SCS-C02 Infrastructure Security Practice Test 17 — 15 Questions

Question 1

A healthcare company runs a HIPAA-compliant application on AWS. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances behind an Auto Scaling group. The EC2 instances store sensitive patient data in an S3 bucket encrypted with SSE-KMS. The security team recently enabled AWS CloudTrail and Amazon GuardDuty. During a routine audit, they notice that an EC2 instance is making repeated API calls to the S3 bucket from an IP address outside the corporate network. The security team suspects the instance is compromised. What is the MOST effective immediate step to contain the potential breach while maintaining availability of the application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Revoke the IAM role attached to the instance by removing the S3 permissions from the role.. Revoking the IAM role's S3 permissions (Option A) immediately stops the compromised EC2 instance from accessing the S3 bucket, containing the data breach without terminating the instance or affecting application availability. Terminating or stopping the instance (Options C and D) would disrupt the application, while removing the security group (Option B) does not prevent API calls to S3 because API calls are made over the internet and not controlled by security groups.

Answer

Remove the security group that allows outbound traffic from the instance.

Answer

Stop the EC2 instance and detach it from the Auto Scaling group.

Answer

Terminate the EC2 instance immediately.

Question 2

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The company has a VPC with public and private subnets. The security team wants to ensure that all traffic between on-premises and the VPC goes through a set of security appliances (firewalls) deployed in the VPC. The appliances are in separate subnets. Currently, traffic is routed directly via the virtual private gateway. What is the MOST secure and scalable way to force traffic through the security appliances?

Accepted Answer

Deploy a Gateway Load Balancer and create Gateway Load Balancer endpoints in each subnet. Update the route tables to point to the endpoints.. Using a Gateway Load Balancer with Gateway Load Balancer endpoints in each subnet allows transparent traffic inspection and scaling. Option A is wrong because a NAT gateway only handles outbound traffic, not bidirectional inspection. Option B is wrong because a transit gateway does not force traffic through appliances; additional routing and appliance VPCs are needed. Option D is wrong because a VPN connection does not inherently route through VPC appliances; it would require custom routing.

Answer

Place the security appliances in a public subnet and route traffic through a NAT gateway.

Answer

Create a transit gateway and attach the Direct Connect virtual interface to it. Then route traffic through the appliance subnets.

Answer

Set up a VPN connection from on-premises to the VPC and route traffic through the appliance subnets.

Question 3

A startup is building a web application on AWS. They have an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. They want to protect the application from common web exploits like SQL injection and cross-site scripting. They also need to allow only traffic from certain geographic regions. Which AWS service should they use to achieve these requirements?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. It also allows you to create rules to block or allow traffic based on geographic regions (geo-match conditions). Option B is incorrect because AWS Shield Advanced provides enhanced DDoS protection, not application-layer filtering. Option C is incorrect because security groups act as a virtual firewall at the instance level but do not inspect application-layer traffic. Option D is incorrect because network ACLs provide stateless filtering at the subnet level and cannot perform deep packet inspection for web exploits.

Answer

AWS Shield Advanced

Answer

Security groups on the ALB

Answer

Network ACLs on the ALB subnets

Question 4

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for whitelisting by third-party services. Which TWO actions should the engineer take?

Accepted Answer

Deploy a NAT Gateway in a public subnet and assign an Elastic IP.. A NAT Gateway in a public subnet with an Elastic IP allows private instances to access the internet using a single IP. Route tables for private subnets must point default route (0.0.0.0/0) to the NAT Gateway.

Answer

Use a VPC Peering connection to a central VPC with an Internet Gateway.

Answer

Deploy a NAT Gateway in a private subnet.

Answer

Configure the private subnet route table with a default route to an Internet Gateway.

Question 5

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. The bucket policy must deny all requests that do not come from the VPC endpoint. Which TWO statements are true for this configuration?

Accepted Answer

Use the aws:SourceVpce condition key in the bucket policy.. The `aws:SourceVpce` condition key in an S3 bucket policy allows you to restrict access to requests that originate from a specific VPC endpoint. This ensures that only traffic coming through that endpoint is permitted, providing a network-level control that is independent of IP addresses. Option D is correct because to enforce this restriction, you must set the Effect to Deny and include a condition that matches the VPC endpoint ID, which will block all requests that do not come from that endpoint.

Answer

Use the aws:SourceIp condition key to restrict IP addresses.

Answer

Set the Principal to the VPC endpoint ID.

Answer

Ensure the bucket policy has an explicit Allow for the VPC endpoint.

Question 6

A company runs a multi-tier web application on AWS. The web tier uses an Application Load Balancer (ALB) in a public subnet, and the application tier runs on EC2 instances in private subnets. The security team recently ran a vulnerability scan and found that the application instances are accessible from the internet on port 8080. The EC2 instances have a security group that allows inbound traffic on port 8080 from the ALB's security group only. However, the ALB's security group allows inbound traffic on port 8080 from 0.0.0.0/0. The architecture also includes a NAT Gateway for outbound internet access from private subnets. The security engineer needs to ensure that only the ALB can communicate with the application instances on port 8080, and that the application instances cannot be directly accessed from the internet. What should the security engineer do?

