SCS-C02 Infrastructure Security Practice Test 14 — 15 Questions

Question 1

A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the instances' security group to allow traffic from the ALB's security group.. Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.

Answer

Configure the instances' security group to allow traffic from the client's source IP addresses.

Answer

Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.

Answer

Assign an IAM role to the instances that allows traffic only from the ALB.

Question 2

A company wants to block SSH access (port 22) to all EC2 instances from the internet, but allow SSH from a specific management VPN IP range (10.0.0.0/16). Which configuration should be used?

Accepted Answer

Configure a security group to allow inbound SSH from 10.0.0.0/16 only.. Security groups are stateful firewalls that control inbound and outbound traffic at the instance level. By configuring a security group to allow inbound SSH (port 22) only from the management VPN IP range (10.0.0.0/16), all other inbound traffic on port 22 is implicitly denied because security groups operate on a default-deny principle. This meets the requirement to block SSH from the internet while permitting access from the specified internal range.

Answer

Use an IAM policy to restrict SSH access to the management IP range.

Answer

Configure a network ACL to allow inbound SSH from 10.0.0.0/16 and deny from 0.0.0.0/0.

Answer

Configure a security group to allow inbound SSH from 0.0.0.0/0 and deny from 10.0.0.0/16.

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to inspect all traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Use Transit Gateway with appliance mode and route tables to direct traffic through a firewall appliance in a central VPC.. Transit Gateway with appliance mode enables the firewall appliance in a central VPC to receive traffic from all attached VPCs with symmetric routing, ensuring that both forward and return traffic flows through the same appliance. By configuring route tables to direct inter-VPC traffic to the firewall appliance's elastic network interface (ENI), the security team can inspect all traffic without requiring complex peering or on-premises backhauling.

Answer

Set up AWS Direct Connect and route all traffic through the on-premises firewall.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Answer

Configure network ACLs in each VPC to block traffic unless it comes from the firewall.

Question 4

A company needs to securely store database credentials used by a Lambda function. The credentials must be automatically rotated. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets throughout their lifecycle. It natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB databases without requiring custom code, and it integrates directly with Lambda via the AWS SDK to retrieve secrets on demand.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 5

A security engineer is configuring a new VPC with public and private subnets. The application servers in the private subnet need to download patches from the internet. Which component is required?

Accepted Answer

NAT gateway. A NAT gateway is required to allow instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing the internet from initiating inbound connections to those instances. The NAT gateway resides in a public subnet with an attached Internet Gateway, and it translates the private IP addresses of the application servers to the NAT gateway's Elastic IP address for outbound traffic.

Answer

VPC endpoint

Answer

Direct Connect

Answer

Internet gateway

Question 6

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all CloudFormation stacks include a specific tag "Environment" with a value of "Production" or "Development". Which approach should be used?

Accepted Answer

Use AWS CloudFormation Guard to validate that the template includes the required tag with allowed values.. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to validate CloudFormation templates before they are used to create or update stacks. By writing a Guard rule that checks for the 'Environment' tag with allowed values of 'Production' or 'Development', you can enforce this requirement at the template level, preventing non-compliant stacks from being deployed. This approach is proactive, catching violations during the authoring or CI/CD pipeline stage rather than after deployment.

Answer

Apply an IAM policy that requires the tag on all CloudFormation actions.

Answer

Use AWS Config to detect and automatically remediate non-compliant stacks.

Answer

Create an SCP to deny CloudFormation stacks that do not have the required tag.

Question 7

A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)

Accepted Answer

Place the web servers in a public subnet with a route to an internet gateway.. Option B is correct because placing the web servers in a public subnet with a route to an internet gateway (0.0.0.0/0 → igw-xxxx) is exactly what makes them reachable from the internet, satisfying the requirement that web servers be internet-accessible. Option E is correct because referencing the web servers' security group as the source in the application servers' security group inbound rules enforces that only instances in that web security group can reach the application tier, which is the recommended, identity-based way to restrict access in a multi-tier design. Option A is not needed here: a NAT gateway provides outbound-only internet access for private subnets and does not control inbound access from the web tier, so it does not satisfy the stated requirement. Option C is not the best fit because network ACLs are stateless subnet-level filters based on CIDR ranges; while they can restrict traffic, they are not the mechanism that ties access to the web servers' identity, and the question asks for the configuration that limits application access to the web servers specifically. Option D is wrong because putting the application servers in a public subnet with an internet gateway route would expose them to the internet, directly violating the requirement that they be reachable only from the web servers.

Answer

Configure a NAT gateway in the private subnet for the application servers.

Answer

Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.

Answer

Place the application servers in a public subnet with a route to an internet gateway.

Question 8

A company wants to ensure that all Amazon S3 bucket policies comply with a security baseline that prohibits public read access. Which TWO methods can be used to detect non-compliant buckets? (Choose TWO.)

Accepted Answer

Use IAM Access Analyzer to review bucket policies for public access.. IAM Access Analyzer reviews resource policies to identify resources shared with an external entity. For S3 buckets, it can analyze bucket policies and detect if they grant public read access (i.e., access to 'Principal': '*'). This directly identifies non-compliant buckets against the security baseline that prohibits public read access.

Answer

Enable AWS CloudTrail to monitor GetPublicAccessBlock calls.

Answer

Use Amazon Inspector to scan bucket policies.

Answer

Use AWS Trusted Advisor to check S3 bucket permissions.

