SCS-C02 Infrastructure Security Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. A security engineer applies this S3 bucket policy to an S3 bucket. The bucket contains sensitive data. What is the effect of this policy?

Accepted Answer

It denies PutObject requests that are not using HTTPS.. The policy denies PutObject requests that are not using HTTPS (SecureTransport false). So it enforces HTTPS for uploads. Option B is correct. Option A is incorrect because it does not deny all PutObject. Option C is incorrect because it does not enforce encryption. Option D is incorrect because it does not allow anonymous uploads.

Answer

It allows anonymous users to upload objects.

Answer

It denies all PutObject requests to the bucket.

Answer

It enforces that all objects must be encrypted at rest.

Question 2

A company wants to launch an Amazon EC2 instance that must be accessible via SSH from the company's corporate network (IP range 198.51.100.0/24). The instance should not be accessible from the internet. Which network configuration should the security engineer recommend?

Accepted Answer

Place the instance in a private subnet, and add a security group rule that allows SSH inbound from 198.51.100.0/24.. The instance must be placed in a private subnet to prevent direct internet access. A security group rule allowing SSH inbound from the corporate IP range (198.51.100.0/24) permits access only from the corporate network. Option A is incorrect because a private subnet with a route to an internet gateway becomes a public subnet, enabling internet access. Option B is incorrect because a public subnet with a network ACL denying all inbound traffic from 0.0.0.0/0 also blocks the corporate IP range, and the instance remains in a public subnet. Option D is incorrect because a public subnet with a security group allowing SSH from 0.0.0.0/0 permits access from the entire internet. Therefore, only option C satisfies both requirements: private subnet and security group restriction to the corporate IP range.

Answer

Place the instance in a private subnet with a route to an internet gateway, and add a security group rule that allows SSH inbound from 198.51.100.0/24.

Answer

Place the instance in a public subnet, and add a network ACL rule that denies all inbound traffic from 0.0.0.0/0.

Answer

Place the instance in a public subnet, and add a security group rule that allows SSH inbound from 0.0.0.0/0.

Question 3

A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. Which feature should they enable on the S3 bucket?

Accepted Answer

Default encryption. Amazon S3 default encryption ensures that all new objects are encrypted at rest. Option A (Versioning) is for maintaining multiple versions of objects, not encryption. Option B (Server access logging) logs requests to the bucket. Option C (Cross-Region Replication) replicates objects to another region but does not enforce encryption. Therefore, the correct answer is D: Default encryption.

Answer

Versioning

Answer

Server access logging

Answer

Cross-Region Replication

Question 4

Refer to the exhibit. A security engineer runs the above command and sees the security group configuration. Based on the output, which statement is correct?

Accepted Answer

The security group allows HTTP traffic from the internet.. The security group allows HTTP from anywhere (0.0.0.0/0) and SSH from a specific IP range. The outbound rule allows all traffic. Option C is correct. Option A is incorrect because the security group has an outbound rule allowing all traffic. Option B is incorrect because SSH is allowed only from a specific IP range, not from any IP address. Option D is incorrect because the output does not indicate multiple associations; it shows only one security group ID.

Answer

The security group has no outbound rules.

Answer

The security group allows SSH access from any IP address.

Answer

The security group is associated with multiple EC2 instances.

Question 5

A company has an AWS Direct Connect connection to its on-premises data center. The security team wants to ensure that traffic between the VPC and the data center is encrypted. Which solution should they use?

Accepted Answer

Set up an IPsec VPN connection over the Direct Connect virtual interface.. AWS Direct Connect does not encrypt traffic by default. To encrypt, you can use an IPsec VPN over the Direct Connect virtual interface (option A). Option B is incorrect because Direct Connect does not support native encryption on the virtual interface; encryption must be added via IPsec or application-level encryption. Option C is not optimal because the requirement specifies using the existing Direct Connect connection, not internet-based VPN. Option D is incorrect because VPC Peering connects VPCs within AWS, not an on-premises data center, and does not provide encryption.

Answer

Enable encryption on the Direct Connect virtual interface.

Answer

Use AWS Site-to-Site VPN over the internet.

Answer

Use VPC Peering to connect the VPC to the data center.

Question 6

Refer to the exhibit. A security engineer reviews this CloudFormation template snippet. What is the security concern with this configuration?

Accepted Answer

The security group allows SSH access from any IP address.. It suggests detaching the volume before taking a snapshot, which is the recommended practice to ensure a consistent snapshot. Detaching a volume while the instance is running is possible for non-root volumes after unmounting, but for root volumes the instance must be stopped first. The original explanation incorrectly indicated Option C as correct.

Answer

The AMI ID is hardcoded.

Answer

The template does not specify a VPC.

Answer

The instance type is too small.

Question 7

A company wants to provide temporary security credentials to users accessing AWS resources from a mobile app. Which AWS service should they use?

Accepted Answer

Amazon Cognito Identity Pools (Federated Identities). Amazon Cognito Identity Pools (Federated Identities) allow you to create unique identities for your users and federate them with identity providers. With an identity pool, you can obtain temporary, limited-privilege AWS credentials to access other AWS services. This is the correct service for providing temporary security credentials to users accessing AWS resources from a mobile app. Option A (AWS Signer) is for code signing, not temporary credentials. Option B (AWS Directory Service) is for managing Microsoft Active Directory, not for generating temporary credentials. Option D (AWS IAM roles for cross-account access) is for granting access between AWS accounts, not for mobile app users.

