SCS-C02 Infrastructure Security Practice Test 15 — 15 Questions

Question 1

A company wants to host a static website in an Amazon S3 bucket. The bucket must be private and accessible only through an Amazon CloudFront distribution. Which configuration ensures that CloudFront can access the S3 bucket while blocking direct access via S3 URL?

Accepted Answer

Create an Origin Access Control (OAC) and update the bucket policy to allow access only to the CloudFront distribution. Option A is correct because an Origin Access Control (OAC) allows CloudFront to access the bucket while blocking direct S3 access. Option B is wrong because a bucket policy allowing s3:GetObject from CloudFront's service principal is the older method (OAI), but OAC is the recommended approach. Option C is wrong because S3 block public access would also block CloudFront if not properly configured. Option D is wrong because CloudFront signed URLs are for end users, not for origin access.

Answer

Use CloudFront signed URLs and configure the bucket policy to allow access from CloudFront IP ranges

Answer

Enable S3 Block Public Access and configure CloudFront to use the bucket as an origin

Answer

Configure the bucket policy to allow s3:GetObject from the CloudFront service principal

Question 2

A company uses AWS Systems Manager Session Manager to manage EC2 instances. The security team wants to ensure that all SSH sessions are logged and that commands are recorded. What should be configured?

Accepted Answer

Enable session logging in the Session Manager preferences to send logs to Amazon S3 and CloudWatch Logs. Option C is correct because Session Manager can log session activity to Amazon S3 and CloudWatch Logs, and enable command recording. Option A is wrong because an IAM policy only controls permissions to start sessions, not logging. Option B is wrong because security groups control network access, not logging. Option D is wrong because CloudTrail logs API calls, not the commands run within a session.

Answer

Configure the security group to allow inbound SSH from the Session Manager service

Answer

Enable AWS CloudTrail to log Systems Manager API calls

Answer

Create an IAM policy that allows ssm:StartSession and attach it to the instance role

Question 3

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

Accepted Answer

Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway. Option D is correct because a NAT Gateway in a public subnet allows outbound internet access from private subnets while blocking inbound traffic. Option A is wrong because an internet gateway attached to the private subnet would allow inbound traffic. Option B is wrong because a bastion host is for SSH access, not for outbound internet. Option C is wrong because a VPC endpoint is for private connectivity to AWS services, not general internet.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it

Answer

Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

Answer

Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

Question 4

A security engineer needs to ensure that an EC2 instance can only be accessed using SSH key pairs, not passwords. Which configuration is required?

Accepted Answer

Set 'PasswordAuthentication no' in /etc/ssh/sshd_config on the EC2 instance. Option B is correct because disabling password authentication in the SSH daemon configuration ensures only key-based authentication is allowed. Option A is wrong because security groups control network access, not authentication method. Option C is wrong because IAM roles do not affect SSH authentication. Option D is wrong because EC2 Instance Connect is an alternative, not a method to enforce key-only.

Answer

Use EC2 Instance Connect instead of SSH

Answer

Attach an IAM role to the instance that denies password-based access

Answer

Configure the security group to allow SSH only from specific IP addresses

Question 5

A company uses AWS WAF to protect a web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match rule. Option D is correct because AWS WAF provides a dedicated SQL injection match rule that inspects incoming requests for SQL injection patterns in the URI, query string, or body. This rule uses a set of predefined SQL-like patterns (e.g., 'OR 1=1', 'UNION SELECT') to detect and block malicious input, directly addressing the security team's requirement.

Answer

IP set rule

Answer

Geographic match rule

Answer

Rate-based rule

Question 6

A company wants to allow cross-account access to an S3 bucket. The bucket owner (Account A) wants to grant read-only access to users in Account B. Which combination of policies is required?

Accepted Answer

A bucket policy in Account A granting s3:GetObject to Account B and an IAM policy in Account B allowing s3:GetObject. Option A is correct because cross-account access requires both a bucket policy granting access and an IAM policy in the accessing account allowing the action. Option B is wrong because an IAM role in Account A would require users to assume the role. Option C is wrong because a bucket ACL is not the recommended method and does not work with IAM policies alone. Option D is wrong because the accessing account must have an IAM policy to allow the action.

Answer

A bucket ACL in Account A granting READ access to Account B

Answer

An IAM policy in Account A that allows s3:GetObject

Answer

An IAM role in Account B that grants s3:GetObject to Account A

Question 7

A security engineer needs to audit all changes to AWS resources in an account. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and changes to AWS resources as events, providing an audit log of who made what change, when, and from where. This directly meets the requirement to audit all changes, as every AWS API call (e.g., CreateInstance, ModifySecurityGroup) is captured in a CloudTrail event history or delivered to an S3 bucket for long-term analysis.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 8

A company is designing a VPC with multiple subnets. The security team wants to ensure that traffic between the application tier and database tier is encrypted in transit. Which TWO actions should be taken?

