SCS-C02 Infrastructure Security Practice Test 15 — 15 Questions

Question 1

A company's security engineer is configuring a web application firewall (WAF) to protect a public-facing Application Load Balancer (ALB). The application is vulnerable to SQL injection attacks. Which AWS WAF rule should be used to mitigate this threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a rule from the AWS Managed Rules for SQL injection.. AWS WAF includes managed rule groups specifically designed to detect and block SQL injection attacks by inspecting request parameters, URIs, and headers for malicious SQL patterns. This directly addresses the vulnerability described in the scenario, as SQL injection targets the application's database layer through crafted input.

Answer

Add a rule to block cross-site scripting (XSS) attacks.

Answer

Add a rate-based rule to limit requests per IP.

Answer

Add a geographic match rule to block traffic from specific countries.

Question 2

Refer to the exhibit. A security engineer runs the command above and sees that the flow log status is ACTIVE. However, the engineer notices that no logs are appearing in the CloudWatch log group. What is the most likely cause?

Accepted Answer

The IAM role specified in DeliverLogsPermissionArn does not have permissions to PutLogEvents.. The most likely cause is that the IAM role specified in the DeliverLogsPermissionArn does not have the necessary permissions to call PutLogEvents on the CloudWatch Logs log group. Even if the flow log status is ACTIVE, the delivery of log records will silently fail if the role lacks the required logs:PutLogEvents, logs:CreateLogStream, and logs:DescribeLogStreams actions. The ACTIVE status only indicates that the flow log configuration is valid and the service is attempting to deliver logs, not that delivery is succeeding.

Answer

The TrafficType is set to ALL, which captures too much data and causes throttling.

Answer

The flow log is attached to an ENI instead of a subnet.

Answer

The flow log destination is set to CloudWatch Logs but the log group is encrypted with KMS.

Question 3

A company wants to allow a user to assume a role in another AWS account to access resources. Which AWS service should be used to create and manage the trust relationship between the accounts?

Accepted Answer

IAM roles with a trust policy that allows the external account.. IAM roles with a trust policy that explicitly allows the external AWS account to assume the role is the correct mechanism for establishing a cross-account trust relationship. The trust policy defines which principal (the external account) is allowed to assume the role, and the permissions policy attached to the role controls what actions the assumed role can perform. This is the foundational AWS service for delegating access across accounts.

Answer

AWS Security Token Service (STS) to generate tokens.

Answer

IAM users in the source account with cross-account permissions.

Answer

AWS Organizations service control policies.

Question 4

Which TWO actions should a security engineer take to protect an Amazon EC2 instance from unauthorized access? (Choose two.)

Accepted Answer

Configure security groups to allow only necessary inbound traffic.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. By configuring security groups to allow only necessary inbound traffic (Option C), you follow the principle of least privilege, reducing the attack surface. This is a fundamental security best practice for protecting EC2 instances from unauthorized access.

Answer

Place the instance in a public subnet and rely solely on security groups.

Answer

Disable termination protection so the instance can be easily terminated if compromised.

Answer

Enable detailed billing to monitor instance usage.

Question 5

Which THREE measures can be taken to secure a VPC's network boundary? (Choose three.)

Accepted Answer

Use security groups to control inbound and outbound traffic at the instance level.. Option B is correct because security groups act as stateful virtual firewalls at the instance/ENI level, allowing you to permit only specific inbound and outbound traffic, which directly hardens the VPC boundary. Option D is correct because network ACLs provide stateless subnet-level filtering with allow and deny rules, adding a second layer of defense that complements security groups. Option E is correct because VPC Flow Logs capture IP traffic metadata to CloudWatch Logs or S3, enabling detection and analysis of suspicious or unauthorized traffic crossing the VPC boundary. Option A is not correct here because an S3 bucket policy secures access to an S3 bucket, not the VPC network boundary. Option C is not correct because attaching an internet gateway enables connectivity to the internet rather than restricting or securing the boundary.

Answer

Attach an S3 bucket policy to restrict access to the bucket.

Answer

Attach an internet gateway to the VPC.

Question 6

A company is using AWS CloudTrail to monitor API activity in their account. They have enabled CloudTrail in all regions and are logging to an S3 bucket. The security team wants to ensure that log files are not tampered with after delivery. They enable CloudTrail log file integrity validation. Which additional step must be taken to verify the integrity of the log files?

Accepted Answer

Use the AWS CLI to run the validate-logs command against the log files.. CloudTrail log file integrity validation uses digital signatures (SHA-256 hashing and signing with a private key). To verify integrity, you must use the AWS CLI command 'aws cloudtrail validate-logs' or download the public key and verify manually. Option A (enable S3 versioning) helps protect against accidental deletion or overwriting but does not verify integrity. Option B (use KMS to encrypt logs) protects confidentiality only. Option C (use S3 Object Lock) prevents deletion or modification but does not provide tamper detection or integrity verification.

Answer

Enable S3 versioning on the log bucket.

Answer

Configure the S3 bucket to use server-side encryption with AWS KMS.

Answer

Enable S3 Object Lock on the log bucket.

Question 7

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can download objects. Which combination of actions should the company take? (Choose TWO.)

Accepted Answer

Create an S3 bucket policy that allows access only from the VPC using the aws:SourceVpc condition.. To restrict access to an S3 bucket so that only traffic from a specific VPC can download objects, the correct combination is to create an S3 bucket policy that uses the aws:SourceVpc condition (Option C) and create a VPC endpoint for Amazon S3 in the VPC (Option E). The bucket policy with aws:SourceVpc ensures that only requests originating from the specified VPC are allowed, while the VPC endpoint enables private connectivity between the VPC and S3 without traversing the internet. Option A (Internet gateway) would make the VPC publicly accessible and is not required for private access. Option B (NAT gateway) is used for outbound internet access from private subnets, not for restricting access to S3. Option D (security group) cannot be attached to an S3 bucket; security groups apply to EC2 instances or other resources, not to S3.