Question 9

Refer to the exhibit. A security engineer runs the describe-instances command for an EC2 instance. The instance has a public IP address. The security group "allow-ssh-http" has inbound rules that allow SSH from 0.0.0.0/0 and HTTP from 0.0.0.0/0. The engineer wants to block SSH access from the internet while keeping HTTP access. Which change should be made?

Accepted Answer

Remove the inbound rule that allows SSH from 0.0.0.0/0 from the security group.. Security groups are stateful and support only allow rules; removing the inbound SSH rule from the security group effectively blocks SSH access from the internet (0.0.0.0/0) while the HTTP rule remains, allowing HTTP traffic. Since the instance already has a public IP address, removing the SSH rule is the simplest and most direct way to achieve the goal without affecting other traffic.

Answer

Add a network ACL rule to deny SSH inbound from 0.0.0.0/0.

Answer

Disassociate the public IP address from the instance.

Answer

Modify the security group to add a deny rule for SSH from 0.0.0.0/0.

Question 10

A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?

Accepted Answer

Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.. Security groups are stateful and support referencing other security groups as a source, which allows you to permit traffic from the web security group to the database security group on port 3306 without needing to specify IP addresses. This approach minimizes administrative overhead as security group rules are automatically applied to all instances associated with the group, and changes propagate without updating network ACLs or CIDR ranges. The web security group can have an inbound rule allowing HTTPS (port 443) from the internet (0.0.0.0/0), while the database security group only allows inbound MySQL/Aurora (port 3306) from the web security group, meeting the access requirements precisely.

Answer

Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.

Answer

Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.

Question 11

Refer to the exhibit. A security engineer is reviewing this IAM policy attached to a user. The user reports that they are able to stop and start instances, but they cannot terminate instances. However, the engineer notices that there is no explicit deny for termination. Why is the user unable to terminate instances?

Accepted Answer

The policy does not include an explicit Allow for ec2:TerminateInstances.. IAM policies operate on an explicit allow model. Even though there is no explicit deny for ec2:TerminateInstances, the user is unable to terminate instances because the policy does not include an explicit Allow action for ec2:TerminateInstances. Without an explicit Allow, the default behavior is to deny the action, regardless of whether a deny statement is present.

Answer

The second statement's Resource is set to '*' but the Action list does not include termination.

Answer

The first statement's Resource element is too restrictive and does not include the termination API call.

Answer

The policy has a syntax error that prevents termination from being evaluated.

Question 12

A company wants to ensure that all data in transit between its EC2 instances and an RDS database is encrypted. The instances and the database are in the same VPC. Which configuration step is necessary to achieve this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL.. To encrypt data in transit between EC2 instances and an RDS database within the same VPC, you must enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL. This ensures that the network traffic is encrypted at the transport layer, protecting against eavesdropping or man-in-the-middle attacks. AWS RDS supports SSL/TLS for most database engines, and the client must explicitly request an encrypted connection.

Answer

Enable encryption at rest for the RDS instance using AWS KMS.

Answer

Set up a VPN connection between the EC2 instances and the RDS database.

Answer

Configure the security group for the RDS instance to enforce encryption.

Question 13

A security engineer needs to restrict outbound traffic from a VPC to only allow HTTPS traffic to specific domains (e.g., api.example.com). The VPC has a NAT gateway in a public subnet. What is the most secure way to implement this restriction?

Accepted Answer

Deploy an AWS Network Firewall in the VPC and configure domain filtering rules.. AWS Network Firewall provides stateful, application-layer inspection that can filter outbound HTTPS traffic based on domain names (SNI/TLS hostnames), not just IP addresses. This allows you to restrict traffic to specific domains like api.example.com even if their IP addresses change, which is more secure and manageable than IP-based rules. Security groups and network ACLs cannot filter by domain name, and VPC endpoints are for specific AWS services, not general HTTPS domains.

Answer

Configure security group egress rules to allow HTTPS to 0.0.0.0/0.

Answer

Configure network ACL outbound rules to allow HTTPS to the IP addresses of the allowed domains.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it.

Question 14

Refer to the exhibit. A security engineer is reviewing this CloudFormation template. What security risk is present in this configuration?

Accepted Answer

SSH access is allowed from a large internal CIDR block (10.0.0.0/8) which could expose the instance to unnecessary internal threats.. Allowing SSH (TCP port 22) from the entire 10.0.0.0/8 CIDR block is overly permissive. This range encompasses all RFC 1918 private addresses in the 10.x.x.x space, which could include many internal subnets, VPNs, or peered VPCs that do not require administrative access. Unnecessarily broad internal access increases the attack surface and violates the principle of least privilege.

Answer

The template does not associate the security group with the instance, so the instance has no security group.

Answer

HTTP access is allowed from all IP addresses (0.0.0.0/0) which is a security risk.

Answer

The template uses SecurityGroups property instead of SecurityGroupIds, which is deprecated.

Question 15

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all access to the bucket is encrypted in transit. Which policy should be attached to the bucket to enforce this?

Accepted Answer

Attach a bucket policy that denies requests when aws:SecureTransport is false.. The `aws:SecureTransport` condition key in an S3 bucket policy evaluates whether the request was sent over HTTPS (TLS). By attaching a bucket policy that denies access when `aws:SecureTransport` is false, the security team enforces that all access to the bucket must be encrypted in transit, blocking any HTTP requests.

Answer

Configure a bucket policy that denies requests that do not include the x-amz-server-side-encryption header.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Use Amazon CloudFront to serve the content and require HTTPS.