SCS-C02 Infrastructure Security Practice Test 19 — 15 Questions

Question 1

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

Accepted Answer

The EC2 instances in this security group cannot initiate outbound connections. Security groups are stateful and, by default, allow all outbound traffic; however, if outbound rules are explicitly removed, the group has no rule permitting egress, so instances cannot initiate outbound connections. Return traffic for allowed inbound connections is still permitted due to statefulness, but new outbound-initiated flows are blocked. Thus the correct implication is that outbound connections cannot be initiated.

Answer

The EC2 instances cannot receive inbound HTTP traffic

Answer

The security group allows all outbound traffic by default

Answer

Outbound traffic is allowed because security groups are stateful

Question 2

A security engineer is troubleshooting connectivity issues from an EC2 instance in a private subnet to an S3 bucket. The instance has a security group allowing outbound HTTPS (443) to 0.0.0.0/0, and the subnet's network ACL allows outbound HTTPS to 0.0.0.0/0. However, requests to S3 are timing out. Which additional configuration is most likely required?

Accepted Answer

Add a VPC Gateway Endpoint for S3 and update the route table. An EC2 instance in a private subnet has no route to the internet, so it cannot reach S3's public endpoints even though the security group and NACL allow outbound HTTPS. The correct fix is to create a VPC Gateway Endpoint for S3 and add a route in the subnet's route table pointing S3 traffic to the endpoint. This keeps traffic on the AWS private network and avoids the need for a NAT gateway.

Answer

Attach an IAM role to the EC2 instance with S3 permissions

Answer

Modify the security group to allow traffic to the S3 region-specific IP range

Answer

Configure a TLS termination proxy

Question 3

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should be used?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. S3 bucket policies support the `aws:SourceVpc` condition key, which allows you to restrict access to requests originating from a specific VPC. This works by evaluating the VPC ID from which the request was made, using the source VPC information that AWS automatically includes in requests from VPC endpoints. No other mechanism (security groups, IAM source IP conditions, or network ACLs) can directly enforce VPC-level access control on S3.

Answer

Security group assigned to the S3 bucket

Answer

IAM policy with aws:SourceIp condition

Answer

Network ACL attached to the S3 bucket

Question 4

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

Accepted Answer

AWS WAF. AWS WAF is a Layer 7 web application firewall that inspects HTTP/HTTPS requests and can block common exploits like SQL injection and cross-site scripting using managed rule groups (e.g., AWSManagedRulesCommonRuleSet, SQLiRuleSet, XSSRuleSet). It integrates natively with ALB, CloudFront, and API Gateway, making it the correct choice for protecting an ALB-fronted web app.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS Shield Advanced

Question 5

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

Accepted Answer

Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured. Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Answer

Set up AWS Config rules to detect non-compliant buckets

Answer

Create an IAM role that requires encryption and attach it to all users

Answer

Use an S3 bucket policy with a condition for encryption

Question 6

A company wants to allow an EC2 instance to access a DynamoDB table without traversing the internet. Which AWS feature should be used?

Accepted Answer

VPC Gateway Endpoint for DynamoDB. A VPC Gateway Endpoint for DynamoDB allows EC2 instances within a VPC to access DynamoDB without traversing the internet. It uses AWS PrivateLink to route traffic through the AWS network, ensuring low latency and enhanced security by keeping traffic within the AWS backbone.

Answer

VPC Peering

Answer

ClassicLink

Answer

NAT Gateway

Question 7

A company has a requirement to log all network traffic flowing through a VPC, including traffic between EC2 instances within the same subnet. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including traffic between EC2 instances within the same subnet, and can be published to CloudWatch Logs or S3. It is the only AWS service listed that provides packet-level metadata for all traffic flowing through VPC network interfaces.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A security engineer is configuring a security group for a web server that should only accept HTTPS traffic from the internet. Which inbound rule should be set?

Accepted Answer

TCP port 443 from 0.0.0.0/0. HTTPS uses TCP port 443, so an inbound security group rule allowing TCP 443 from 0.0.0.0/0 permits HTTPS traffic from any internet source. This is the standard configuration for a public web server that must accept secure web traffic. Security groups are stateful, so return traffic is automatically allowed without an outbound rule.

Answer

TCP port 3389 from 0.0.0.0/0

Answer

TCP port 22 from 0.0.0.0/0

Answer

TCP port 80 from 0.0.0.0/0

Question 9

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be used?

Accepted Answer

Set up an IPsec VPN over the Direct Connect connection. Direct Connect does not natively encrypt traffic; it provides a private, low-latency connection but the data traverses it in cleartext. By establishing an IPsec VPN tunnel over the Direct Connect link (often called a 'Direct Connect VPN' or using a virtual private gateway with a VPN attachment), you encrypt all traffic between on-premises and the VPC at the network layer, meeting the security team's requirement for encryption.

