SCS-C02 Infrastructure Security Practice Test 12 — 15 Questions

Question 1

Which TWO actions can be taken to protect an S3 bucket from accidental public access? (Choose 2.)

Accepted Answer

Enable S3 Block Public Access at the account level. Options A and B are correct. Enabling S3 Block Public Access at the account level (option A) prevents any public access to all buckets. Using a bucket policy with a condition that denies s3:PutBucketPolicy unless the request comes from a specific VPC (option B) ensures that only authorized VPCs can modify the bucket policy, preventing accidental public exposure. Option C is wrong because default encryption does not affect public access. Option D is wrong because MFA Delete protects against accidental deletion, not public access. Option E is wrong because requiring MFA for S3 actions does not prevent public access.

Answer

Enable default encryption for the bucket

Answer

Enable MFA Delete on the bucket

Answer

Use an IAM policy that requires MFA for all S3 actions

Question 2

Which THREE components are required to set up a client VPN for remote access to a VPC? (Choose 3.)

Accepted Answer

Client VPN endpoint. A Client VPN endpoint is required as the entry point for remote clients to connect to the VPC. It manages authentication, encryption (using TLS 1.2), and routing for client connections. Without this component, there is no VPN server to accept and authenticate client traffic.

Answer

Virtual Private Gateway

Answer

Customer Gateway

Question 3

Which TWO AWS services are designed to provide DDoS protection? (Choose 2.)

Accepted Answer

AWS WAF. AWS WAF (Option D) is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. It integrates with Amazon CloudFront, Application Load Balancer, and API Gateway to filter and monitor HTTP(S) requests, providing protection against layer 7 DDoS attacks such as SQL injection and cross-site scripting.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. Security engineers need to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which architecture should be used?

Accepted Answer

Create a central inspection VPC with the firewall appliance. Configure Transit Gateway route tables to route traffic between VPCs through the inspection VPC.. Transit Gateway route tables can force traffic between VPCs through the inspection VPC by attaching the firewall appliance and using specific routing entries. Option A is incorrect because security groups only control traffic at the instance level and cannot redirect traffic to an inspection appliance. Option B is incorrect because VPC Peering does not support transitive routing, so traffic between two VPCs cannot go through a third VPC. Option C is incorrect because Network ACLs are stateless and can only filter traffic based on IP/port, not route traffic through an inspection appliance.

Answer

Use security groups in each VPC to allow only traffic from the firewall appliance's IP.

Answer

Establish VPC Peering connections between each VPC and the inspection VPC.

Answer

Configure Network ACLs in each VPC to deny traffic that does not originate from the inspection VPC.

Question 5

A security engineer is reviewing AWS CloudTrail logs and notices repeated `UnauthorizedOperation` errors for `ec2:RunInstances` from a specific IAM user. The user has a policy that allows `ec2:RunInstances` with a condition `aws:RequestedRegion` set to `us-east-1`. The engineer confirms the user is launching instances in `us-east-1`. What is the most likely cause of the error?

Accepted Answer

The user is using an AWS CLI command that does not include the `--region` parameter, causing the request to go to a global endpoint.. The error occurs because the user's IAM policy condition `aws:RequestedRegion` evaluates the region specified in the request, not the physical region where the instance is launched. If the user runs an AWS CLI command without the `--region` parameter, the request goes to the global endpoint (iam.amazonaws.com) or the default region configured in the CLI, which may not be `us-east-1`. This causes the condition to fail, resulting in an `UnauthorizedOperation` error. Option A is incorrect because service-linked roles are not required for `ec2:RunInstances`. Option B is incorrect because the condition key `aws:RequestedRegion` does not require a `Resource` element; it works with the default resource `*`. Option C is incorrect because the error is `UnauthorizedOperation`, not an instance type error.

Answer

The user does not have a service-linked role for EC2.

Answer

The IAM policy lacks a `Resource` element specifying which instances can be launched.

Answer

The user is trying to launch an instance type that is not supported in us-east-1.

Question 6

A company is designing a security group for a web application that must receive HTTPS traffic from the internet and send traffic to a backend database. The backend database is an Amazon RDS MySQL instance. What is the best practice for configuring the security groups?

