SCS-C02 Infrastructure Security Practice Test 18 — 15 Questions

Question 1

A company wants to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile applications. Which AWS service should the company use?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service because it enables the generation of temporary, limited-privilege credentials (access key, secret key, and session token) that can be used to access AWS resources. These credentials are ideal for mobile applications where long-term keys are a security risk, as they can be scoped with an IAM role and have a configurable expiration (default 1 hour, max 36 hours). STS supports the AWS Signature Version 4 signing process and can be called via the AssumeRole or GetFederationToken APIs to provide federated access.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Identity and Access Management (IAM) users

Answer

Amazon Cognito user pools

Question 2

A security engineer needs to ensure that all Amazon S3 buckets in an AWS account have server-side encryption (SSE) enabled. The engineer wants to automatically remediate any bucket that is created without SSE. Which solution should the engineer implement?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action.. AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates every S3 bucket in the account and flags any that lack default encryption. Pairing it with an automatic remediation action (typically an SSM Automation document such as AWS-EnableS3BucketEncryption) means newly created non-compliant buckets are remediated without human intervention, satisfying the 'automatically remediate' requirement. This is the canonical AWS-native pattern for continuous compliance enforcement on S3.

Answer

Use S3 bucket policies to deny access to objects without encryption.

Answer

Apply an IAM policy that requires SSE for all S3 actions.

Answer

Create a service control policy (SCP) that denies creation of buckets without encryption.

Question 3

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Accepted Answer

Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.. Option B is correct because the private subnets' route table must have a default route (0.0.0.0/0) whose target is the central NAT device (e.g., a NAT instance or NAT Gateway), which forces all outbound traffic to be sent to that device for logging and filtering instead of going directly to an internet gateway. Option E is correct because the NAT device itself must reside in a public subnet and have a route to an internet gateway so it can forward the private subnets' traffic to the internet while performing the required logging and filtering. Option A is not required because an HTTP forward proxy is an application-layer solution and is not the mechanism that routes VPC subnet traffic to a NAT device; the question asks for the routing/placement steps. Option C is unnecessary because a transit gateway is used to interconnect VPCs or on-premises networks, not to route a single VPC's outbound traffic through a NAT device. Option D is incorrect because a gateway endpoint for Amazon S3 only provides private access to S3 and does not handle general outbound internet traffic through a NAT device.

Answer

Deploy an HTTP forward proxy in the public subnet.

Answer

Set up a transit gateway and attach the VPC to it.

Answer

Create a gateway endpoint for Amazon S3.

Question 4

A company wants to use AWS CloudTrail to log all API calls in an AWS account. The security engineer needs to ensure that the logs are encrypted at rest and are accessible only to authorized personnel. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Enable server-side encryption on the S3 bucket that stores CloudTrail logs.. Option B is correct because enabling server-side encryption (SSE-S3, SSE-KMS, or SSE-C) on the S3 bucket that stores CloudTrail logs ensures the log objects are encrypted at rest, satisfying the encryption requirement. Option D is correct because an IAM policy scoped to specific users or roles enforces least-privilege access, ensuring only authorized personnel can read the CloudTrail log objects. Option E is correct because a bucket policy condition requiring aws:SecureTransport=true denies any non-TLS (HTTP) requests, protecting logs in transit and preventing unencrypted access. Option A does not belong because MFA delete protects against accidental or malicious deletion of objects but does not provide encryption at rest or restrict read access to authorized personnel. Option C does not belong because an SCP attached to the root account only sets permission guardrails for accounts in an organization and does not encrypt CloudTrail logs or grant/restrict access to the specific S3 bucket.

Answer

Enable MFA delete on the S3 bucket.

Answer

Attach a service control policy (SCP) to the root account.

Question 5

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

Accepted Answer

The network ACL denies inbound SSH from all IPs except the specific IP. Security groups in AWS are stateful and allow-only — they cannot deny traffic. If a security group permits SSH from 0.0.0.0/0 but access is restricted to one IP, the restriction must come from a stateless network ACL, which supports both allow and deny rules and is evaluated before the security group. A network ACL that denies SSH from all sources except the specific IP would produce exactly this observed behavior. This is the only option that explains a restriction despite a permissive security group.

Answer

The network ACL allows inbound SSH from 0.0.0.0/0

Answer

The security group rule is being overridden by a more restrictive security group attached to the same instance

Answer

The security group rule is being evaluated but the instance's operating system firewall is blocking SSH

Question 6

A company wants to host a static website in an Amazon S3 bucket. The bucket must be private and accessible only through an Amazon CloudFront distribution. Which configuration ensures that CloudFront can access the S3 bucket while blocking direct access via S3 URL?

Accepted Answer

Create an Origin Access Control (OAC) and update the bucket policy to allow access only to the CloudFront distribution. Origin Access Control (OAC) is the recommended way to secure an S3 origin for CloudFront. OAC allows CloudFront to sign requests to S3, and the bucket policy can be configured to allow access only from the specific CloudFront distribution using the OAC. This blocks direct access via S3 URL because the bucket policy does not grant public access.

Answer

Use CloudFront signed URLs and configure the bucket policy to allow access from CloudFront IP ranges

Answer

Enable S3 Block Public Access and configure CloudFront to use the bucket as an origin

Answer

Configure the bucket policy to allow s3:GetObject from the CloudFront service principal

Question 7

A company uses AWS Systems Manager Session Manager to manage EC2 instances. The security team wants to ensure that all SSH sessions are logged and that commands are recorded. What should be configured?

