribute

Answer

ec2:CreateTags

Answer

ec2:DescribeSubnets

Question 4

A security engineer is designing a VPC with public and private subnets. The private subnets must be able to download software updates from the internet. Which TWO components can provide this functionality without exposing the private instances to inbound internet traffic?

Accepted Answer

NAT gateway. A NAT gateway is a managed AWS service that enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for downloading software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address, allowing return traffic to be routed back correctly. This meets the requirement of outbound-only internet access without exposing private instances to inbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Egress-only internet gateway

Question 5

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are protected from unauthorized access and deletion. Which TWO actions should be taken?

Accepted Answer

Enable server-side encryption using AWS KMS (SSE-KMS) on the S3 bucket.. Enabling server-side encryption using AWS KMS (SSE-KMS) on the S3 bucket that stores CloudTrail logs ensures that the log files are encrypted at rest, protecting them from unauthorized access. This encryption uses envelope encryption with a customer-managed or AWS-managed KMS key, providing an additional layer of access control via KMS key policies and IAM policies. Option C is correct because CloudTrail log file validation creates a signed digest file for each log file, allowing you to verify that the logs have not been tampered with, deleted, or modified after delivery. This uses SHA-256 hashing and digital signing with the private key of AWS, ensuring integrity and authenticity of the log files.

Answer

Use S3 bucket ACLs to restrict access.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) for CloudTrail.

Question 6

Refer to the exhibit. The bucket policy allows access from a specific IP range and denies access over HTTP. A user from IP 198.51.100.5 makes a GET request over HTTPS. What will happen?

Accepted Answer

Denied because no explicit allow matches the request.. In AWS S3 bucket policies, an explicit Deny always overrides any Allow, but the request must first match a Deny condition. Here, the Deny condition applies to HTTP requests, but the request is HTTPS, so the Deny does not apply. However, the bucket policy only allows access from a specific IP range, and the user's IP (198.51.100.5) is not within that allowed range. Since no explicit Allow matches the request, the default implicit Deny applies, resulting in access being denied.

Answer

Denied because of the explicit Deny statement.

Answer

Allowed because the request is over HTTPS.

Answer

Allowed because the Deny condition is not satisfied.

Question 7

Refer to the exhibit. A security engineer runs the iptables command on an EC2 instance in a VPC. The instance has a security group that allows all outbound traffic and inbound SSH from 0.0.0.0/0, HTTP from 0.0.0.0/0, and HTTPS from 0.0.0.0/0. A user from IP 203.0.113.5 tries to connect to the instance over HTTP. What will happen?

Accepted Answer

The connection is dropped by iptables.. The iptables command shown in the exhibit (not provided here but implied to have a default DROP or REJECT policy on the INPUT chain, or a specific rule that drops HTTP traffic) overrides the security group's permissive rules. Security groups act as a virtual firewall at the instance level, but iptables operates within the instance's OS kernel netfilter framework and is evaluated after the security group. Since iptables drops the HTTP connection, the packet is discarded before reaching the application, regardless of the security group allowing HTTP from 0.0.0.0/0.

Answer

The connection succeeds because the security group allows HTTP.

Answer

The connection succeeds because iptables allows HTTP from anywhere.

Answer

The connection is dropped by the security group.

Question 8

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group. Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.

Answer

Allow inbound HTTP traffic from the EC2 instances' own security group

Answer

Allow inbound HTTP traffic from 0.0.0.0/0

Answer

Allow inbound HTTP traffic from the VPC CIDR block

Question 9

A security engineer is designing a network ACL for a public subnet containing an Application Load Balancer. The subnet must allow inbound HTTPS traffic from the internet and outbound traffic to the internet for patches. Which inbound rule should be added?

Accepted Answer

Allow TCP port 443 from 0.0.0.0/0. HTTPS traffic uses TCP port 443, and the network ACL must explicitly allow inbound TCP traffic on port 443 from the internet (0.0.0.0/0) to reach the Application Load Balancer. Network ACLs are stateless, so each direction requires a separate rule; this inbound rule permits the initial HTTPS connection requests.

