SCS-C02 Infrastructure Security Practice Test 15 — 15 Questions

Question 1

A security engineer is designing a network architecture for a web application that must be highly available and secure. The application uses an Application Load Balancer (ALB) in front of EC2 instances. Which architecture meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the ALB in public subnets and EC2 instances in private subnets across two Availability Zones.. The correct architecture places the ALB in public subnets so it can receive internet traffic, while EC2 instances reside in private subnets for enhanced security. The ALB acts as a reverse proxy, terminating client connections and forwarding requests to the instances over private IPs, which prevents direct internet access to the instances. Deploying across two Availability Zones ensures high availability by surviving an AZ failure.

Answer

Place both the ALB and EC2 instances in private subnets across two Availability Zones.

Answer

Place the ALB in private subnets and EC2 instances in public subnets across two Availability Zones.

Answer

Place both the ALB and EC2 instances in public subnets across two Availability Zones.

Question 2

Which of the following is a best practice for securing an AWS account root user?

Accepted Answer

Enable multi-factor authentication (MFA) and avoid using the root user.. The AWS root user has unrestricted access to all AWS resources and services, making it a high-value target. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond the password, and AWS best practices dictate that the root user should only be used for a limited set of tasks (e.g., changing account settings) and never for daily operations. This minimizes the attack surface and reduces the risk of compromise.

Answer

Create access keys for the root user and use them for API calls.

Answer

Use the root user for daily administrative tasks.

Answer

Share the root user password with the IT team for emergency access.

Question 3

A company is using AWS CloudFormation to deploy infrastructure. Which method ensures that sensitive data, such as database passwords, is not exposed in the template or outputs?

Accepted Answer

Use a dynamic reference to a Systems Manager Parameter Store parameter.. Using a dynamic reference to an AWS Systems Manager Parameter Store parameter allows CloudFormation to retrieve the password at stack creation time without embedding it in the template or exposing it in outputs. The password is stored securely in Parameter Store, and CloudFormation resolves the reference dynamically, ensuring the sensitive value never appears in plaintext in the template, stack events, or outputs.

Answer

Use the 'NoEcho' property on the password parameter.

Answer

Store the password in the template outputs.

Answer

Hardcode the password in the template and use the 'NoEcho' property.

Question 4

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a default security group that allows all outbound traffic. The instance needs to download files from an S3 bucket in the same region. Which configuration allows this without internet access?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the private subnet's route table.. A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet. By adding a route to the private subnet's route table that points to the endpoint, traffic destined for S3 stays within the AWS network. The default security group's outbound rule permits all traffic, so no additional security group changes are needed.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet.

Answer

Create a NAT gateway in the public subnet and add a route to the private subnet's route table.

Question 5

A company is deploying a multi-tier web application across multiple Availability Zones. The application includes a web tier, application tier, and database tier. The security team requires that the web tier can communicate with the application tier only on port 8080, and the application tier can communicate with the database tier only on port 3306. Which security group configuration should be used?

Accepted Answer

In the application tier security group, allow inbound from the web tier security group on port 8080. In the database tier security group, allow inbound from the application tier security group on port 3306.. Security groups allow you to reference other security groups as sources in inbound rules. This enables traffic to flow between instances based on their security group membership, without needing to know IP addresses. Option A correctly uses the application tier security group as the source for the inbound rule on port 8080, and the database tier security group as the source for the inbound rule on port 3306. Option B is incorrect because it uses CIDR blocks for the database tier, which is less specific and could allow traffic from unintended sources. Option C is incorrect because it uses CIDR blocks for the web tier, also less specific. Option D is incorrect because an outbound rule from the web tier does not control which source can initiate communication; inbound rules must be defined on the application tier security group.

Answer

In the database tier security group, allow inbound from the application tier's CIDR block on port 3306.

Answer

In the application tier security group, allow inbound from the web tier's CIDR block on port 8080.

Answer

In the web tier security group, allow outbound to 0.0.0.0/0 on port 8080.

Question 6

A company is designing a network architecture for a critical application that must be highly available and secure. Which TWO actions should be taken to ensure high availability of the network infrastructure?

Accepted Answer

Deploy resources across multiple Availability Zones.. Deploying resources across multiple Availability Zones (AZs) ensures that if one AZ experiences a failure (e.g., power outage, network disruption), the application can continue serving traffic from another AZ. This is the foundational principle of high availability in AWS, as each AZ is isolated but connected via low-latency links, allowing for fault tolerance without single points of failure.

Answer

Use a single internet gateway for the VPC.

Answer

Use a single Availability Zone for all resources to reduce complexity.

Answer

Place all instances in a public subnet for easy access.

Question 7

A security engineer needs to enable VPC Flow Logs to capture traffic metadata. Which THREE components are required to create a VPC Flow Log?

