SCS-C02 Infrastructure Security Practice Test 13 — 15 Questions

Question 1

Which THREE of the following are best practices for securing an Amazon RDS database instance? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS. Enabling encryption at rest using AWS KMS ensures that the underlying storage for the RDS instance, automated backups, read replicas, and snapshots are encrypted using AES-256. This protects data at rest from unauthorized physical access or storage media theft, and is a fundamental security best practice for compliance frameworks like PCI DSS and HIPAA.

Answer

Enable public accessibility for ease of management

Answer

Use the default database port

Question 2

Which TWO of the following are valid ways to control inbound traffic to an EC2 instance? (Select TWO.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are a valid method to control inbound traffic to an EC2 instance because they act as a stateless firewall at the subnet level. Each NACL rule evaluates inbound traffic based on source IP, protocol, and port, and rules are processed in order from lowest to highest number. Since NACLs are stateless, you must explicitly allow both inbound and outbound traffic for a response to return.

Answer

IAM policies

Answer

Amazon CloudWatch alarms

Answer

AWS Key Management Service (KMS)

Question 3

A company wants to restrict access to an Amazon S3 bucket so that only users from a specific AWS account can upload objects. Which policy mechanism should be used?

Accepted Answer

Create a bucket policy with a condition that checks the aws:SourceAccount condition key.. A bucket policy with the `aws:SourceAccount` condition key allows you to restrict access to a specific AWS account. When users from the allowed account upload objects, the condition evaluates the source account ID, ensuring only requests originating from that account are permitted. This is the recommended approach for cross-account access control in S3, as it directly enforces the account-level restriction at the bucket policy level.

Answer

Attach an IAM policy to the bucket that denies access to all users except those from the allowed account.

Answer

Generate a pre-signed URL for each upload request.

Answer

Configure the bucket ACL to grant access only to the allowed account's canonical user ID.

Question 4

A security engineer is designing a VPC with public and private subnets. The VPC will host web servers in public subnets and database servers in private subnets. The web servers need to send traffic to the database servers, and the database servers must not have direct internet access. Which TWO configurations should the engineer implement?

Accepted Answer

Configure security group rules to allow inbound traffic from the web server security group to the database security group.. Security group rules are stateful and can reference other security groups as a source, allowing the web server security group to be specified as the source for inbound traffic to the database security group. This ensures that only traffic originating from the web servers is permitted to reach the database servers, providing a logical, application-layer firewall without exposing the databases to the internet. Option C is correct because omitting a route to an internet gateway from the private subnet's route table ensures that the database servers have no direct path to the internet, satisfying the requirement that they must not have direct internet access.

Answer

Use network ACLs to block all inbound traffic to the private subnets.

Answer

Attach an internet gateway to the VPC and route the private subnets to it.

Answer

Add a NAT gateway in the public subnet and route the private subnets to it.

Question 5

An organization has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that no Amazon EC2 instances are launched without an IAM instance profile that includes a specific role. Which preventive control should be implemented?

Accepted Answer

Create an SCP that denies ec2:RunInstances when the condition iam:InstanceProfile is not set to the required profile ARN.. AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to prevent actions across all principals. By using the `iam:InstanceProfile` condition key with the `ec2:RunInstances` action, the SCP denies the launch of any EC2 instance that does not have the required IAM instance profile attached. This is a preventive control that blocks the action before it occurs, ensuring compliance across the entire multi-account environment.

Answer

Attach an IAM policy to all users that denies ec2:RunInstances unless an instance profile is specified.

Answer

Create an SCP that denies ec2:RunInstances when the condition ec2:InstanceProfile is not set.

Answer

Use AWS Config rule ec2-instance-profile-attached to detect non-compliant instances and automatically terminate them.

Question 6

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are not tampered with and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

Enable log file integrity validation in CloudTrail.. CloudTrail log file integrity validation uses a hash chain (SHA-256) to create a digest file that proves log files have not been modified, deleted, or tampered with since delivery. This feature allows you to verify that CloudTrail log files have remained unchanged, meeting the security team's requirement for integrity verification.

Answer

Enable MFA delete on the log bucket.

Answer

Enable server-side encryption with AWS KMS on the log bucket.

Answer

Enable S3 versioning on the log bucket.

Question 7

A company is deploying a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The security team wants to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Accepted Answer

AWS WAF.. AWS WAF is a web application firewall that helps protect web applications from common web exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and filter malicious traffic based on customizable rules, including managed rule groups for OWASP Top 10 threats.

Answer

AWS Network Firewall.

Answer

AWS Shield Advanced.

Answer

AWS Security Hub.

Question 8

A security engineer is tasked with securing an Amazon RDS for MySQL database. The database must be accessible only from a specific set of EC2 instances. Which THREE steps should the engineer take?

Accepted Answer

Enable encryption at rest for the RDS instance.. Enabling encryption at rest for the RDS instance ensures that data stored on the underlying storage is encrypted using AWS Key Management Service (KMS). This is a security best practice for protecting sensitive data at rest, and it does not conflict with the requirement to restrict network access. Encryption at rest is independent of network access controls and is essential for compliance with many security frameworks.