Answer

Attach an Internet gateway to the VPC and route traffic through it.

Answer

Attach a security group to the S3 bucket.

Answer

Create a NAT gateway in the VPC for outbound traffic.

Question 8

A security engineer is designing a multi-tier web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The engineer needs to ensure that the EC2 instances only accept traffic from the ALB and not from any other source. Which security group configuration should the engineer use?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group on the EC2 instances' security group.. It uses a security group reference to allow inbound HTTP traffic from the ALB's security group. This ensures that only traffic originating from the ALB (which has that security group attached) can reach the EC2 instances, regardless of the ALB's IP addresses or changes in the VPC CIDR. This is the recommended AWS best practice for securing traffic between an ALB and backend instances.

Answer

Allow inbound HTTP traffic from the ALB's public IP address on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from the VPC CIDR range on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 instances' security group.

Question 9

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.. The most likely cause is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from private instances cannot reach the NAT gateway, and thus cannot access the internet. Option B is incorrect because a NAT gateway must have an Elastic IP assigned during creation, so it would not be missing. Option C is incorrect because NAT gateways do not have security groups; they are managed by AWS and the security group concept does not apply. Option D is incorrect because network ACLs are stateless and must allow both inbound and outbound traffic, but the issue here is more likely with routing.

Answer

The NAT gateway does not have an Elastic IP address assigned.

Answer

The security group for the NAT gateway does not allow inbound traffic from the private subnets.

Answer

The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.

Question 10

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

Accepted Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.. It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.

Answer

Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.

Answer

Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.

Answer

Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.

Question 11

A company wants to allow an EC2 instance to access an S3 bucket without exposing the instance to the internet. Which AWS service should be used to achieve this?

Accepted Answer

VPC Endpoint (Gateway type) for S3. A VPC Endpoint (Gateway type) for S3 allows EC2 instances within a VPC to access S3 buckets privately using AWS's internal network, without traversing the internet. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic to the endpoint, which uses AWS's private infrastructure. It eliminates the need for an internet gateway, NAT gateway, or VPN connection, ensuring the instance remains isolated from the public internet.

Answer

NAT Gateway

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway

Question 12

A security engineer is reviewing the security group rules for a web server. The security group currently has the following inbound rules: allow HTTP from 0.0.0.0/0, allow HTTPS from 0.0.0.0/0, and allow SSH from 0.0.0.0/0. Which change should the engineer make to improve security?

Accepted Answer

Change the SSH rule to allow from a specific IP range used by the company's administrators.. Restricting SSH access (TCP port 22) to a specific IP range used by the company's administrators follows the principle of least privilege. The current rule allows SSH from 0.0.0.0/0, which exposes the server to brute-force attacks and unauthorized access from the entire internet. By limiting the source to only trusted administrative IPs, the attack surface is significantly reduced while still allowing necessary remote management.

Answer

Remove the HTTP rule and keep only HTTPS.

Answer

Change the SSH rule to allow from the VPC CIDR only.

Answer

Add a rule to allow ICMP from 0.0.0.0/0.

Question 13

A company is using AWS Systems Manager Session Manager to provide secure shell access to EC2 instances without opening inbound ports. Which of the following is a requirement for this setup?

Accepted Answer

The EC2 instance must have an IAM role that allows SSM actions.. AWS Systems Manager Session Manager establishes a secure shell connection to EC2 instances without requiring inbound ports. The EC2 instance must have an IAM role attached that includes the AWS managed policy AmazonSSMManagedInstanceCore, which grants permissions for the SSM agent to communicate with the Systems Manager service. This IAM role is essential because the SSM agent uses AWS credentials from the instance metadata to authenticate and establish a bidirectional control channel via HTTPS (port 443) to the Systems Manager endpoint, not through traditional SSH.

Answer

The EC2 instance must be in a public subnet.

Answer

The EC2 instance must have a public IP address.

Answer

The security group must allow inbound SSH from 0.0.0.0/0.

Question 14

A security engineer is configuring a VPC for a web application. The VPC has public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The engineer wants to ensure that the database servers are not accessible from the internet. Which two actions should the engineer take?

Accepted Answer

Ensure the route table for the database subnets does not have a default route to an Internet Gateway.. Removing the default route (0.0.0.0/0) to an Internet Gateway (IGW) from the route table associated with the database subnets ensures that traffic from those subnets cannot reach the internet, and the internet cannot initiate connections to instances in those subnets. This is the fundamental network-level isolation required for private subnets in a VPC.

Answer

Place the database instances in a public subnet with a NAT gateway.

Answer

Assign public IP addresses to the database instances.

Answer

Configure a network ACL on the database subnets to deny all inbound traffic.

Question 15

A security engineer is reviewing the security of an Amazon EKS cluster. The cluster is used to run containerized applications. Which three actions should the engineer take to improve the security of the cluster?

Accepted Answer

Restrict access to the cluster using AWS IAM authentication for kubectl.. Restricting access to the cluster using AWS IAM authentication for kubectl is correct because it integrates with AWS IAM to manage user and role permissions, ensuring that only authorized principals can interact with the EKS cluster. This replaces the default, less secure static token or certificate-based authentication with a robust, auditable identity federation. By mapping IAM roles to Kubernetes RBAC, you enforce least-privilege access and prevent unauthorized API calls.

Answer

Use the default VPC for the cluster.

Answer

Grant the cluster-admin role to all developers.