SCS-C02 Infrastructure Security Practice Test 17 — 15 Questions

Question 1

An organization has a VPC with public and private subnets. A NAT Gateway is deployed in a public subnet to allow instances in private subnets to access the internet. The security team notices that instances in a private subnet can reach the internet, but cannot initiate connections to an on-premises network connected via AWS Direct Connect. The on-premises network advertises a specific route. What is the most likely cause?

Accepted Answer

The private subnet route table has a route for the on-premises CIDR pointing to the NAT Gateway.. Option A is correct because a more specific route to the on-premises network via the NAT Gateway may override the Direct Connect route in the route table. Option B is wrong because Security Groups do not affect outbound traffic initiated by instances. Option C is wrong because NACLs are stateless but would affect both directions. Option D is wrong because the internet gateway is not involved in Direct Connect traffic.

Answer

The security group assigned to the instances does not allow outbound traffic to the on-premises network.

Answer

The network ACL on the private subnet is blocking inbound traffic from the on-premises network.

Answer

The internet gateway is not attached to the VPC.

Question 2

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

Accepted Answer

Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.. Option D is correct because the ALB can terminate HTTPS and use HTTPS with the target group to encrypt traffic to instances. Option A is wrong because security groups do not encrypt traffic. Option B is wrong because SSL certificates are for the listener, not the target group. Option C is wrong because Network Load Balancer does not support HTTPS termination natively.

Answer

Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Configure security groups to allow only HTTPS traffic.

Question 3

A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?

Accepted Answer

Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.. Option B is correct because security groups can be referenced in inbound rules of other security groups, allowing the web tier SG to allow inbound from the ALB SG, the app tier SG to allow inbound from the web tier SG, and the database tier SG to allow inbound from the app tier SG. Option A is wrong because using CIDR blocks is less granular and does not scale. Option C is wrong because public subnets expose the application tier to the internet. Option D is wrong because NACLs are stateless and require more rules.

Answer

Use a single security group for all instances and use IAM policies to restrict access.

Answer

Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.

Answer

Place all instances in public subnets and restrict access using security groups.

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize costs and avoid NAT Gateway or NAT Instance charges. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and configure the instance to download patches from S3.. Option C is correct because a VPC Gateway Endpoint is used for S3 and DynamoDB, not for general internet access. For general internet access, a NAT device is required. However, if the patches are hosted on S3, a Gateway Endpoint is free. Option A is wrong because an internet gateway alone cannot be used from private subnets. Option B is wrong because an egress-only internet gateway is for IPv6. Option D is wrong because a proxy instance incurs costs.

Answer

Deploy a proxy instance in a public subnet and configure the private instance to use the proxy.

Answer

Use an egress-only internet gateway for the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table pointing to the internet gateway.

Question 5

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Accepted Answer

Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.. Options A and D are correct. Enabling encryption at rest protects data, and using a VPC security group restricts network access. Option B is wrong because disabling automated backups reduces durability but does not directly improve security. Option C is wrong because Multi-AZ is for high availability, not security. Option E is wrong because assigning a public IP address increases exposure.

Answer

Disable automated backups to reduce storage costs.

Answer

Enable Multi-AZ deployment for fault tolerance.

Answer

Assign a public IP address to the RDS instance for easier access from the internet.

Question 6

Which THREE are benefits of using AWS Systems Manager Session Manager to connect to EC2 instances? (Choose THREE.)

Accepted Answer

It allows closing inbound SSH and RDP ports on the instance.. Options A, C, and D are correct. Session Manager eliminates the need for a bastion host, does not require opening SSH or RDP ports, and logs sessions to CloudTrail for auditing. Option B is wrong because Session Manager does not require an internet gateway or NAT gateway for connectivity; it uses the SSM agent. Option E is wrong because it does not automatically rotate SSH keys; it uses IAM for access control.

Answer

It automatically rotates SSH keys on the instance.

Answer

It requires an internet gateway or NAT gateway for the instance to communicate with the Session Manager service.

Question 7

Which TWO are valid methods to secure data at rest in Amazon S3? (Choose TWO.)

Accepted Answer

Enabling default encryption on the S3 bucket.. Options B and D are correct. Server-side encryption (SSE-S3, SSE-KMS, SSE-C) and S3 Block Public Access are both methods to secure data at rest. Option A is wrong because bucket policies control access but do not encrypt data. Option C is wrong because versioning helps with data recovery, not encryption. Option E is wrong because MFA Delete adds protection for deletion, not encryption.

Answer

Enabling MFA Delete.

Answer

Enabling S3 Versioning.

Answer

Configuring an S3 bucket policy to restrict access to specific IP addresses.

Question 8

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC Endpoint are allowed. Which policy element should be used in the bucket policy?