Accepted Answer

Modify the ALB security group to remove the inbound rule for port 8080 from 0.0.0.0/0, and configure the ALB listener to forward traffic from port 80/443 to port 8080 on the target group.. The ALB's security group should not allow inbound from 0.0.0.0/0 on the application port. Instead, the ALB should listen on port 80/443 from the internet and forward to port 8080 on the instances. The ALB security group rule should be removed, and the listener should be configured on standard ports. The EC2 security group is already correct.

Answer

Change the EC2 instance security group to allow inbound traffic on port 8080 from 0.0.0.0/0, and rely on the subnet network ACL to block traffic.

Answer

Add a rule to the EC2 security group that denies inbound traffic from 0.0.0.0/0 on port 8080.

Answer

Place the EC2 instances in a public subnet and use a network ACL to block inbound traffic on port 8080 from the internet.

Question 7

A company uses AWS Organizations to manage multiple accounts. The security team must enforce that all Amazon S3 buckets across all accounts are encrypted with AWS KMS. The team has enabled S3 default encryption for new buckets, but existing buckets may not be encrypted. They need to automatically remediate any non-compliant buckets. The team has AWS Config and AWS Lambda available. What is the MOST operationally efficient solution?

Accepted Answer

Use AWS Config with the s3-bucket-server-side-encryption-enabled rule and configure an AWS Systems Manager Automation document to remediate non-compliant buckets.. Use AWS Config with the s3-bucket-server-side-encryption-enabled rule to detect non-compliant S3 buckets. Then configure an automatic remediation action using an AWS Systems Manager Automation document to enable encryption on those buckets. This approach is serverless, automated, and operationally efficient as it does not require manual intervention or separate compute resources.

Answer

Manually review all buckets using the S3 console and enable encryption for those that are not encrypted.

Answer

Write a script that runs daily on an EC2 instance to list all buckets and enable encryption on any that are not encrypted.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and send an SNS notification to the security team to manually remediate.

Question 8

A company is deploying a new web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted using TLS. The ALB uses a certificate from AWS Certificate Manager (ACM). The EC2 instances are Linux-based and have a self-signed certificate installed. The security engineer configured the ALB target group to use HTTPS on port 443, and the EC2 security group allows inbound traffic on port 443 from the ALB security group. However, when testing, the application returns a 502 Bad Gateway error. The ALB health checks are failing. What is the likely cause?

Accepted Answer

The ALB is configured to verify the certificate on the backend instances, and the self-signed certificate is not trusted.. The ALB can be configured to verify the backend certificate when establishing TLS connections. By default, this verification is disabled, but it can be enabled via a target group attribute. In this scenario, the security team requires encrypted traffic between ALB and EC2, and they configured the target group to use HTTPS. If the target group has certificate verification enabled (e.g., via a mutual authentication policy), the ALB will check that the backend certificate is trusted. The self-signed certificate on the EC2 instances is not trusted by the ALB, causing the TLS handshake to fail. This leads to the health checks failing and the ALB returning 502 Bad Gateway errors. The other options are less likely because the question states health checks are failing; if the web server were not running or the security group were misconfigured, the health check would also fail but the specific mention of a self-signed certificate points to certificate verification as the root cause.

Answer

The EC2 instances are not running a web server listening on port 443.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB on the health check port.

Answer

The target group health check is configured to use the same port as the traffic port (443), but the health check path is incorrect.

Question 9

Refer to the exhibit. A security engineer applies the IAM policy to a user, and then successfully runs the CLI command. Later, the user attempts to upload an object without specifying the ACL. What will happen?

Accepted Answer

The upload fails because the Deny statement explicitly denies any PutObject that does not have the ACL set to bucket-owner-full-control.. The IAM policy explicitly denies PutObject when the ACL is not set to bucket-owner-full-control. Since the user does not specify an ACL, the condition 'StringNotEquals' evaluates to true, triggering the Deny.

Answer

The upload succeeds because the bucket policy allows it.

Answer

The upload succeeds because the Allow statement allows PutObject without condition.

Answer

The upload fails because the bucket policy requires ACL to be bucket-owner-full-control.

Question 10

Refer to the exhibit. An application running on EC2 behind an ALB is unreachable from the internet. The ALB health checks are failing. What is the most likely cause?

