SCS-C02 Infrastructure Security Practice Test 17 — 15 Questions

Question 1

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Accepted Answer

Security groups. Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Answer

VPN connection

Answer

Internet gateway

Question 2

A Security Engineer is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier, and the database tier only from the application tier. All tiers are in the same VPC. Which configuration meets these requirements with minimal administrative overhead?

Accepted Answer

Use security groups with inbound rules that reference the security group of the previous tier.. Security groups are stateful and can reference other security groups as a source in inbound rules, allowing traffic from any instance associated with the referenced security group regardless of IP address changes. This creates a logical dependency chain (web SG → app SG → db SG) that enforces the required tier-to-tier access with zero maintenance when instances scale or subnets change. Option D meets the requirement with minimal administrative overhead because security group references automatically adapt to dynamic environments.

Answer

Use network ACLs with inbound rules that reference the prefix list of the previous tier's subnets.

Answer

Use network ACLs with inbound rules that allow traffic from the previous tier's subnet CIDR.

Answer

Use security groups with inbound rules that allow traffic from the previous tier's public IP addresses.

Question 3

A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS Key Management Service (AWS KMS) is the correct service because it is a fully managed, centralized service that allows you to create, manage, and control the encryption keys used to encrypt data at rest in Amazon S3. S3 integrates directly with KMS via Server-Side Encryption with AWS KMS (SSE-KMS), enabling you to use customer managed keys (CMKs) or AWS managed keys to enforce granular access control and audit key usage through AWS CloudTrail.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 4

An application running on EC2 instances needs to access an S3 bucket. The Security Engineer wants to ensure that the EC2 instances do not have access keys and that the access is restricted to only the required bucket. What is the most secure way to provide this access?

Accepted Answer

Create an IAM role with a policy that allows access to the specific S3 bucket, and attach the role to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary security credentials from AWS STS (Security Token Service) without storing any long-term access keys. The role's policy can be scoped to grant access only to the specific S3 bucket, ensuring least privilege. This approach eliminates the risk of key exposure and is the AWS-recommended best practice for granting EC2 instances access to AWS services.

Answer

Generate an access key for an IAM user with permissions to the S3 bucket and store it in the EC2 instance.

Answer

Create an S3 bucket policy that allows the EC2 instance's public IP address to access the bucket.

Answer

Use the root user's access keys to configure the application.

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The Security Engineer needs to ensure that traffic between VPCs is inspected by a central network appliance. Which architecture should the Engineer implement?

Accepted Answer

Use Transit Gateway with appliance mode enabled on the attachments to the inspection VPC, and route inter-VPC traffic through the inspection VPC.. Enabling appliance mode on the Transit Gateway attachments to the inspection VPC forces the Transit Gateway to preserve the source and destination MAC addresses of packets, ensuring that asymmetric routing does not cause the network appliance to drop traffic. By routing inter-VPC traffic through the inspection VPC, the appliance can inspect all packets, and appliance mode ensures that return traffic is sent back through the same appliance, maintaining stateful inspection.

Answer

Use VPC Peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Place the network appliance in a public subnet of the inspection VPC and use internet gateways for routing.

Answer

Use Transit Gateway with route tables that point to the network appliance's ENI for all inter-VPC traffic.

Question 6

A Security Engineer needs to block SSH traffic (port 22) from the internet to all EC2 instances in a VPC. Which approach is the most secure and scalable?

Accepted Answer

Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.. Network ACLs (NACLs) are stateless and operate at the subnet level, allowing you to explicitly deny inbound SSH traffic from 0.0.0.0/0. This approach is more secure and scalable than security group rules because NACLs can block traffic before it reaches the instance, and they support explicit deny rules, which security groups do not. Security groups only support allow rules, so you cannot add a deny rule to block SSH traffic; you must omit the allow rule, which is less explicit and can be accidentally overridden.

Answer

Add a security group rule to deny inbound traffic on port 22 from 0.0.0.0/0.

Answer

Add a network ACL rule to allow inbound traffic on port 22 from 0.0.0.0/0 and then add a deny rule for the same traffic.

Answer

Add a security group rule to block inbound traffic on port 22 from 0.0.0.0/0 at the VPC level.

Question 7

A company is using AWS WAF to protect a web application behind an Application Load Balancer. The Security Engineer wants to block requests that contain SQL injection attacks. Which action should the Engineer take?

Accepted Answer

Create a WAF rule with a SQL injection match condition and set the action to block.. AWS WAF is the native service for filtering web traffic to Application Load Balancers, and it includes a managed rule set specifically for SQL injection (SQLi) detection. By creating a custom WAF rule with a SQL injection match condition and setting the action to 'Block', the Engineer directly instructs WAF to inspect incoming requests for SQLi patterns and drop matching traffic before it reaches the ALB. This is the correct, service-native approach for blocking SQL injection attacks at the application layer.

Answer

Enable AWS Shield Advanced to automatically block SQL injection attacks.

Answer

Use Amazon GuardDuty to detect and block SQL injection attempts.

Answer

Configure the security group of the EC2 instances to block traffic containing SQL injection patterns.

Question 8

A company wants to enforce encryption in transit for all traffic between its VPC and on-premises data center over AWS Direct Connect. Which TWO configurations can achieve this?