Accepted Answer

Enable encryption on the database connections using TLS/SSL. Options A and C are correct. Using TLS/SSL for database connections encrypts data in transit, and ensuring the application uses an encrypted protocol is fundamental. Option B is wrong because VPC Peering does not encrypt traffic. Option D is wrong because security groups do not encrypt. Option E is wrong because an internet gateway does not provide encryption.

Answer

Attach an internet gateway to the database subnet

Answer

Use security group rules to restrict traffic to the database port

Answer

Use VPC Peering to connect the subnets

Question 9

A security engineer is configuring an AWS WAF web ACL for an Application Load Balancer. The engineer wants to block requests that contain cross-site scripting (XSS) and also limit the rate of requests from a single IP. Which THREE rule groups should be added?

Accepted Answer

Rate-based rule. Options A, C, and E are correct. The AWS Managed Rules for XSS (A) and Rate-based rules (C) address the requirements, and the SQL injection rule group (E) is commonly included for comprehensive protection. Option B is wrong because an IP set rule allows/denies specific IPs, not rate limiting. Option D is wrong because geographic match rules are for location-based blocking, not behavior.

Answer

AWS Managed Rules - IP reputation rule group

Answer

Geographic match rule

Question 10

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation have encryption enabled by default. Which TWO approaches can achieve this?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket encryption and auto-remediates. Options B and D are correct. A CloudFormation Stack Policy (B) can enforce encryption settings. AWS Config rules (D) can detect and remediate non-compliant buckets. Option A is wrong because S3 Block Public Access does not enforce encryption. Option C is wrong because SCPs apply to accounts, not CloudFormation stacks. Option E is wrong because IAM roles do not enforce encryption on S3 buckets.

Answer

Enable S3 Block Public Access at the account level

Answer

Attach a service control policy (SCP) to the root OU that denies S3 bucket creation without encryption

Answer

Attach an IAM role to the CloudFormation service that grants permissions to encrypt buckets

Question 11

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

Accepted Answer

The source IP condition does not match the user's actual IP address. Option C is correct because the policy grants access based on the source IP of the request. IAM user credentials are used, but the actual source IP must match the condition. Option A is wrong because the policy allows GetObject. Option B is wrong because the policy does not require a specific IAM role. Option D is wrong because the bucket policy is not shown; the IAM policy is the issue.

Answer

The bucket policy overrides the IAM policy

Answer

The policy does not allow the s3:GetObject action

Answer

The user is not assuming the correct IAM role

Question 12

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

Accepted Answer

The EC2 instances in this security group cannot initiate outbound connections. Option A is correct because a security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing. Option D is wrong because the security group does allow inbound HTTP.

Answer

The EC2 instances cannot receive inbound HTTP traffic

Answer

The security group allows all outbound traffic by default

Answer

Outbound traffic is allowed because security groups are stateful

Question 13

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

Accepted Answer

Create an Origin Access Control (OAC) for the S3 bucket origin. Option C is correct because an Origin Access Control (OAC) prevents direct access to the S3 bucket. Option A is wrong because the alias record already points to CloudFront. Option B is wrong because CloudFront signed URLs are for user authentication, not origin access. Option D is wrong because security groups are for EC2, not S3.

Answer

Create a Route 53 health check to verify CloudFront availability

Answer

Configure CloudFront signed URLs to restrict access

Answer

Attach a security group to the S3 bucket

Question 14

A company is designing a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates but cannot be directly accessed from the internet. Which AWS service or feature should be used to meet this requirement?

Accepted Answer

NAT Gateway. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway is used for public subnets and allows inbound traffic. Option C is wrong because a VPN connection is for site-to-site connectivity, not internet access. Option D is wrong because a VPC Peering connection connects VPCs, not to the internet.

Answer

VPC Peering

Answer

AWS VPN

Answer

Internet Gateway

Question 15

A security engineer is troubleshooting connectivity issues from an EC2 instance in a private subnet to an S3 bucket. The instance has a security group allowing outbound HTTPS (443) to 0.0.0.0/0, and the subnet's network ACL allows outbound HTTPS to 0.0.0.0/0. However, requests to S3 are timing out. Which additional configuration is most likely required?

Accepted Answer

Add a VPC Gateway Endpoint for S3 and update the route table. Option C is correct because S3 endpoints are accessed via a prefix list in route tables; without a VPC Gateway Endpoint for S3, traffic goes through a NAT Gateway or Internet Gateway, but the private subnet lacks a route to the internet. Option A is wrong because S3 supports HTTPS without TLS termination. Option B is wrong because S3 is a global service and does not require a specific region endpoint configuration at the VPC level. Option D is wrong because S3 does not require an IAM role for connectivity; that is for access permissions.

Answer

Attach an IAM role to the EC2 instance with S3 permissions

Answer

Modify the security group to allow traffic to the S3 region-specific IP range

Answer

Configure a TLS termination proxy