SCS-C02 Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A company has a VPC with a single public subnet and a single private subnet. The private subnet contains an RDS MySQL database that should not be accessible from the internet. The public subnet contains a bastion host that is used for SSH access to the database instance. The security team wants to ensure that the database can only be accessed from the bastion host. Which two security group rules should be configured? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Database security group: Allow inbound MySQL from the bastion security group.. Option B is correct because referencing the bastion's security group as the source in the database security group's inbound rule for MySQL (TCP 3306) ensures only instances carrying that security group—i.e., the bastion host—can reach the RDS database, which is exactly the least-privilege access the security team wants. Option C is correct because restricting inbound SSH (TCP 22) on the bastion security group to a limited corporate IP range prevents the bastion itself from being exposed to the entire internet, which is essential since the bastion is the only path to the database. Option A is wrong because allowing the entire public subnet CIDR would permit any resource in that subnet, not just the bastion, to reach the database. Option D is wrong because 0.0.0.0/0 would make the database reachable from the internet, directly violating the requirement. Option E is wrong because allowing SSH from 0.0.0.0/0 exposes the bastion to the world and undermines the controlled access model.

Answer

Database security group: Allow inbound MySQL from the public subnet CIDR.

Answer

Database security group: Allow inbound MySQL from 0.0.0.0/0.

Answer

Bastion security group: Allow inbound SSH from 0.0.0.0/0.

Question 2

A company is using AWS Organizations to manage multiple accounts. The security team wants to restrict the use of specific instance types across all accounts. Which two AWS services can enforce this restriction? (Choose TWO.)

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are correct because they are AWS Organizations policies that set the maximum available permissions for member accounts, so an SCP with a Deny effect on ec2:RunInstances for the restricted instance types (using a condition such as ec2:InstanceType) enforces the restriction centrally across all accounts in the organization. AWS Config rules are also correct because a managed or custom rule can evaluate EC2 instances against the desired instance-type configuration and flag or remediate noncompliant resources, providing enforcement through compliance monitoring and automatic remediation. IAM policies do not belong here because they are scoped to individual identities or resources within a single account and cannot centrally govern all accounts in an organization. VPC Flow Logs do not belong because they only capture IP traffic metadata for network analysis, not instance-type usage. AWS CloudTrail does not belong because it only records API activity for auditing and does not enforce or restrict resource configurations.

Answer

IAM policies

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 3

A security engineer needs to ensure that an EC2 instance can only be launched using an approved Amazon Machine Image (AMI) from a specific AWS account. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Service Catalog. AWS Service Catalog allows you to create and manage a portfolio of approved products, such as EC2 instances launched from specific AMIs. By defining a product that uses an approved AMI from a particular AWS account and enforcing launch constraints, you can ensure that only that AMI is used. IAM policies alone cannot restrict the AMI ID at launch time because they lack the granularity to filter by source account or AMI ID in the ec2:RunInstances action.

Answer

IAM policies

Answer

AWS Config

Answer

AWS Image Builder

Question 4

An organization uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which approach would enforce this across all accounts?

Accepted Answer

Apply a Service Control Policy that denies PutBucketPolicy or PutBucketEncryption without encryption.. A Service Control Policy (SCP) is a centralized policy in AWS Organizations that can deny actions across all accounts in the organization. By denying the s3:PutBucketPolicy and s3:PutEncryptionConfiguration actions unless encryption is specified, the SCP enforces server-side encryption on all S3 buckets, regardless of individual account configurations. This approach is effective because SCPs are applied at the organization level and cannot be overridden by account administrators.

Answer

Create IAM roles in each account to enforce encryption.

Answer

Apply an S3 bucket policy to each bucket requiring encryption.

Answer

Use AWS Config rules to detect unencrypted buckets.

Question 5

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. The security team wants to create a subnet for a legacy application that requires 2000 IP addresses. What is the smallest subnet CIDR that meets this requirement?

Accepted Answer

10.0.0.0/20. The /20 subnet provides 4096 total IP addresses (2^(32-20) = 4096), minus 5 reserved by AWS (network, VPC router, DNS, future, broadcast) leaves 4091 usable IPs, which exceeds the 2000 requirement. A /22 offers only 1024 usable IPs (1024 total - 5 = 1019), which is insufficient. The smallest subnet that meets the 2000-IP requirement is /20.

Answer

10.0.0.0/24

Answer

10.0.0.0/22

Answer

10.0.0.0/19

Question 6

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Accepted Answer

AWS WAF. AWS WAF (B) is correct because it operates at the application layer (Layer 7) and inspects HTTP/HTTPS requests against web ACL rules to block exploits such as SQL injection and cross-site scripting before they reach the EC2-hosted web application. Security Groups (C) are correct because they provide stateful, instance-level network-layer (Layer 3/4) filtering of inbound and outbound traffic by protocol, port, and source/destination, forming the network protection tier of a defense-in-depth design. Together they cover both the network and application layers the scenario requires. Amazon GuardDuty (A) is a threat-detection service that monitors for malicious activity but does not block traffic, so it is not a protective control. AWS Shield Advanced (D) primarily defends against volumetric DDoS attacks at Layers 3/4/7 but is not the application-layer request-filtering control the question targets. Network ACLs (E) are stateless subnet-level filters that also operate only at Layers 3/4, duplicating the network layer rather than adding application-layer protection.