Accepted Answer

aws:SourceVpce. Option B is correct because 'aws:SourceVpce' is the condition key that specifies the VPC Endpoint ID to restrict access to a specific VPC endpoint. Option A is wrong because 'aws:SourceVpc' specifies a VPC ID, not an endpoint ID. Option C is wrong because 'aws:VpcSourceIp' is not a valid condition key. Option D is wrong because 'aws:SourceIp' is for IP-based restrictions, not VPC endpoints.

Answer

aws:SourceVpc

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 9

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Which combination of security groups should be used?

Accepted Answer

Web: 0.0.0.0/0 on ports 80/443; App: Web SG on port 8080; DB: App SG on port 3306. Option D is correct because it uses security groups as source references for the application and database tiers, ensuring traffic only from the required tiers. Option A is wrong because it allows all traffic to the web tier via 0.0.0.0/0 but doesn't restrict the app tier properly. Option B is wrong because it allows SSH from anywhere. Option C is wrong because it allows all traffic between tiers.

Answer

Web: 0.0.0.0/0 on ports 80/443 and SSH; App: Web SG on port 8080; DB: App SG on port 3306

Answer

Web: 0.0.0.0/0 on all ports; App: Web SG on all ports; DB: App SG on all ports

Answer

Web: 0.0.0.0/0 on ports 80/443; App: Web SG on ports 8080; DB: App SG on port 3306

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. Which AWS service should be used to allow this without assigning a public IP address to the instance?

Accepted Answer

NAT Gateway. Option C is correct because a NAT Gateway allows instances in a private subnet to connect to the internet while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway alone does not allow outbound-only for private instances. Option B is wrong because a VPN connection is for hybrid connectivity, not internet access. Option D is wrong because a VPC Endpoint is for private access to AWS services.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

VPN Connection

Question 11

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Which step should be taken to secure the bucket while maintaining access for authorized users?

Accepted Answer

Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.. Option B is correct because removing the public access and using a VPC Endpoint with a bucket policy that restricts access to the endpoint ensures only authorized users within the VPC can access the bucket. Option A is wrong because an IAM role alone does not prevent public access. Option C is wrong because the bucket policy already allows public access. Option D is wrong because blocking all public access prevents even authorized users if they are not in the VPC.

Answer

Use AWS Config to automatically block all public access.

Answer

Create an IAM role with S3 access and assign it to the bucket.

Answer

Add a Deny statement for any IP address outside the corporate network.

Question 12

A company is designing a hybrid cloud architecture with an AWS Direct Connect connection. The company wants to ensure that traffic to and from the VPC goes through the Direct Connect connection and not over the internet. Which configuration should be used?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update the route tables to point to the Direct Connect virtual interface.. Option A is correct because using a Virtual Private Gateway and updating route tables to point to the Direct Connect virtual interface ensures traffic is routed through Direct Connect. Option B is wrong because a VPN connection still uses the internet. Option C is wrong because a VPC Endpoint is for AWS service access. Option D is wrong because Direct Connect alone does not enforce routing.

Answer

Create a VPC Endpoint for each AWS service.

Answer

Set up a VPN connection over the internet as a backup.

Answer

Configure the Direct Connect connection and assign public IPs to instances.

Question 13

A company wants to block traffic from a specific IP address range from accessing an Application Load Balancer (ALB). Which AWS feature should be used?

Accepted Answer

AWS WAF. Option B is correct because AWS WAF can be associated with an ALB to filter traffic based on IP addresses. Option A is wrong because security groups cannot be associated with ALBs in the same way as EC2. Option C is wrong because Network ACLs operate at the subnet level, not directly on the ALB. Option D is wrong because Route53 does not filter traffic.

Answer

Network ACL

Answer

Security Group for the ALB

Answer

Route53

Question 14

A company is running a critical application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB reaches the EC2 instances. How can this be achieved?

Accepted Answer

Reference the ALB's security group in the EC2 security group inbound rule.. Option D is correct because referencing the ALB's security group in the EC2 security group ensures only traffic from the ALB is allowed. Option A is wrong because the ALB's private IP can change. Option B is wrong because public IPs are not used. Option C is wrong because a Network ACL would affect all instances in the subnet.

Answer

Use the ALB's private IP address in the EC2 security group.

Answer

Configure a Network ACL to allow only the ALB's subnet.

Answer

Use the ALB's public IP address in the EC2 security group.

Question 15

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and update the route table.. Option B is correct because a Gateway VPC Endpoint for S3 allows private access to S3 without going through the internet or NAT Gateway, and it is more secure. Option A is wrong because it goes through the internet. Option C is wrong because Interface Endpoints are more costly and complex for S3. Option D is wrong because internet access still goes through the internet.

Answer

Create an Interface VPC Endpoint for S3.

Answer

Route the traffic through a NAT Gateway to the internet.

Answer

Assign a public IP address to the EC2 instance and allow it to access S3 via internet.