SCS-C02 Infrastructure Security Practice Test 16 — 15 Questions

Question 1

A security engineer needs to protect an S3 bucket that contains sensitive data. Which two methods should the engineer use?

Accepted Answer

Apply an S3 bucket policy that restricts access to specific IAM users or roles.. Option C is correct because an S3 bucket policy is a resource-based policy attached directly to the bucket that can explicitly allow or deny access based on principals (specific IAM users, roles, or accounts), conditions such as source VPC endpoint or IP range, and actions, making it the primary tool for restricting who can reach sensitive objects. Option D is correct because IAM policies are identity-based policies attached to users, groups, or roles that define which S3 actions (for example s3:GetObject, s3:PutObject) those identities may perform on the bucket and its objects; combined with the bucket policy, they enforce least-privilege access. Option A is not correct because CloudFront is a content-delivery service that can front an S3 bucket for performance or OAC-based access, but it does not by itself protect the bucket's data or restrict direct S3 access. Option B is not correct because VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC and have no relationship to S3 bucket access control. Option E is not correct because S3 object ACLs are legacy access-control lists that grant only coarse read/write permissions to individual objects and are not the recommended mechanism for restricting sensitive bucket data to specific IAM principals.

Answer

Use Amazon CloudFront to serve the content.

Answer

Enable VPC Flow Logs on the bucket.

Answer

Enable S3 object ACLs.

Question 2

A company is considering using AWS Shield Advanced to protect against DDoS attacks. Which three features are included with AWS Shield Advanced? (Choose THREE.)

Accepted Answer

Cost protection against DDoS-related scaling charges. AWS Shield Advanced provides cost protection against DDoS-related scaling charges, meaning if your EC2 or ELB instances scale up due to a DDoS attack, AWS will provide credits for the additional resources incurred. This is a key financial safeguard included in the Shield Advanced subscription.

Answer

Dedicated IP addresses for EC2 instances

Answer

AWS Site-to-Site VPN

Question 3

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?

Accepted Answer

There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.. AWS WAF evaluates rules in priority order, and the first rule that matches determines the action. If an allow rule with a lower number (higher priority) matches all requests, the block rule is never evaluated. Therefore, the most likely cause is that an allow rule with higher priority is permitting all traffic before the block rule can inspect the header.

Answer

AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.

Answer

AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.

Answer

The regex pattern for the token is too complex for AWS WAF to process.

Question 4

A company wants to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key checks whether the request was sent using SSL/TLS (i.e., HTTPS). Setting it to `false` in a deny statement ensures that any HTTP request to the S3 bucket is rejected, thereby enforcing encryption in transit. This is the correct condition for the stated requirement.

Answer

aws:SourceVpce

Answer

s3:x-amz-server-side-encryption

Answer

aws:SourceIp

Question 5

A security engineer is designing a VPC with private and public subnets. Which TWO actions improve network security? (Choose two.)

Accepted Answer

Use security groups to restrict traffic to the database from only the application tier.. Security groups act as a stateful virtual firewall at the instance level, allowing you to restrict inbound traffic to the database instances to only the application tier's security group. This ensures that only traffic originating from the application instances can reach the database, effectively implementing a least-privilege security model.

Answer

Use a single subnet for all resources to simplify network rules.

Answer

Place database instances in a public subnet for easier management.

Answer

Place an internet gateway in a private subnet.

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to allow only HTTP and HTTPS traffic from the internet to the ALB, and only HTTP traffic from the ALB to the EC2 instances. Which THREE security group configurations are required? (Choose three.)

Accepted Answer

ALB security group: inbound rule allowing HTTP from 0.0.0.0/0.. The ALB must accept HTTP traffic from the internet (0.0.0.0/0) to serve web requests. This inbound rule allows the ALB to listen on port 80 for unencrypted HTTP traffic, which is a standard requirement for a public-facing web application. Without this rule, HTTP requests from clients would be dropped by the ALB's security group.

Answer

EC2 security group: inbound rule allowing HTTP from 0.0.0.0/0.

Answer

EC2 security group: inbound rule allowing HTTPS from ALB security group.

Question 7

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all Amazon S3 buckets across the organization are configured to block public access. Which solution should be used to centrally enforce this requirement?

Accepted Answer

Use a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action at the organization root.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within the organization. By denying the s3:PutBucketPublicAccessBlock action at the organization root, you prevent any account from disabling or modifying the public access block settings on any S3 bucket, thereby enforcing the security team's requirement across all accounts. This approach works because SCPs are applied at the organization level and override any IAM or bucket-level permissions that would otherwise allow the action.

Answer

Enable AWS Trusted Advisor to automatically remediate public buckets.

Answer

Create an IAM role in each account that denies the s3:PutBucketPublicAccessBlock action.

Answer

Apply a bucket policy to each bucket that blocks public access.

Question 8

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The security team wants to allow only traffic from the ALB to reach the EC2 instances. Which security group configuration should be used?