Answer

Disable encryption at rest to improve performance.

Answer

Associate the RDS instance with a public subnet for easier access.

Question 9

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including changes to security group rules via the EC2 AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, and RevokeSecurityGroupEgress API actions. These events are captured as management events in CloudTrail, providing a complete audit trail of who made the change, when, from which IP address, and the exact parameters of the rule modification.

Answer

Amazon CloudWatch Logs.

Answer

VPC Flow Logs.

Answer

AWS Config.

Question 10

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled in all regions. Which approach should be used?

Accepted Answer

Enable AWS CloudTrail from the master account as an organization trail.. AWS Organizations allows you to create an organization trail from the management account that automatically applies to all member accounts and all regions. This ensures CloudTrail is enabled across the entire organization without requiring per-account configuration, and it centralizes log delivery to a single Amazon S3 bucket for auditing.

Answer

Create an SCP that requires CloudTrail to be enabled.

Answer

Enable CloudTrail in each account using a cross-account IAM role.

Answer

Use AWS Config rules to detect non-compliant accounts and automatically enable CloudTrail.

Question 11

A company has an Amazon S3 bucket that stores sensitive data. The security team needs to ensure that all access to the bucket is encrypted in transit. Which condition should be added to the bucket policy?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key in an S3 bucket policy enforces that all requests to the bucket must be made over HTTPS (TLS). When set to `false`, any HTTP request is denied, ensuring data is encrypted in transit. This directly addresses the security team's requirement to encrypt all access to the bucket during transmission.

Answer

aws:SourceIp

Answer

s3:x-amz-server-side-encryption

Answer

aws:UserAgent

Question 12

A security engineer sees the above security group configuration for an EC2 instance. The instance hosts a web application that should only be accessible from the internal network (10.0.0.0/8) over HTTPS, and SSH should not be open to the internet. What is the security issue with this configuration?

Accepted Answer

The outbound rule allows all traffic to all destinations.. The outbound rule allowing all traffic to all destinations (0.0.0.0/0) violates the principle of least privilege. While the inbound rules restrict HTTPS to the internal network (10.0.0.0/8) and SSH is not open to the internet, the outbound rule permits any instance in the security group to initiate connections to any IP address and port, including malicious external hosts. This could allow data exfiltration or outbound attacks, which is a security issue even if inbound access is properly restricted.

Answer

The inbound HTTPS rule is too permissive.

Answer

The inbound SSH rule is too permissive.

Answer

There is no security issue; the configuration is correct.

Question 13

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow all EC2 actions except deleting volumes in the Production environment. However, the user reports being able to delete volumes that are tagged with Environment=Production. What is the reason for this behavior?

Accepted Answer

The condition in the Deny statement uses StringNotEquals, which denies deletion for non-Production volumes, not Production volumes.. The Deny statement uses the StringNotEquals condition operator with ec2:ResourceTag/Environment=Production. This means the Deny applies when the tag value is NOT equal to Production, so it denies deletion for non-Production volumes but allows deletion for Production volumes. To deny deletion of Production volumes, the policy should use StringEquals instead of StringNotEquals.

Answer

The policy is not attached to the correct IAM entity.

Answer

The Deny statement should use iam:ResourceTag instead of ec2:ResourceTag.

Answer

The Allow statement uses a wildcard for the action, which overrides the Deny statement.

Question 14

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which security mechanism should be used?

Accepted Answer

Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.. An S3 bucket policy can include a condition that restricts access to traffic originating from a specific VPC endpoint. By using the `aws:SourceVpce` condition key, the policy ensures that only requests coming through the specified VPC endpoint (interface or gateway) are allowed to read objects, effectively locking down access to the VPC.

Answer

Assign an IAM role to the S3 bucket.

Answer

Attach a security group to the S3 bucket.

Answer

Configure a network ACL on the VPC subnet to allow traffic to S3.

Question 15

A security engineer notices that an EC2 instance in a private subnet is able to make outbound connections to the internet. The instance does not have a public IP, and there is no NAT gateway or instance in the VPC. What is the most likely cause?

Accepted Answer

The VPC has an egress-only internet gateway for IPv6 traffic.. An egress-only internet gateway (EIGW) allows outbound IPv6 traffic from instances in a private subnet without requiring a public IPv4 address or NAT. Since the instance is making outbound connections to the internet and has no public IP or NAT, and the VPC likely has IPv6 enabled, the EIGW is the most plausible cause. Option D is incorrect because a default route to an internet gateway requires the instance to have a public IPv4 address for return traffic, which contradicts the scenario.

Answer

The instance has a public IP assigned automatically via Auto-assign Public IP.

Answer

The instance is using a VPC endpoint (Gateway type) for S3.

Answer

The subnet's route table has a default route (0.0.0.0/0) pointing to an internet gateway.