Accepted Answer

Enable session logging in the Session Manager preferences to send logs to Amazon S3 and CloudWatch Logs. Session Manager preferences allow logging session activity to Amazon S3 and CloudWatch Logs, which records all commands run during SSH sessions. Option B is incorrect because security groups control network access, not logging. Option C is incorrect because CloudTrail logs API calls to Systems Manager, not the commands executed within a session. Option D is incorrect because an IAM policy only controls permissions to start sessions, not the logging of session activity.

Answer

Configure the security group to allow inbound SSH from the Session Manager service

Answer

Enable AWS CloudTrail to log Systems Manager API calls

Answer

Create an IAM policy that allows ssm:StartSession and attach it to the instance role

Question 8

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

Accepted Answer

Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing any unsolicited inbound traffic from the internet. The private subnet route table sends 0.0.0.0/0 traffic to the NAT Gateway, which then forwards it through the Internet Gateway (IGW) attached to the VPC. This provides the highest security because the private instances remain unreachable from the internet, unlike using an IGW directly or a bastion host for routing.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it

Answer

Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

Answer

Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

Question 9

A security engineer needs to ensure that an EC2 instance can only be accessed using SSH key pairs, not passwords. Which configuration is required?

Accepted Answer

Set 'PasswordAuthentication no' in /etc/ssh/sshd_config on the EC2 instance. SSH password authentication is controlled by the `PasswordAuthentication` directive in `/etc/ssh/sshd_config`. Setting it to `no` disables password-based logins, forcing users to authenticate using SSH key pairs (public-key cryptography). This is the standard, OS-level method to enforce key-only SSH access on an EC2 instance.

Answer

Use EC2 Instance Connect instead of SSH

Answer

Attach an IAM role to the instance that denies password-based access

Answer

Configure the security group to allow SSH only from specific IP addresses

Question 10

A company uses AWS WAF to protect a web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match rule. AWS WAF provides a dedicated SQL injection match rule that inspects incoming requests for SQL injection patterns in the URI, query string, or body. This rule uses a set of predefined SQL-like patterns (e.g., 'OR 1=1', 'UNION SELECT') to detect and block malicious input, directly addressing the security team's requirement.

Answer

IP set rule

Answer

Geographic match rule

Answer

Rate-based rule

Question 11

A company wants to allow cross-account access to an S3 bucket. The bucket owner (Account A) wants to grant read-only access to users in Account B. Which combination of policies is required?

Accepted Answer

A bucket policy in Account A granting s3:GetObject to Account B and an IAM policy in Account B allowing s3:GetObject. Cross-account S3 access requires two-sided permission: the bucket owner (Account A) must grant access via a bucket policy that allows Account B's principal to perform s3:GetObject, and the IAM user or role in Account B must also have an IAM policy allowing s3:GetObject. Both are evaluated, and the request is allowed only if both sides permit it.

Answer

A bucket ACL in Account A granting READ access to Account B

Answer

An IAM policy in Account A that allows s3:GetObject

Answer

An IAM role in Account B that grants s3:GetObject to Account A

Question 12

A security engineer needs to audit all changes to AWS resources in an account. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity and changes to AWS resources as events, providing an audit log of who made what change, when, and from where. This directly meets the requirement to audit all changes, as every AWS API call (e.g., CreateInstance, ModifySecurityGroup) is captured in a CloudTrail event history or delivered to an S3 bucket for long-term analysis.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

A company is designing a VPC with multiple subnets. The security team wants to ensure that traffic between the application tier and database tier is encrypted in transit. Which TWO actions should be taken?

Accepted Answer

Enable encryption on the database connections using TLS/SSL. Option B is correct because enabling TLS/SSL on the database connections ensures that the data transmitted between the application tier and database tier is encrypted in transit, protecting it from interception or eavesdropping. Option D is correct because configuring the application to use an encrypted protocol (such as TLS/SSL) when connecting to the database is necessary to actually initiate and negotiate the encrypted session, complementing the database-side encryption. Option A is incorrect because an internet gateway only enables internet connectivity for a subnet and does not encrypt traffic between internal tiers. Option C is incorrect because security group rules restrict which ports and sources can communicate but do not provide encryption in transit. Option E is incorrect because VPC peering connects subnets or VPCs for routing purposes but does not encrypt the traffic between them.

Answer

Attach an internet gateway to the database subnet

Answer

Use security group rules to restrict traffic to the database port

Answer

Use VPC Peering to connect the subnets

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation have encryption enabled by default. Which TWO approaches can achieve this?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket encryption and auto-remediates. An AWS Config rule can check that S3 buckets have encryption enabled and automatically remediate any non-compliant buckets. Option C is correct because a service control policy (SCP) can be attached to the root OU to deny the creation of S3 buckets without encryption, using a condition on the s3:x-amz-server-side-encryption header. Option B is incorrect because S3 Block Public Access does not enforce encryption. Option D is incorrect because attaching an IAM role to CloudFormation only grants permissions but does not enforce encryption. Option E is incorrect because CloudFormation stack policies only protect existing resources from updates and cannot enforce conditions on bucket creation.

Answer

Enable S3 Block Public Access at the account level

Answer

Attach an IAM role to the CloudFormation service that grants permissions to encrypt buckets

Answer

Use a CloudFormation stack policy to deny creation of S3 buckets without encryption

Question 15

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

Accepted Answer

The source IP condition does not match the user's actual IP address. The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Answer

The bucket policy overrides the IAM policy

Answer

The policy does not allow the s3:GetObject action

Answer

The user is not assuming the correct IAM role