SCS-C02 Infrastructure Security Practice Test 13 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. Which AWS service should be used to allow this without assigning a public IP address to the instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while preventing inbound traffic from the internet. Option A is incorrect because an Internet Gateway alone does not provide outbound-only connectivity; instances in a private subnet would still need a public IP. Option B is incorrect because a VPC Endpoint provides private connectivity to AWS services, not general internet access. Option D is incorrect because a VPN Connection is used for hybrid connectivity between a VPC and an on-premises network, not for internet access.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

VPN Connection

Question 2

A company is designing a hybrid cloud architecture with an AWS Direct Connect connection. The company wants to ensure that traffic to and from the VPC goes through the Direct Connect connection and not over the internet. Which configuration should be used?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update the route tables to point to the Direct Connect virtual interface.. A Virtual Private Gateway (VGW) is the AWS-side anchor for an AWS Direct Connect private virtual interface (VIF). By attaching the VGW to the VPC and updating the VPC route tables to point the destination CIDR (e.g., the on-premises network) to the Direct Connect VIF, all traffic between the VPC and the on-premises network is forced through the Direct Connect link, bypassing the internet entirely.

Answer

Create a VPC Endpoint for each AWS service.

Answer

Set up a VPN connection over the internet as a backup.

Answer

Configure the Direct Connect connection and assign public IPs to instances.

Question 3

A company wants to block traffic from a specific IP address range from accessing an Application Load Balancer (ALB). Which AWS feature should be used?

Accepted Answer

AWS WAF. AWS WAF can be associated with an Application Load Balancer to filter traffic based on IP addresses, allowing you to block traffic from a specific IP address range. Option A is incorrect because Network ACLs operate at the subnet level and cannot be directly associated with an ALB. Option B is incorrect because security groups for an ALB cannot block IP addresses; they support allow rules only and do not have a deny capability. Option C is incorrect because Route53 is a DNS service and does not filter traffic.

Answer

Network ACL

Answer

Security Group for the ALB

Answer

Route53

Question 4

A company is running a critical application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB reaches the EC2 instances. How can this be achieved?

Accepted Answer

Reference the ALB's security group in the EC2 security group inbound rule.. You can reference the ALB's security group as the source in the EC2 instance's security group inbound rule. This allows traffic only from the ALB, regardless of the ALB's IP addresses (which can change if the ALB scales). The security group reference is resolved dynamically by AWS, ensuring that only traffic originating from the ALB's elastic network interfaces (ENIs) is permitted.

Answer

Use the ALB's private IP address in the EC2 security group.

Answer

Configure a Network ACL to allow only the ALB's subnet.

Answer

Use the ALB's public IP address in the EC2 security group.

Question 5

A company wants to ensure that all data sent to an S3 bucket is encrypted in transit. Which policy statement should be added to the bucket policy?

Accepted Answer

Deny if aws:SecureTransport is false. The condition 'aws:SecureTransport' checks whether the request was sent over HTTPS. By denying requests when 'aws:SecureTransport' is false, the bucket policy blocks any HTTP requests, ensuring all data is encrypted in transit. Option A allows HTTP requests. Option B denies HTTPS requests. Option C allows HTTPS but does not explicitly deny HTTP, making it less secure.

Answer

Allow if aws:SecureTransport is false

Answer

Deny unless aws:SecureTransport is false

Answer

Allow if aws:SecureTransport is true

Question 6

A security engineer is configuring a VPC with public and private subnets. The engineer wants to ensure that the private subnet instances cannot initiate outbound connections to the internet but can receive responses from the internet if initiated from within the VPC. Which TWO configurations should be used?

Accepted Answer

Configure the private subnet security group to allow inbound traffic from the public subnet's security group.. Allows inbound traffic from the public subnet (e.g., from a load balancer) but does not affect outbound initiation. Option B ensures the private subnet has no route to the internet, preventing instances from initiating outbound traffic. Options C and D would allow outbound initiation. Option E is insufficient because the route table is the primary control for outbound traffic.

Answer

Attach an Internet Gateway to the VPC and add a route to it in the private subnet route table.

Answer

Attach a NAT Gateway to the private subnet and add a route to it.

Answer

Configure the private subnet Network ACL to allow outbound traffic to 0.0.0.0/0.

Question 7

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation are encrypted at rest. Which THREE configuration steps should be taken?

Accepted Answer

Create an AWS Config rule to check for unencrypted S3 buckets.. Options A, C, and D are correct. AWS Config rules can detect unencrypted S3 buckets and trigger remediation. Service control policies (SCPs) can deny the creation of S3 buckets without encryption at the organizational level. In CloudFormation templates, specifying the BucketEncryption property ensures encryption is configured at deployment time. Option B is incorrect because a CloudFormation stack policy only prevents updates to existing stacks but does not enforce encryption during initial creation. Option E is incorrect because an IAM role can restrict permissions but does not enforce encryption directly on S3 buckets created by CloudFormation.

Answer

Use a CloudFormation stack policy to prevent updates that remove encryption.

Answer

Create an IAM role that only allows creation of encrypted buckets.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all security groups restrict SSH access to only the company's VPN public IP address range (203.0.113.0/24). A developer creates a stack that includes a security group with SSH open to 0.0.0.0/0. The stack deploys successfully. Which action should the security team take to prevent this in the future?

