SCS-C02 Infrastructure Security Practice Test 16 — 15 Questions

Question 1

A company has a VPC with multiple subnets and uses VPC Flow Logs to capture network traffic. The security team notices that some expected traffic is not appearing in the logs. What is a likely cause?

Accepted Answer

The traffic is to or from the Amazon DNS server (169.254.169.253).. VPC Flow Logs do not capture traffic to or from the Amazon DNS server (169.254.169.253) by default. This is because the DNS server is a well-known AWS internal service and capturing that traffic is unnecessary. Therefore, if expected traffic involves the DNS server, it will not appear in the logs. Option A is incorrect because Flow Logs can be published to either CloudWatch Logs or S3, but the destination does not cause missing logs. Option B is incorrect because Flow Logs capture UDP traffic as well as TCP. Option C is incorrect because Flow Logs capture all accepted traffic regardless of security group rules; they log both accepted and rejected traffic (though rejected traffic is logged only if the log format includes the 'action' field and the rule allows logging).

Answer

Flow Logs are published to an S3 bucket instead of CloudWatch Logs.

Answer

The traffic uses UDP protocol.

Answer

The traffic is blocked by a security group rule.

Question 2

A company wants to provide its developers with IAM roles that allow them to launch EC2 instances with specific security groups. The security team wants to ensure that developers cannot launch instances without a security group. How can this be enforced?

Accepted Answer

Add a condition in the IAM policy that requires the ec2:SecurityGroup parameter to have a specific value.. You can use a condition in the IAM policy to require the security group. Option A is wrong because default security group is always attached if none specified, so that doesn't enforce. Option B is wrong because that is the default behavior, but developers can still launch without specifying a security group. Option D is wrong because that would allow any security group.

Answer

Create a service control policy that allows only the use of specific security groups.

Answer

Use an SCP to deny launching instances without a security group.

Answer

Configure the VPC to have no default security group.

Question 3

A company has an Amazon RDS for MySQL database in a private subnet. The security team wants to ensure that only an application server in the same VPC can connect to the database. Which security group configuration should be used?

Accepted Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the security group ID of the application server.. Referencing the application server's security group ID as the source in the inbound rule for MySQL (port 3306) on the RDS security group allows traffic only from instances that are members of that security group, regardless of their IP addresses. This is the most secure and precise method, as it automatically adapts to changes in the application server's IP (e.g., after scaling or replacement) and avoids opening the database to the entire subnet or VPC CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the VPC's CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the subnet CIDR of the application server.

Answer

Inbound rule on the application server's security group: allow outbound MySQL to the RDS security group.

Question 4

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The security team wants to receive real-time notifications when a DDoS attack is detected. Which configuration should be used?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an Amazon SNS notification when a Shield Advanced event occurs.. AWS Shield Advanced automatically pushes DDoS events to Amazon CloudWatch Events. You can configure a CloudWatch Events rule to match Shield events and trigger an AWS Lambda function that sends notifications via Amazon SNS. Option B is incorrect because VPC Flow Logs record IP traffic metadata, not DDoS events, and a high traffic alarm is not a reliable indicator of a Shield-detected attack. Option C is incorrect because Shield Advanced does not natively support direct SNS subscriptions for notifications; it integrates via CloudWatch Events. Option D is incorrect because AWS CloudTrail records API calls, not DDoS events, and metric filters on CloudTrail logs would not capture Shield-specific attack detections.

Answer

Enable VPC Flow Logs and create a CloudWatch alarm for high traffic volume.

Answer

Subscribe an SNS topic to Shield Advanced notifications directly.

Answer

Enable AWS CloudTrail and create a metric filter for DDoS events.

Question 5

A company has an S3 bucket that stores sensitive data. The security team wants to ensure that all objects in the bucket are encrypted at rest. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Use an SCP to deny the s3:PutObject action unless the request includes the x-amz-server-side-encryption header.. The correct combination is option A and D. Option A uses an SCP to deny s3:PutObject unless the request includes the x-amz-server-side-encryption header, which enforces encryption at upload time across the account. Option D enables default encryption on the S3 bucket using SSE-S3 or SSE-KMS, ensuring that any object uploaded without explicit encryption headers is automatically encrypted. Together, these actions guarantee that all objects in the bucket are encrypted at rest. Option B is incorrect because creating a KMS key and assigning it to the bucket does not automatically encrypt objects; additional configuration like default encryption is needed. Option C is incorrect because CloudTrail only logs API calls and does not enforce encryption. Option E is incorrect because while a bucket policy can deny unencrypted PutObject, it is not as effective as an SCP for organization-wide enforcement, and the combination of SCP and default encryption provides a more robust solution.