Accepted Answer

Web server SG: inbound HTTPS from 0.0.0.0/0. Database SG: inbound MySQL from web server SG.. The web server security group should allow inbound HTTPS from 0.0.0.0/0 for internet traffic, and the database security group should allow inbound MySQL traffic only from the web server security group (not its CIDR). This follows the principle of least privilege and allows dynamic IP changes. Option B is wrong because outbound rules on the web server SG are unnecessary; security groups are stateful, so return traffic is automatically allowed. Also, using the web server's CIDR in the database SG is less flexible than referencing the SG. Option C is wrong because allowing outbound all traffic from the web server is too permissive, and allowing inbound MySQL from 0.0.0.0/0 to the database is insecure. Option D is wrong because the web server should not have an inbound rule for MySQL; that would allow direct database access from outside.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound to database SG on port 3306. Database SG: inbound MySQL from web server CIDR block.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound all traffic. Database SG: inbound MySQL from 0.0.0.0/0.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, inbound MySQL from database SG. Database SG: outbound MySQL to web server SG.

Question 7

A company wants to allow its developers to SSH into EC2 instances only from the corporate network IP range (203.0.113.0/24). Which configuration should be used to enforce this restriction?

Accepted Answer

Add a security group rule that allows inbound SSH (port 22) from the corporate IP range.. A security group rule can restrict inbound SSH to the specific IP range. Security groups act as a virtual firewall for EC2 instances, and by adding a rule that allows inbound SSH only from the corporate IP range (203.0.113.0/24), all other inbound traffic on port 22 is implicitly denied. Option A is incorrect because network ACLs are stateless and apply at the subnet level, not the instance level, and the question asks for a configuration to enforce SSH restriction on EC2 instances. Option B is incorrect because AWS Systems Manager Session Manager does not use SSH; it provides browser-based shell access without inbound ports. Option C is incorrect because IAM policies control permissions for API actions, not network traffic.

Answer

Configure a network ACL on the subnet to allow inbound SSH from the corporate range and deny all other inbound traffic.

Answer

Use AWS Systems Manager Session Manager to connect to instances instead of SSH.

Answer

Add an IAM policy that allows `ec2:RunInstances` only if the request includes the corporate IP.

Question 8

A security team needs to audit all changes to security group rules across multiple AWS accounts in an organization. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS Config and AWS CloudTrail.. AWS Config can track changes to security group rules by recording configuration history, while AWS CloudTrail logs API calls that modify security groups. Together, they provide a complete audit trail across multiple accounts. Option A is incorrect because CloudWatch Logs is for monitoring logs, not configuration changes; CloudTrail alone logs API calls but lacks the configuration tracking that Config provides. Option B is incorrect because GuardDuty and Security Hub are focused on threat detection and security posture, not auditing configuration changes. Option C is incorrect because Trusted Advisor provides best-practice checks and does not log changes; Config alone cannot capture API call details.

Answer

Amazon CloudWatch Logs and AWS CloudTrail.

Answer

Amazon GuardDuty and AWS Security Hub.

Answer

AWS Trusted Advisor and AWS Config.

Question 9

An organization has a VPC with public and private subnets. A NAT Gateway is deployed in a public subnet to allow instances in private subnets to access the internet. The security team notices that instances in a private subnet can reach the internet, but cannot initiate connections to an on-premises network connected via AWS Direct Connect. The on-premises network advertises a specific route. What is the most likely cause?

Accepted Answer

The private subnet route table has a route for the on-premises CIDR pointing to the NAT Gateway.. The most likely cause is that the private subnet's route table has a route for the on-premises CIDR pointing to the NAT Gateway. Since the NAT Gateway is intended for internet-bound traffic, traffic destined to the on-premises network is incorrectly routed to the NAT Gateway, which cannot forward it to the on-premises network via Direct Connect. For Direct Connect, the route should point to the virtual private gateway. Option A is incorrect because Security Groups are stateful and allow return traffic; outbound rules are not the issue. Option B is incorrect because NACLs are stateless and would affect both directions, but the problem is outbound connectivity. Option D is incorrect because the IGW is not relevant for Direct Connect traffic.

Answer

The security group assigned to the instances does not allow outbound traffic to the on-premises network.

Answer

The network ACL on the private subnet is blocking inbound traffic from the on-premises network.

Answer

The internet gateway is not attached to the VPC.

Question 10

A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?