Answer

AWS Signer

Answer

AWS Directory Service

Answer

AWS IAM roles for cross-account access

Question 8

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used in the S3 bucket policy?

Accepted Answer

aws:SourceVpce. To restrict access to an S3 bucket so that only requests originating from a specific VPC endpoint are allowed, the `aws:SourceVpce` condition key must be used in the S3 bucket policy. This key checks the VPC endpoint ID (e.g., `vpce-1a2b3c4d`) from which the request originated, ensuring that only traffic through that specific endpoint is permitted. Using `aws:SourceVpc` would allow any endpoint within the VPC, not a specific one, and `aws:SourceIp` or `aws:Referer` are irrelevant for VPC endpoint-based access control.

Answer

aws:Referer

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 9

A security engineer notices that an EC2 instance in a private subnet can reach the internet, even though there is no NAT gateway or instance in the route table. What is the most likely cause?

Accepted Answer

An egress-only internet gateway is used for IPv6 traffic.. An egress-only internet gateway (EIGW) allows outbound-only IPv6 traffic from instances in a private subnet to the internet, but it does not permit inbound connections initiated from the internet. Since the question states there is no NAT gateway or instance, and the instance can reach the internet, the most likely cause is that the VPC uses IPv6 and an EIGW is configured with a default route (::/0) pointing to it. This enables outbound internet access without a NAT device, matching the described scenario.

Answer

An internet gateway is attached to the VPC and a default route points to it.

Answer

A VPC endpoint for S3 is configured.

Answer

A NAT gateway is configured in a different availability zone.

Question 10

Which AWS service can be used to create a private network connection between a VPC and an on-premises data center over dedicated physical lines?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it establishes a dedicated, private network connection from an on-premises data center to a VPC using physical Ethernet cables routed through an AWS Direct Connect location. This bypasses the public internet entirely, providing consistent latency, higher bandwidth, and a more reliable connection than internet-based options.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 11

A company has a security group that allows inbound SSH from 0.0.0.0/0. The security team wants to restrict access to only the company's public IP range 203.0.113.0/24. What change should be made?

Accepted Answer

Modify the inbound SSH rule in the security group to source 203.0.113.0/24.. Security groups are stateful and act as a virtual firewall for instances. To restrict inbound SSH access from 0.0.0.0/0 to only the company's public IP range, you must modify the existing inbound rule's source CIDR from 0.0.0.0/0 to 203.0.113.0/24. This change directly updates the allowed source IP range, and since security groups evaluate all rules before making a decision, the more specific allowed range will take effect without needing additional rules.

Answer

Add a network ACL rule to deny SSH from 0.0.0.0/0.

Answer

Add a network ACL rule to allow SSH from 203.0.113.0/24.

Answer

Remove the inbound SSH rule from the security group.

Question 12

A security engineer needs to ensure that all data in transit between an Application Load Balancer (ALB) and EC2 instances is encrypted. What configuration is required?

Accepted Answer

Configure the target group to use HTTPS protocol.. To encrypt traffic between ALB and EC2, the target group must use HTTPS protocol. Option D is correct. Option A (security group) controls access, not encryption. Option B (listener protocol) is for client-to-ALB encryption. Option C (TLS termination) is for the listener, not backend.

Answer

Configure the security group to allow traffic on port 443.

Answer

Configure the ALB listener with HTTPS protocol.

Answer

Configure the ALB to terminate TLS connections.

Question 13

A company wants to store audit logs for a minimum of 7 years to meet compliance requirements. The logs are stored in Amazon S3. Which action should be taken to ensure logs are not deleted before 7 years?

Accepted Answer

Enable S3 Object Lock in Compliance mode with a 7-year retention period on the bucket.. To ensure logs cannot be deleted before 7 years, you must use S3 Object Lock with a Compliance retention period. MFA Delete (A) only adds an MFA requirement for deletions but does not enforce a retention period. Lifecycle policies (B) transition objects but do not prevent deletion. Versioning (C) preserves previous versions but not the current object. Therefore, option D is the correct choice as it implements an immutable retention policy.

Answer

Enable MFA Delete on the bucket.

Answer

Configure an S3 Lifecycle policy to transition objects to Glacier after 7 years.

Answer

Enable S3 Versioning to preserve all versions of objects.

Question 14

Which AWS service can be used to centrally manage VPC security groups and network ACLs across multiple accounts in AWS Organizations?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service because it provides centralized management of security groups and network ACLs across multiple accounts within AWS Organizations. It allows you to define common security rules and apply them automatically to new and existing accounts, ensuring consistent enforcement of VPC security policies without manual per-account configuration.

Answer

AWS Shield

Answer

AWS Config

Answer

AWS WAF

Question 15

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. Which combination of components provides a highly available, managed solution? (Select TWO.)

Accepted Answer

Add a route to the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. A NAT gateway enables outbound internet access for instances in a private subnet while preventing inbound connections from the internet. It is a managed AWS service that automatically scales and is highly available within a single Availability Zone. By adding a route for 0.0.0.0/0 to the NAT gateway in the private subnet's route table, traffic destined for the internet is forwarded to the NAT gateway, which then uses an internet gateway to reach the internet.

Answer

Launch a NAT instance in a public subnet.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an internet gateway to the VPC.