Accepted Answer

Allow inbound traffic from the ALB's security group ID on the EC2 security group.. Security groups can reference other security groups by ID. By setting an inbound rule on the EC2 security group that references the ALB's security group ID, only traffic originating from the ALB is allowed. This is the recommended approach as ALB private IP addresses are dynamic and can change, making IP-based rules (Option A) unreliable.

Answer

Allow inbound traffic from the ALB's private IP addresses on the EC2 security group.

Answer

Allow inbound traffic from the VPC CIDR block on the EC2 security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 security group.

Question 9

A security engineer needs to ensure that an Amazon RDS database instance is not accessible from the internet. Which configuration step will achieve this?

Accepted Answer

Set the DB instance to be not publicly accessible and place it in a private subnet.. Setting a DB instance to be not publicly accessible ensures that it does not receive a public IP address, and placing it in a private subnet (one without a route to an internet gateway) prevents any direct inbound or outbound traffic from the internet. This combination guarantees that the RDS instance is isolated from the public internet, aligning with the security requirement.

Answer

Deploy the DB instance in a multi-AZ configuration.

Answer

Set the DB instance to be publicly accessible and restrict security group inbound rules.

Answer

Use the default VPC security group for the DB instance.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. A security requirement states that no security group should allow inbound SSH access from 0.0.0.0/0. What is the best way to enforce this policy?

Accepted Answer

Use AWS Config with a managed rule to detect and automatically remediate non-compliant security groups.. AWS Config with a managed rule (e.g., 'restricted-ssh') can continuously evaluate security group configurations against the policy and automatically remediate non-compliant rules using AWS Systems Manager Automation. This provides detective and corrective enforcement without blocking legitimate administrative actions, unlike IAM or SCP approaches that would prevent necessary changes or fail to detect existing non-compliant resources.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.

Answer

Add an AWS::IAM::Policy resource in the CloudFormation template to deny the rule.

Answer

Use a service control policy (SCP) that denies the CreateStack action if the template contains SSH from 0.0.0.0/0.

Question 11

A company has a VPC with public and private subnets. The private sub host Amazon RDS instances. To allow the RDS instances to access the internet for software updates without exposing them to inbound internet traffic, what should be configured?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway in the private subnet route table.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. Adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway enables this outbound-only internet access for the RDS instances.

Answer

Use a VPN connection to an on-premises network that has internet access.

Answer

Set up a VPC peering connection to a VPC with internet access.

Answer

Attach an internet gateway to the private subnet route table.

Question 12

A company wants to encrypt data at rest for an Amazon S3 bucket. Which action should be taken?

Accepted Answer

Enable default encryption on the S3 bucket.. Enabling default encryption on the S3 bucket ensures that all objects stored in the bucket are automatically encrypted at rest using server-side encryption (SSE-S3, SSE-KMS, or SSE-C). This meets the requirement for encrypting data at rest without requiring any client-side changes, as the encryption is applied by S3 upon write.

Answer

Use client-side encryption before uploading objects.

Answer

Enable SSL/TLS for the bucket.

Answer

Use AWS CloudHSM to encrypt the bucket.

Question 13

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, but the application and database tiers must not. Which VPC configuration should be used?

Accepted Answer

Place web tier in public subnets, app and database tiers in private subnets.. It places the web tier in public subnets with an internet gateway for direct internet access, while the application and database tiers reside in private subnets with no direct internet route. This ensures that only the web tier is exposed, and the app and database tiers can only be reached through the web tier via internal routing, aligning with the principle of least privilege for a three-tier architecture.

Answer

Place web and app tiers in public subnets, database in private subnet.

Answer

Place all tiers in private subnets and use a VPN for external access.

Answer

Place all tiers in public subnets with security groups restricting access.

Question 14

A company wants to protect its Amazon EC2 instances from distributed denial-of-service (DDoS) attacks at the network layer. Which AWS service should be used?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protections for Amazon EC2 instances against network-layer (Layer 3/4) DDoS attacks, such as SYN floods, UDP reflection attacks, and other volumetric attacks. It includes always-on traffic monitoring, automated mitigation, and access to the DDoS Response Team (DRT) for custom mitigations, making it the correct choice for network-layer DDoS protection.

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Answer

AWS WAF

Question 15

A company needs to enforce that all Amazon S3 buckets are encrypted at rest. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use bucket policies to deny write operations without encryption.. Option B is correct because a bucket policy with a Deny effect on s3:PutObject when the request lacks the s3:x-amz-server-side-encryption header (or uses an unapproved algorithm) actively blocks unencrypted uploads, enforcing encryption at rest at the object level. Option C is correct because enabling default encryption (SSE-S3 or SSE-KMS) on each bucket ensures any object PUT without explicit encryption headers is automatically encrypted at rest. Option A is incorrect because CloudTrail only records API activity for auditing; it does not enforce encryption. Option D is incorrect because creating a KMS key alone does not apply it to buckets or enforce encryption; the key must be referenced in bucket policies or default encryption settings. Option E is incorrect because denying s3:PutBucketPublicAccessBlock addresses public access blocking, not encryption at rest.

Answer

Enable AWS CloudTrail to log S3 API calls.

Answer

Create a KMS key and apply it to all buckets.

Answer

Use a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action.