Accepted Answer

Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.. Security groups can reference other security groups as sources in inbound rules, allowing granular traffic control between tiers without CIDR blocks. This approach allows the web tier security group to allow inbound from the internet, the app tier security group to allow inbound only from the web tier security group, and the database tier security group to allow inbound only from the app tier security group. Option B is incorrect because IAM policies control user permissions, not network traffic. Option C is incorrect because network ACLs with CIDR blocks are less specific and do not scale well, and placing tiers in separate subnets is not necessary. Option D is incorrect because placing all instances in public subnets unnecessarily exposes them to the internet, increasing security risk.

Answer

Use a single security group for all instances and use IAM policies to restrict access.

Answer

Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.

Answer

Place all instances in public subnets and restrict access using security groups.

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize costs and avoid NAT Gateway or NAT Instance charges. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and configure the instance to download patches from S3.. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 over the AWS network without traversing the internet, avoiding NAT Gateway or NAT Instance charges. The patches can be stored in an S3 bucket and downloaded by the EC2 instance using the endpoint, which uses AWS PrivateLink and does not require an internet gateway or public IP.

Answer

Deploy a proxy instance in a public subnet and configure the private instance to use the proxy.

Answer

Use an egress-only internet gateway for the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table pointing to the internet gateway.

Question 12

Which THREE are benefits of using AWS Systems Manager Session Manager to connect to EC2 instances? (Choose THREE.)

Accepted Answer

It allows closing inbound SSH and RDP ports on the instance.. Session Manager eliminates the need for a bastion host or jump box (C), allows closing inbound SSH and RDP ports (A), and provides session logging to AWS CloudTrail for auditing (E). Option B is incorrect because Session Manager does not automatically rotate SSH keys; it uses IAM for access control. Option D is incorrect because Session Manager does not require an internet gateway or NAT gateway; it uses the SSM agent and AWS Systems Manager endpoints.

Answer

It automatically rotates SSH keys on the instance.

Answer

It requires an internet gateway or NAT gateway for the instance to communicate with the Session Manager service.

Question 13

Which TWO are valid methods to secure data at rest in Amazon S3? (Choose TWO.)

Accepted Answer

Enabling default encryption on the S3 bucket.. Options A and E are correct. Enabling default encryption on an S3 bucket (SSE-S3, SSE-KMS, or SSE-C) ensures that all objects stored in the bucket are encrypted at rest, providing data confidentiality. S3 Block Public Access settings prevent public access to the bucket and its objects, which helps protect data at rest from unauthorized exposure. Option B is incorrect because MFA Delete adds an extra layer of protection for deletions, not encryption. Option C is incorrect because versioning helps with data recovery and protection against accidental deletions, but does not encrypt data. Option D is incorrect because a bucket policy restricting access to specific IP addresses controls network-level access but does not encrypt data at rest.

Answer

Enabling MFA Delete.

Answer

Enabling S3 Versioning.

Answer

Configuring an S3 bucket policy to restrict access to specific IP addresses.

Question 14

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC Endpoint are allowed. Which policy element should be used in the bucket policy?

Accepted Answer

aws:SourceVpce. The correct condition key to restrict access to a specific VPC Endpoint is 'aws:SourceVpce'. This key allows you to specify the VPC Endpoint ID in the bucket policy's Condition element. Option D (aws:SourceVpce) is correct. Option A (aws:SourceVpc) is incorrect because it restricts to a VPC ID, not a VPC Endpoint. Option B (aws:VpcSourceIp) is not a valid condition key. Option C (aws:SourceIp) is used for IP-based restrictions, not VPC endpoints.

Answer

aws:SourceVpc

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 15

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Which combination of security groups should be used?

Accepted Answer

Web: 0.0.0.0/0 on ports 80/443; App: Web SG on port 8080; DB: App SG on port 3306. It properly restricts traffic: the web tier allows only HTTP/HTTPS from the internet (0.0.0.0/0 on ports 80/443), the application tier allows traffic only from the web security group on port 8080, and the database tier allows traffic only from the application security group on port 3306. This enforces the principle of least privilege. Option D is incorrect because it uses 'ports 8080' (plural) instead of 'port 8080' (singular), which is invalid syntax in AWS security group rules.

Answer

Web: 0.0.0.0/0 on ports 80/443 and SSH; App: Web SG on port 8080; DB: App SG on port 3306

Answer

Web: 0.0.0.0/0 on all ports; App: Web SG on all ports; DB: App SG on all ports

Answer

Web: 0.0.0.0/0 on ports 80/443; App: Web SG on ports 8080; DB: App SG on port 3306