Accepted Answer

Use a public virtual interface with Direct Connect and configure an IPsec VPN over it.. A public virtual interface over Direct Connect provides connectivity to public AWS endpoints, and by layering an IPsec VPN on top, you encrypt all traffic between your VPC and on-premises data center. This ensures encryption in transit while leveraging the low latency and reliability of Direct Connect. Option C is correct because a Direct Connect Gateway allows you to connect multiple VPCs to a Direct Connect private virtual interface, and configuring an IPsec VPN over that private virtual interface encrypts traffic end-to-end, meeting the encryption requirement.

Answer

Use a Site-to-Site VPN connection over the internet.

Answer

Use a Transit VPC architecture with VPN attachments.

Answer

Use a private virtual interface with Direct Connect.

Question 9

A Security Engineer is designing a secure VPC architecture. Which THREE components are essential for creating a public subnet that can host a web server accessible from the internet?

Accepted Answer

Route table with a default route (0.0.0.0/0) pointing to the IGW. A public subnet requires a route table that directs traffic destined for 0.0.0.0/0 to an Internet Gateway (IGW). Without this default route, instances in the subnet cannot send or receive traffic from the internet, even if they have public IP addresses. The IGW acts as the target for this route, enabling bidirectional communication between the VPC and the internet.

Answer

VPN connection to on-premises

Answer

NAT Gateway

Question 10

A company is using Amazon EC2 instances in a VPC with a security group that allows inbound SSH from 0.0.0.0/0. A security engineer needs to restrict SSH access to only the company's public IP range (203.0.113.0/24) while maintaining all other existing rules. What is the MOST efficient way to accomplish this?

Accepted Answer

Modify the existing security group rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Modifying the existing security group rule's source from 0.0.0.0/0 to 203.0.113.0/24 directly restricts inbound SSH to the company's public IP range without affecting any other rules. Security groups are stateful and rule changes apply immediately, making this the most efficient approach as it requires only a single edit to the existing rule.

Answer

Disable SSH and use AWS Systems Manager Session Manager to connect to instances.

Answer

Create a network ACL with an inbound rule allowing SSH from 203.0.113.0/24 and deny all other traffic.

Answer

Create a new security group rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

Question 11

A company wants to ensure that all traffic to and from an Amazon RDS instance is encrypted in transit. Which solution should the security engineer implement?

Accepted Answer

Configure the database to require SSL/TLS connections and modify clients to connect using SSL.. Encrypting data in transit for Amazon RDS requires enabling SSL/TLS on the database instance and configuring client connections to use SSL/TLS. This ensures that all traffic between the client and the RDS instance is encrypted using TLS protocols, protecting against eavesdropping and man-in-the-middle attacks. Amazon RDS supports SSL/TLS for all database engines, and you can enforce SSL connections by setting the 'require_secure_transport' parameter (MySQL) or similar parameters for other engines.

Answer

Enable encryption at rest using AWS KMS.

Answer

Use an S3 bucket policy to enforce encryption in transit for all S3 traffic.

Answer

Use an AWS Transit Gateway to route traffic through a central VPC.

Question 12

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

Accepted Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.. It uses security group IDs as the source for inbound rules, which allows traffic only from instances associated with the specified security group, regardless of their IP addresses. This provides a dynamic and secure way to control traffic between tiers, as security group IDs are resolved at the instance level and automatically adapt to changes in instance membership. By contrast, using CIDR blocks (as in options A and C) is less secure because it relies on static IP ranges that may not accurately reflect the actual instances in the web or app tiers, and option B is overly permissive by allowing all traffic from the web SG.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.

Answer

Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.

Question 13

A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.. It uses VPC endpoints for Amazon S3 (and optionally DynamoDB) to provide private connectivity to AWS services without requiring an internet gateway. By storing the security patches in an S3 bucket with a custom domain alias (e.g., patches.example.com), the application can download patches through the VPC endpoint, meeting the requirement of no internet route and minimizing operational overhead. Options A and D require an internet gateway, which creates a route to the internet. Option C does not provide access to an external domain like patches.example.com.

Answer

Launch a proxy server in a public subnet and configure the application to use the proxy.

Answer

Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.

Answer

Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no resources can be created in a specific AWS Region except for the us-east-1 Region. Which policy type should the security team use?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are the correct choice because they allow you to centrally control the maximum available permissions for all accounts in an AWS Organization. By applying an SCP that denies all actions in a specific region (except us-east-1), the security team can enforce a region restriction across all member accounts, regardless of any IAM policies attached to users or roles. SCPs do not grant permissions themselves but act as a guardrail that limits what IAM policies can allow.

Answer

IAM permissions boundary

Answer

IAM policy applied to the root user

Answer

Resource-based policy

Question 15

A company is designing a shared services VPC architecture with multiple VPCs connected via a transit gateway. The security engineer needs to ensure that all traffic between VPCs is inspected by a centralized firewall appliance deployed in the shared services VPC. What configuration is required?

Accepted Answer

Configure transit gateway route tables to route all inter-VPC traffic through the firewall appliance.. A transit gateway can use separate route tables to control traffic flow. By configuring the transit gateway route tables to point the default route (0.0.0.0/0) or specific inter-VPC CIDR ranges to a network interface of the centralized firewall appliance in the shared services VPC, all traffic between VPCs is forced through the firewall for inspection. This design ensures that the firewall acts as a central inspection point without requiring VPC peering or complex routing.

Answer

Create VPC peering connections between each VPC and the shared services VPC.

Answer

Use security groups to route traffic through the firewall.

Answer

Deploy a Gateway Load Balancer (GWLB) in the shared services VPC and register the firewall as a target.