Accepted Answer

A CloudWatch Logs log group to publish the flow logs.. A CloudWatch Logs log group is required because VPC Flow Logs publish traffic metadata to CloudWatch Logs as the default destination. The flow logs are stored as log streams within the specified log group, enabling querying and monitoring via CloudWatch Logs Insights. Without a log group, there is no destination for the flow log records to be sent to.

Answer

An S3 bucket to store the flow logs.

Answer

An Amazon Kinesis Data Firehose delivery stream.

Question 8

Which TWO actions can help protect against DDoS attacks at the network layer?

Accepted Answer

Configure security groups to restrict inbound traffic.. AWS Shield Advanced provides dedicated, always-on detection and automatic inline mitigations for network-layer (Layer 3/4) DDoS attacks, such as SYN floods and UDP floods. Security groups act as a virtual firewall at the instance level, allowing you to restrict inbound traffic to only necessary ports and IP ranges, which reduces the attack surface. Together, these two actions help protect against network-layer DDoS attacks. AWS WAF (option C) operates at the application layer (Layer 7) and is not designed to mitigate network-layer attacks. Option B (network ACLs) would block all inbound traffic, rendering services inaccessible, and is not a recommended DDoS mitigation. VPC peering (option E) is a connectivity feature and does not protect against DDoS.

Answer

Configure network ACLs to deny all inbound traffic.

Answer

Use AWS WAF to filter malicious requests.

Answer

Use VPC peering to distribute traffic.

Question 9

A company is running a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application serves traffic on port 443. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic from the ALB security group on port 8080. The application works correctly. However, the security team wants to add an additional layer of defense by implementing a web application firewall (WAF) to block common web exploits. The team also wants to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) can access the application for administrative purposes on a separate path. The team has enabled AWS WAF on the ALB and associated a web ACL. They have also created a rule to allow traffic from the corporate IP range and block all other traffic. After deploying these changes, external users (not from corporate IP) cannot access the application at all. The company wants external users to be able to access the main application, but only corporate IPs should access the admin path. What should the security engineer do to fix the issue?

Accepted Answer

Modify the WAF rule to allow traffic from the corporate IP range on the admin path and allow all traffic on the main application path.. The correct action is to modify the WAF rule to allow traffic from corporate IPs on the admin path and allow all other traffic on the main application path. Currently, the WAF rule blocks all non-corporate traffic, which prevents external users from accessing the main application. By creating separate conditions for the admin path (corporate IPs only) and the main path (allow all), the security team can achieve the desired access control. Option A is incorrect because it would block external users at the security group level. Option B is unnecessary and adds complexity. Option C removes the WAF protection entirely. Therefore, option D is the correct solution.

Answer

Configure the security group of the ALB to allow only corporate IPs.

Answer

Create two separate ALBs, one for admin traffic and one for main traffic.

Answer

Remove the WAF rule that blocks all non-corporate traffic and rely on security groups.

Question 10

A company is designing a VPC for a three-tier web application that must be accessible from the internet only via HTTPS. The web servers must be able to initiate outbound connections to the internet for software updates, but the database servers must have no direct internet access. Which architecture meets these requirements?

Accepted Answer

Web servers in private subnets with a route to a NAT Gateway, database servers in private subnets with no route to the NAT Gateway, both behind an Application Load Balancer in public subnets. It places the web servers in private subnets with a route to a NAT Gateway for outbound internet access (e.g., software updates), while the database servers are in private subnets with no route to the NAT Gateway, ensuring no direct internet access. Both tiers are behind an Application Load Balancer in public subnets for HTTPS ingress. Option A is wrong because database servers in public subnets have direct internet access. Option B is wrong because web servers in public subnets have direct internet access, reducing security. Option D is wrong because web servers in public subnets with Elastic IPs have direct internet access, and database servers with a route to an internet gateway also have internet access.

Answer

Web servers in private subnets, database servers in public subnets, both behind an Application Load Balancer

Answer

Web servers in public subnets, database servers in private subnets with a route to a NAT Gateway in a public subnet

Answer

Web servers in public subnets with Elastic IPs, database servers in private subnets with a route to an internet gateway

Question 11

A company uses AWS Systems Manager Session Manager to provide SSH access to EC2 instances without needing to open inbound ports. The security team wants to ensure that all session activity is logged and that only authorized users can start sessions. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable AWS CloudTrail to log StartSession API calls.. The correct answers are B and D. Enabling CloudTrail logging captures StartSession API calls, providing an audit trail of session activity. Creating IAM policies that allow the ssm:StartSession action for specific users or roles ensures that only authorized users can initiate sessions. Option A is incorrect because Session Manager does not require SSH key pairs; it uses IAM for authentication. Option C is not the primary method for logging session activity; VPC Flow Logs monitor network traffic but not API calls. Option E is unnecessary because Session Manager does not rely on inbound ports.