Answer

Allow TCP port 1024-65535 from 0.0.0.0/0

Answer

Allow UDP port 443 from 0.0.0.0/0

Answer

Allow all traffic from 0.0.0.0/0

Question 10

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team suspects that a DDoS attack is targeting the application. Which AWS service can be used to absorb and mitigate the attack at the network layer before traffic reaches the ALB?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protections against larger and more sophisticated DDoS attacks, including network-layer (Layer 3/4) attacks such as UDP floods, SYN floods, and reflection attacks. It integrates directly with Application Load Balancers to absorb and mitigate malicious traffic before it reaches the ALB, ensuring the application remains available. This makes it the correct choice for mitigating a DDoS attack at the network layer.

Answer

AWS WAF

Answer

AWS Identity and Access Management (IAM)

Answer

Network ACLs

Question 11

A company has a security group that allows inbound SSH from a specific IP range. A security engineer notices that the security group rule is not being applied to a newly launched EC2 instance. What is the most likely cause?

Accepted Answer

The new EC2 instance was not launched with the correct security group. The most likely cause is that the new EC2 instance was not launched with the correct security group. Security groups act as virtual firewalls for instances, and an instance can only be associated with security groups at launch time. If the engineer launched the instance without explicitly selecting the security group that allows inbound SSH from the specific IP range, the instance would default to the VPC's default security group, which typically does not have the same custom SSH rule. This is a common operational oversight when automating or manually launching instances.

Answer

The security group is using the default VPC security group

Answer

The security group is configured as stateless

Answer

The network ACL is blocking SSH traffic to the subnet

Question 12

A company uses AWS Systems Manager Session Manager to manage EC2 instances without opening inbound ports. Which IAM policy is required for an EC2 instance to allow Session Manager to connect?

Accepted Answer

AmazonSSMManagedInstanceCore. The AmazonSSMManagedInstanceCore policy grants the minimum permissions required for an EC2 instance to communicate with the Systems Manager service via the SSM Agent, including sending heartbeats, receiving commands, and establishing Session Manager connections. Session Manager does not require inbound ports; it relies on the instance initiating outbound HTTPS connections (port 443) to the SSM endpoints, so the instance needs only the permissions in this managed policy to function as a managed node.

Answer

AmazonSSMFullAccess

Answer

AmazonEC2FullAccess

Answer

AdministratorAccess

Question 13

A security engineer needs to ensure that all traffic between two EC2 instances in different subnets is encrypted in transit. What is the most secure and efficient solution?

Accepted Answer

Set up an IPsec VPN between the instances. An IPsec VPN between the two EC2 instances provides end-to-end encryption of all traffic at the network layer, regardless of the application protocol. This ensures that data in transit between the instances is encrypted using IPsec (ESP/AH), which is the most secure and efficient solution for encrypting traffic between two specific instances in different subnets without relying on the underlying network infrastructure.

Answer

Configure network ACLs to allow traffic

Answer

Use VPC Peering

Answer

Configure security groups to allow traffic

Question 14

A company's security team wants to detect and block malicious SQL injection attempts against an Application Load Balancer. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that can be associated with an Application Load Balancer to inspect HTTP/HTTPS requests for malicious patterns, such as SQL injection attempts. It uses managed rule sets (e.g., AWS Managed Rules for SQL injection) to detect and block these attacks in real time, making it the correct choice for this use case.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Shield Advanced

Question 15

Which TWO of the following are valid methods to protect sensitive data in transit between an on-premises data center and AWS? (Select TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (Option B) creates an encrypted tunnel between an on-premises VPN device and a Virtual Private Gateway in AWS, using IPSec to protect data in transit. This ensures confidentiality and integrity of data crossing the public internet, making it a valid method for securing sensitive data between an on-premises data center and AWS.

Answer

AWS Transit Gateway

Answer

Internet Gateway

Answer

VPC Peering