Answer

Use AWS KMS to create a customer master key and assign it to the bucket.

Answer

Enable AWS CloudTrail to log S3 API calls.

Answer

Add a bucket policy that denies s3:PutObject if the object is not encrypted.

Question 6

A company uses Amazon CloudFront to distribute content from an S3 bucket. The security team wants to ensure that only CloudFront can access the S3 bucket. Which configuration should be used?

Accepted Answer

Create an Origin Access Identity (OAI) and grant it read access to the S3 bucket.. An Origin Access Identity (OAI) is a special CloudFront user that you can associate with a distribution, and then the S3 bucket policy can grant read access to that OAI, ensuring that only CloudFront can access the bucket. Option A is incorrect because allowing all principals is too permissive. Option B is incorrect because CloudFront IP addresses can change, so this is not a reliable method. Option D is incorrect because trusted signers are used for signed URLs/cookies to control who can access content, not to restrict origin access.

Answer

Set the bucket policy to allow all principals and rely on CloudFront to restrict access.

Answer

Configure the bucket policy to allow access only from CloudFront's IP addresses.

Answer

Use CloudFront trusted signers to restrict access to the S3 bucket.

Question 7

A company has an EC2 instance that needs to access an S3 bucket. The security team wants to use the principle of least privilege. Which method should be used to grant access?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. It follows the principle of least privilege by using an IAM role with a scoped S3 access policy, which is then attached to the EC2 instance profile. This allows the EC2 instance to obtain temporary security credentials from the AWS STS service, avoiding long-term access keys and ensuring permissions are granted only as needed.

Answer

Use a security group to allow outbound traffic to S3.

Answer

Store AWS access keys on the instance and use them in the application.

Answer

Create a bucket policy that grants access to the EC2 instance ID.

Question 8

A company uses AWS WAF to protect its web application from common web exploits. The security team wants to block requests that contain SQL injection or cross-site scripting (XSS) in the query string. Which rule type should be used?

Accepted Answer

Managed rule group for SQL injection and XSS. AWS WAF managed rule groups, such as the AWS-AWSManagedRulesSQLiRuleSet and AWS-AWSManagedRulesXSSRuleSet, are pre-configured to inspect query strings for SQL injection and cross-site scripting (XSS) patterns. Using a managed rule group is the most efficient and accurate approach because it leverages AWS's continuously updated threat signatures, reducing false positives and administrative overhead compared to custom rules.

Answer

Custom regex pattern set

Answer

Rate-based rule

Answer

Geographic match rule

Question 9

A company wants to restrict access to an S3 bucket so that only objects uploaded with server-side encryption using AWS KMS are allowed. The bucket policy uses the 's3:x-amz-server-side-encryption' condition key. However, users can still upload unencrypted objects. What is the most likely reason?

Accepted Answer

The bucket policy uses an Allow effect instead of Deny for the condition.. The bucket policy must use a Deny effect with the condition key 's3:x-amz-server-side-encryption' to block unencrypted uploads. An Allow effect only permits encrypted uploads but does not prevent unencrypted ones, because the default behavior is to allow if no explicit Deny applies. Therefore, the correct answer is B: the bucket policy uses an Allow effect instead of Deny for the condition.

Answer

The user's IAM policy overrides the bucket policy.

Answer

The condition key is misspelled.

Answer

The bucket policy does not explicitly deny s3:PutObject.

Question 10

A security engineer needs to ensure that all traffic to an EC2 instance in a VPC is inspected by a network firewall appliance. The firewall is deployed in a separate subnet. What is the MOST secure and scalable way to route traffic through the firewall?

Accepted Answer

Use a Gateway Load Balancer with a Gateway Load Balancer endpoint in each subnet.. A Gateway Load Balancer (GWLB) with a Gateway Load Balancer endpoint in each subnet provides transparent, scalable, and highly available traffic inspection. GWLB operates at Layer 3 (IP packets) and uses GENEVE encapsulation to forward traffic to the firewall appliance without modifying the source/destination IP addresses, ensuring all traffic to the EC2 instance is inspected. This architecture scales horizontally by adding more firewall instances behind the GWLB and avoids single points of failure.

Answer

Configure a NAT gateway in the firewall subnet and route all traffic through it.