Answer

Configure the EC2 instances to require SSH key pairs for authentication.

Answer

Enable VPC Flow Logs to monitor network traffic.

Answer

Use security groups to restrict inbound traffic to the Session Manager endpoints.

Question 12

A security engineer is configuring a Network ACL for a public subnet that hosts a web server. The web server must accept HTTPS (TCP 443) traffic from the internet and respond. It must also be able to initiate outbound connections to the internet for software updates (HTTPS). What is the MINIMUM set of rules required for the inbound and outbound Network ACL?

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0 (for return traffic) and allow TCP 443 to 0.0.0.0/0 (for updates).. Network ACLs are stateless, meaning they require explicit rules for both inbound and outbound traffic. For the web server to accept HTTPS requests from the internet, an inbound rule allowing TCP 443 from 0.0.0.0/0 is needed. For the server to respond to those requests, an outbound rule allowing ephemeral ports (TCP 1024-65535) to 0.0.0.0/0 is required to handle return traffic. Additionally, to allow the server to initiate outbound HTTPS connections for software updates, a separate outbound rule allowing TCP 443 to 0.0.0.0/0 is necessary.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0 and TCP 22 from a management IP; Outbound: allow all traffic to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to a specific software update server IP.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow all traffic to 0.0.0.0/0.

Question 13

A company uses AWS PrivateLink to connect to a SaaS provider's VPC endpoint service. The security team wants to ensure that traffic between the company's VPC and the SaaS provider's VPC is encrypted in transit and that no other AWS service can access the data. Which configuration meets these requirements?

Accepted Answer

Use an AWS PrivateLink endpoint (interface endpoint) in the company's VPC to connect to the SaaS provider's VPC endpoint service.. AWS PrivateLink uses interface VPC endpoints (powered by AWS PrivateLink) to establish a private connection between the company's VPC and the SaaS provider's VPC endpoint service. Traffic stays within the AWS network and is encrypted in transit using TLS (Transport Layer Security) when the application layer uses HTTPS, ensuring no other AWS service can intercept the data. This meets both the encryption and exclusive access requirements without traversing the internet or relying on VPNs.

Answer

Use a Site-to-Site VPN connection between the VPC and the SaaS provider's on-premises network.

Answer

Create a VPC peering connection and use security groups to restrict traffic.

Answer

Use an AWS Transit Gateway with inter-region peering.

Question 14

A company has a security group rule that allows inbound traffic from 0.0.0.0/0 on port 22. The security engineer wants to restrict SSH access to only the company's public IP range (203.0.113.0/24). What is the correct way to update the security group rule?

Accepted Answer

Modify the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Security group rules can be modified in place. Changing the source CIDR from 0.0.0.0/0 to 203.0.113.0/24 restricts inbound SSH traffic to only that range. Option A is incorrect because removing the rule without adding a new one would deny all SSH access, but the goal is to restrict, not deny all. Option C is incorrect because adding a new rule does not automatically deny other traffic; security groups evaluate all rules and allow matching traffic; you must remove the permissive rule. Option D is incorrect because outbound rules do not affect inbound SSH access.

Answer

Remove the existing inbound rule and do not add any new rule; SSH access will be denied by default.

Answer

Add a new inbound rule with source 203.0.113.0/24 and the security group will automatically deny all other traffic.

Answer

Change the outbound rules to restrict traffic.

Question 15

A company uses an AWS Network Firewall to inspect traffic between subnets in a VPC. The security team wants to ensure that all traffic from the web tier to the database tier passes through the firewall. The web servers are in subnet A, and the database servers are in subnet B. What routing configuration is required?

Accepted Answer

Add a route in the route table for subnet A with destination subnet B CIDR and target the firewall endpoint. Add a similar route in subnet B's route table with destination subnet A CIDR and target the firewall endpoint.. To force traffic between subnets through the AWS Network Firewall, you need symmetric routes: add a route in subnet A's route table for destination subnet B CIDR with target the firewall endpoint, and similarly add a route in subnet B's route table for destination subnet A CIDR with target the firewall endpoint. This ensures both forward and return traffic pass through the firewall. Option A is wrong because it sends all traffic from subnet A to the firewall, which is overly broad and may break other traffic; more importantly, it does not ensure return traffic from subnet B goes through the firewall. Option C is wrong because it only handles return traffic from subnet B but not the forward traffic from subnet A. Option D is wrong because both subnets cannot be in the same route table if they need different routes; also, sending all traffic from both subnets to the firewall is not the correct setup for inter-subnet traffic inspection.

Answer

Add a route in the route table associated with subnet A that sends all traffic to the firewall endpoint.

Answer

Add a route in the route table associated with subnet B that sends all traffic to the firewall endpoint.

Answer

Associate both subnets with the same route table and add a route to the firewall endpoint for all traffic.