Accepted Answer

The network ACL inbound rule only allows traffic from 10.0.0.0/16 on ports 80 and 443, but the ALB is in a different subnet (public subnet) with a different CIDR (e.g., 10.0.2.0/24). The ALB's traffic to the instance must come from its private IP, which is in the same VPC but may not be within 10.0.0.0/16 if the VPC CIDR is not /16.. The network ACL inbound rules only allow traffic from 10.0.0.0/16 on ports 80 and 443. The ALB's private IP addresses are in the public subnet, which has a different CIDR (e.g., 10.0.2.0/24). If the VPC CIDR is not 10.0.0.0/16 (e.g., /20), the ALB's IPs may not be allowed. This causes health checks to be blocked. Therefore, option D is correct.

Answer

The security group inbound rule allows HTTP from 0.0.0.0/0, but it should only allow traffic from the ALB's security group.

Answer

The network ACL outbound rules deny all traffic, so the instance cannot send responses back to the ALB.

Answer

The security group outbound rule allows all traffic, which is too permissive and causes the ALB to reject the instance as unhealthy.

Question 11

Refer to the exhibit. A security engineer is investigating a potential compromise. What is the most critical finding?

Accepted Answer

The root user does not have MFA enabled, as indicated by AccountMFAEnabled being 1 (true) but that means MFA is enabled? Actually, the summary shows AccountMFAEnabled: 1, which means MFA is enabled for the root account? Wait, the key is "AccountMFAEnabled" which indicates if the account (root) has MFA enabled. 1 means true. So MFA is enabled. But there are access keys present. The critical finding is that the root user has access keys.. The exhibit shows that the root user has two access keys (AccountAccessKeysPresent: 2) and has MFA enabled (AccountMFAEnabled: 1). While MFA is enabled, AWS best practice strictly prohibits creating access keys for the root account because they cannot be rotated or revoked via IAM policies. The presence of root access keys is a critical security risk as they provide unrestricted access to all AWS resources. Option A correctly identifies this as the most critical finding. Options B, C, and D are less critical because console login success alone does not indicate a weak password, and IP address anomalies can be addressed with proper monitoring.

Answer

The root user's console login succeeded, which indicates that the root account password is weak.

Answer

The root user logged in successfully from an unknown IP address.

Answer

The IP address 203.0.113.5 is not from the company's trusted IP range.

Question 12

Refer to the exhibit. A user assumes the role and tries to terminate an instance, but gets an error. The instance i-12345678 has a tag 'Environment' with value 'dev'. What is the most likely reason for the failure?

Accepted Answer

The role policy has an implicit deny because the 'ec2:TerminateInstances' action is not allowed on the specific resource ARN due to missing account ID or region mismatch, or the session credentials have expired.. The error most likely occurs because the assumed role credentials have expired, or because the policy's resource ARN for ec2:TerminateInstances does not include the correct account ID or region, resulting in an implicit deny. Option A correctly identifies these two possibilities. The instance tag is not the issue here, as the condition for the tag is likely satisfied.

Answer

The role policy has a condition that requires the instance to have the tag 'Environment' set to 'dev', but the condition is evaluated against the principal, not the resource.

Answer

The role policy includes 'ec2:Describe*' which grants permission to describe all resources, but that does not include terminate. The condition on TerminateInstances requires the tag, but the user may not have passed the tag condition correctly.

Answer

The policy uses 'ec2:TerminateInstances' with a resource ARN that includes the region and account, but the instance may be in a different region or account.

Question 13

Refer to the exhibit. A security engineer is unable to SSH into an EC2 instance in subnet-12345678. The instance's security group allows inbound SSH from 10.0.0.0/8, and the instance has a public IP. What is the most likely reason for the failure?

Accepted Answer

The security group inbound rule restricts SSH to the 10.0.0.0/8 range, blocking the engineer's IP.. The network ACL allows inbound SSH from 0.0.0.0/0, but the security group only allows SSH from 10.0.0.0/8. Since the engineer is connecting from an IP outside that range, the security group blocks the connection.

Answer

The security group egress rule is blocking return traffic.

Answer

The network ACL's default deny rule (32767) is blocking all inbound traffic.

Answer

The network ACL inbound rule for SSH is misconfigured, denying all traffic.

Question 14

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

Accepted Answer

Failure, because the Deny statement blocks HTTP requests.. The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Answer

Success, because the Allow statement is evaluated first.

Answer

Failure, because the user's IP is not in the allowed range.

Answer

Success, because the user's IP is within the allowed range.

Question 15

Refer to the exhibit. A security engineer is investigating a potential unauthorized VPC creation. What does the evidence suggest?

Accepted Answer

The user admin created two VPCs, but one was deleted shortly after creation.. The CloudTrail log shows two CreateVpc events by user admin. One VPC exists (vpc-12345678), but the other (vpc-87654321) does not exist, indicating that it was deleted after creation. This could indicate malicious activity where a VPC was created and then deleted to cover tracks.

Answer

The CloudTrail log is incomplete; both VPCs exist.

Answer

Both VPCs were created successfully and still exist.

Answer

The user admin only created one VPC; the second event is a duplicate.