Answer

Enable encryption on the Direct Connect virtual interface

Answer

Use VPC Peering with encryption

Answer

Configure TLS on all applications

Question 10

Which THREE components are required to set up a client VPN for remote access to a VPC? (Choose 3.)

Accepted Answer

Client VPN endpoint. A Client VPN endpoint is required as the entry point for remote clients to connect to the VPC. It manages authentication, encryption (using TLS 1.2), and routing for client connections. Without this component, there is no VPN server to accept and authenticate client traffic.

Answer

Virtual Private Gateway

Answer

Customer Gateway

Question 11

Which TWO AWS services are designed to provide DDoS protection? (Choose 2.)

Accepted Answer

AWS WAF. AWS WAF (Option D) is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. It integrates with Amazon CloudFront, Application Load Balancer, and API Gateway to filter and monitor HTTP(S) requests, providing protection against layer 7 DDoS attacks such as SQL injection and cross-site scripting.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. Security engineers need to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which architecture should be used?

Accepted Answer

Create a central inspection VPC with the firewall appliance. Configure Transit Gateway route tables to route traffic between VPCs through the inspection VPC.. Transit Gateway route tables can force traffic between VPCs through the inspection VPC by attaching the firewall appliance and using specific routing entries. Option A is incorrect because security groups only control traffic at the instance level and cannot redirect traffic to an inspection appliance. Option B is incorrect because VPC Peering does not support transitive routing, so traffic between two VPCs cannot go through a third VPC. Option C is incorrect because Network ACLs are stateless and can only filter traffic based on IP/port, not route traffic through an inspection appliance.

Answer

Use security groups in each VPC to allow only traffic from the firewall appliance's IP.

Answer

Establish VPC Peering connections between each VPC and the inspection VPC.

Answer

Configure Network ACLs in each VPC to deny traffic that does not originate from the inspection VPC.

Question 13

A company is designing a security group for a web application that must receive HTTPS traffic from the internet and send traffic to a backend database. The backend database is an Amazon RDS MySQL instance. What is the best practice for configuring the security groups?

Accepted Answer

Web server SG: inbound HTTPS from 0.0.0.0/0. Database SG: inbound MySQL from web server SG.. The best practice is to allow inbound HTTPS from the internet to the web server security group, and then allow inbound MySQL on the database security group referencing the web server security group as the source. This creates a tight, identity-based trust relationship between tiers without hardcoding CIDR ranges.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound to database SG on port 3306. Database SG: inbound MySQL from web server CIDR block.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, outbound all traffic. Database SG: inbound MySQL from 0.0.0.0/0.

Answer

Web server SG: inbound HTTPS from 0.0.0.0/0, inbound MySQL from database SG. Database SG: outbound MySQL to web server SG.

Question 14

A company wants to allow its developers to SSH into EC2 instances only from the corporate network IP range (203.0.113.0/24). Which configuration should be used to enforce this restriction?

Accepted Answer

Add a security group rule that allows inbound SSH (port 22) from the corporate IP range.. A security group rule can restrict inbound SSH to the specific IP range. Security groups act as a virtual firewall for EC2 instances, and by adding a rule that allows inbound SSH only from the corporate IP range (203.0.113.0/24), all other inbound traffic on port 22 is implicitly denied. Option A is incorrect because network ACLs are stateless and apply at the subnet level, not the instance level, and the question asks for a configuration to enforce SSH restriction on EC2 instances. Option B is incorrect because AWS Systems Manager Session Manager does not use SSH; it provides browser-based shell access without inbound ports. Option C is incorrect because IAM policies control permissions for API actions, not network traffic.

Answer

Configure a network ACL on the subnet to allow inbound SSH from the corporate range and deny all other inbound traffic.

Answer

Use AWS Systems Manager Session Manager to connect to instances instead of SSH.

Answer

Add an IAM policy that allows `ec2:RunInstances` only if the request includes the corporate IP.

Question 15

A security team needs to audit all changes to security group rules across multiple AWS accounts in an organization. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS Config and AWS CloudTrail.. AWS Config continuously records changes to resource configurations, including security group rules, and can evaluate them against desired configurations. AWS CloudTrail captures API activity, so it logs the actual API calls that modify security groups (e.g., AuthorizeSecurityGroupIngress). Together, Config provides the configuration change history and CloudTrail provides the who, what, when, and from where for each change. This combination is the standard AWS approach for auditing security group modifications across multiple accounts, especially when centralized via AWS Organizations and a delegated administrator.

Answer

Amazon CloudWatch Logs and AWS CloudTrail.

Answer

Amazon GuardDuty and AWS Security Hub.

Answer

AWS Trusted Advisor and AWS Config.