Answer

Use an Application Load Balancer in front of the firewall.

Answer

Create a transit gateway and route traffic through the firewall subnet.

Question 11

A company uses AWS Shield Advanced to protect its web application against DDoS attacks. The application is behind an Application Load Balancer (ALB) with a web application firewall (AWS WAF) in front. The security team notices that some requests are being blocked by AWS WAF, but the source IP addresses are legitimate customers. What step should the team take to minimize false positives?

Accepted Answer

Implement rate-based rules with a count action and use the count data to create custom rules.. Implementing rate-based rules with a count action allows you to collect data on blocked requests without actually blocking them. You can then use this data to create custom rules that differentiate between legitimate traffic and attacks, reducing false positives. Option B is incorrect because AWS Managed Rules for IP reputation lists are designed to block known malicious IPs, which could include legitimate customers' IPs if they are misclassified, potentially increasing false positives. Option C is incorrect because increasing the WAF rate-based rule threshold would allow more requests before blocking, which might reduce false positives temporarily but could also allow more attack traffic. Option D is incorrect because reconfiguring the ALB idle timeout does not affect WAF blocking decisions; idle timeout controls how long the ALB waits before closing idle connections.

Answer

Switch to using AWS Managed Rules for IP reputation lists.

Answer

Increase the WAF rate-based rule threshold to allow more requests.

Answer

Reconfigure the ALB idle timeout to a higher value.

Question 12

A company wants to securely store secrets used by an application running on EC2 instances. The secrets include database credentials and API keys. What is the MOST secure and manageable approach?

Accepted Answer

Use AWS Secrets Manager and attach an IAM role to the EC2 instance with permission to access the secrets.. The most secure and manageable approach is using AWS Secrets Manager with an IAM role attached to the EC2 instance. This allows fine-grained access control, automatic secret rotation, and integration with AWS services. Option A is insecure because user data and instance metadata are accessible to any process running on the instance. Option B is insecure because embedding secrets in code, even encrypted, still exposes them at runtime. Option D (Parameter Store SecureString) is secure but lacks automatic rotation and advanced auditing features provided by Secrets Manager, making it less manageable for secrets like database credentials and API keys.

Answer

Store the secrets in the EC2 instance user data and retrieve them from the metadata service.

Answer

Embed the secrets in the application code and encrypt the code with a KMS key.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter and reference it in the application code.

Question 13

A security engineer is configuring a VPC with public and private subnets. The engineer needs to allow instances in the private subnet to download software updates from the internet. Which component should be added to the VPC?

Accepted Answer

NAT gateway in a public subnet.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet for downloading updates. Option A is incorrect because a VPN connection is used for secure connectivity to on-premises networks, not for general internet access. Option B is incorrect because a VPC endpoint provides private connectivity to AWS services like S3, not to the internet. Option C is incorrect because a bastion host is used for administrative access (SSH/RDP) to instances, not for providing internet access.

Answer

VPN connection to on-premises.

Answer

VPC endpoint for Amazon S3.

Answer

Bastion host in a public subnet.

Question 14

A company runs a containerized application on Amazon ECS with Fargate. The security team wants to ensure that the containers can only communicate with specific external APIs and not with other containers in the same task. Which security control should be applied?

Accepted Answer

Attach a security group to the ECS task with outbound rules allowing only the specific API endpoints.. Security groups attached to ECS tasks in awsvpc mode can control inbound and outbound traffic at the task level, allowing restriction of communication to specific external API endpoints. Option A is incorrect because network ACLs operate at the subnet level and are stateless, not suitable for per-task granularity. Option B is incorrect because IAM policies control API authorization, not network traffic. Option D is incorrect because VPC endpoints are used for private connectivity to AWS services, not for restricting container outbound traffic to external APIs.

Answer

Configure network ACLs on the subnets where the tasks run.

Answer

Apply an IAM policy to the task execution role to restrict API calls.

Answer

Use VPC endpoints to restrict traffic to specific APIs.

Question 15

A company wants to automate security assessments of its AWS environment. Which TWO AWS services can be used to perform vulnerability scanning and compliance checks?

Accepted Answer

Amazon Inspector. (Amazon Inspector) is correct for vulnerability scanning. Option C (AWS Security Hub) is correct for compliance checks. Option A (AWS Shield) is for DDoS protection. Option D (AWS WAF) is for web application firewall. Option E (AWS Config) tracks resource changes but does not perform vulnerability scanning or compliance checks.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config