Accepted Answer

Use an AWS Config managed rule to detect security groups with unrestricted SSH access and trigger an automatic remediation.. Using AWS CloudFormation Stack Policies allows you to define which stack resources can be updated or deleted, but not to enforce security rules. AWS Config rules can evaluate resources against desired configurations and trigger remediation or notifications. Service control policies (SCPs) are for AWS Organizations and cannot block resource creation at the account level. IAM permissions can prevent users from creating security groups with open SSH, but that requires careful management and does not cover all cases. Option B is the correct answer because an AWS Config managed rule can detect security groups with unrestricted SSH access and trigger an automatic remediation action via AWS Systems Manager Automation.

Answer

Create an AWS CloudFormation stack policy to block security groups with SSH open to 0.0.0.0/0.

Answer

Implement a service control policy (SCP) to deny the ec2:AuthorizeSecurityGroupIngress action for port 22 from 0.0.0.0/0.

Answer

Add an IAM policy to deny the ec2:AuthorizeSecurityGroupIngress action for port 22 from 0.0.0.0/0.

Question 9

A company has a VPC with public and private subnets. The private subnets contain Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which combination of controls should the security team implement? (Choose TWO.)

Accepted Answer

Ensure that the route tables for the subnets containing RDS instances do not have a route to an internet gateway.. To ensure RDS instances are not accessible from the internet, you must prevent any network path from the internet to the instances. Option A is correct because if the subnet's route table lacks a route to an internet gateway, traffic cannot reach the internet, and internet traffic cannot reach the instances via the gateway. Option B is correct because security group rules act as a virtual firewall at the instance level; by not allowing inbound traffic from 0.0.0.0/0 and only allowing specific IP ranges, you restrict internet access. Option C is incorrect because placing RDS instances in public subnets would expose them to the internet regardless of NACLs; public subnets have a route to an internet gateway. Option D is incorrect because a network ACL denying all inbound traffic is overly restrictive and would block all traffic to the subnets, including legitimate internal traffic; also, NACLs are stateless and require separate outbound rules. Option E is incorrect because AWS WAF is for web application traffic at the application layer (HTTP/HTTPS) and does not apply to RDS instances directly; it is used with CloudFront, ALB, or API Gateway.

Answer

Place the RDS instances in public subnets with network ACLs blocking inbound traffic.

Answer

Add a network ACL rule to deny all inbound traffic to the RDS subnets.

Answer

Use an AWS WAF web ACL attached to the RDS instances.

Question 10

Refer to the exhibit. A security engineer is reviewing VPC Flow Logs and sees the above entry. The engineer notices that traffic from IP 203.0.113.10 to an instance in the VPC on port 443 is being accepted. The security group for the instance only allows inbound HTTPS from the VPC CIDR (10.0.0.0/16). What is the most likely reason the traffic is accepted?

Accepted Answer

The VPC Flow Logs capture traffic before security group evaluation.. VPC Flow Logs capture traffic after network ACL evaluation but before security group evaluation. Therefore, the flow log shows ACCEPT because the network ACL allowed the traffic, but the security group would have subsequently dropped it. This explains why the flow log entry appears despite the security group denying traffic from 203.0.113.10.

Answer

The network ACL associated with the subnet has an inbound rule allowing port 443 from 203.0.113.10/32.

Answer

The network ACL inbound rule is evaluated before the security group inbound rule.

Answer

The security group has a default rule that allows all inbound traffic from the internet.

Question 11

A company is designing a new AWS account structure using AWS Organizations. The security team wants to restrict the use of specific AWS services across all member accounts. Which feature should they use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct feature because they allow you to centrally restrict which AWS services and actions are permitted across all member accounts in an AWS Organization. SCPs act as a permission guardrail that applies to all IAM users, roles, and root users within the affected accounts, enabling the security team to enforce service restrictions without modifying individual account configurations.

Answer

AWS Single Sign-On (SSO)

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM) cross-account roles

Question 12

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests and block malicious traffic based on customizable rules. This makes it the correct choice for the security team's requirement.

Answer

AWS Network Firewall

Answer

AWS Firewall Manager

Answer

AWS Shield Advanced

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. Which AWS service should be used to allow this without assigning a public IP address to the instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an inbound rule to the RDS security group that allows traffic from the security group of the application server on port 3306.. It uses a security group reference as the source in the inbound rule for the RDS security group. This allows traffic only from the specific application server(s) associated with that security group, regardless of their IP addresses, and automatically scales if the application server is replaced or scaled. This is the most secure and AWS-recommended method for controlling traffic between resources within a VPC.

Answer

Add an inbound rule to the RDS security group that allows traffic from the VPC CIDR on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from the subnet CIDR of the application server on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from 0.0.0.0/0 on port 3306.

Question 14

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that log files are not modified after they are created. Which feature should they enable?

Accepted Answer

Log file integrity validation. CloudTrail log file integrity validation uses hash chains to detect any modification of log files after they are created. This ensures the authenticity and integrity of the logs. Option A (server-side encryption with AWS KMS) protects confidentiality but does not provide integrity verification. Option C (S3 Object Lock) prevents deletion or overwrites but does not verify integrity of existing objects. Option D (CloudWatch Logs integration) is for real-time monitoring and alerting, not integrity validation.

Answer

Server-side encryption with AWS KMS

Answer

S3 Object Lock

Answer

CloudWatch Logs integration

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it allows you to centrally configure and manage VPC security group rules across multiple accounts within AWS Organizations. Option A (AWS Network Firewall) is used for managing network firewall rules (e.g., stateful inspection), not security groups. Option C (AWS Config) is for evaluating configuration compliance, not for centrally managing security group rules. Option D (Amazon Route 53 Resolver DNS Firewall) is for DNS-level filtering and does not manage security groups.

Answer

AWS Network Firewall

Answer

AWS Config

Answer

Amazon Route 53 Resolver DNS Firewall