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 7

A company wants to ensure that all Amazon EC2 instances in a VPC can only be accessed via SSH from a specific IP address range (203.0.113.0/24). Which VPC component should be used to enforce this restriction?

Accepted Answer

Network ACL. A network ACL is a stateless firewall that controls inbound and outbound traffic at the subnet level. It can be configured with rules to allow SSH traffic only from the specified IP range (203.0.113.0/24) and deny all other inbound traffic, effectively enforcing the restriction. Security groups (Option A) are stateful and attached to instances, but they cannot explicitly deny traffic; they only allow. Route tables (Option B) control traffic routing, not filtering. Internet gateways (Option D) allow internet access but do not provide traffic filtering.

Answer

Security group

Answer

Route table

Answer

Internet gateway

Question 8

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

Accepted Answer

Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.. Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.

Answer

Delete the IAM role that is allowed access to the bucket.

Answer

Use AWS WAF to block the IP addresses of the compromised role.

Answer

Modify the bucket policy to deny all principals.

Question 9

A company is designing a security group for a web server that must allow HTTP (80) and HTTPS (443) traffic from the internet. The server also needs to make outbound connections to an Amazon RDS database on port 3306 and to the internet for software updates. Which THREE rules should be included in the security group? (Select THREE.)

Accepted Answer

Inbound: HTTPS (443) from 0.0.0.0/0. Option C is correct because the web server must accept HTTPS traffic on port 443 from the internet, and 0.0.0.0/0 as the source allows any public IPv4 client to reach it. Option E is correct for the same reason with HTTP on port 80, which the scenario explicitly requires for inbound web traffic. Option D is correct because security groups are stateful but still need an outbound rule permitting the server's own HTTPS (443) connections to 0.0.0.0/0 for software updates from internet repositories. The duplicate outbound HTTPS rule (the option rendered as null) is also marked correct because it matches that same required outbound 443 permission to 0.0.0.0/0. Option A is not needed because inbound MySQL 3306 from the VPC CIDR would let other hosts initiate database connections to the web server, whereas the scenario requires the web server to be the client connecting outbound to RDS. Option B is not needed because outbound MySQL 3306 should target the RDS database's security group or subnet CIDR as the destination, not the entire VPC CIDR block, and the question's required rules center on inbound 80/443 and outbound 443.

Answer

Inbound: MySQL (3306) from the VPC CIDR block

Answer

Outbound: MySQL (3306) to the VPC CIDR block

Question 10

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

Accepted Answer

The PublicAccessBlockConfiguration is blocking the bucket policy.. The PublicAccessBlockConfiguration at the account or bucket level overrides any bucket policy that grants public or cross-account access. Even though the bucket policy may allow the DataAccessRole to read objects, the PublicAccessBlockConfiguration blocks all public or cross-account access, causing AccessDenied errors. This is the most likely cause because the bucket policy is effectively ignored when public access blocks are enabled.

Answer

The IAM role is not attached to the EC2 instance profile.

Answer

The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.

Answer

The role does not have s3:ListBucket permission.

Question 11

A company wants to allow an EC2 instance in a VPC to download patches from the internet but block all other outbound traffic. Which configuration should be used?

Accepted Answer

Place a NAT Gateway in a public subnet and route the EC2 instance's traffic through it. A NAT Gateway in a public subnet allows outbound traffic from private subnets to the internet while preventing inbound traffic from the internet. By routing the EC2 instance's traffic through the NAT Gateway, the instance can download patches (outbound) but cannot be reached from the internet, satisfying the requirement to block all other outbound traffic (i.e., only patch downloads are allowed, but the NAT Gateway itself does not filter by destination; additional security group or NACL rules would be needed to restrict to patch servers only).

Answer

Use a Virtual Private Gateway and connect to a VPN

Answer

Attach an Internet Gateway and add a route 0.0.0.0/0 to the EC2 instance's route table

Answer

Use a VPC Peering connection to an external VPC with internet access

Question 12

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy type should be used?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. An S3 bucket policy with the `aws:SourceVpc` condition key allows you to restrict access to the bucket so that only requests originating from a specific VPC are permitted. This is the correct approach because S3 bucket policies are resource-based policies that can evaluate the source VPC of a request via the VPC endpoint, providing a direct and granular access control mechanism for VPC-restricted access.

Answer

IAM policy

Answer

Network ACL

Answer

VPC Endpoint policy

Question 13

A company is using AWS WAF to protect a web application. The security team notices that a specific IP address is generating a high volume of requests and triggering the WAF rate-based rule. However, the IP address is a legitimate partner's static IP. What should the security team do to allow this IP while still protecting against other malicious traffic?

Accepted Answer

Add a rule with an IP set condition that allows the partner's IP as an exception to the rate-based rule.. AWS WAF allows you to add a rule with an IP set condition that explicitly allows traffic from the partner's static IP address. By placing this allow rule at a higher priority than the rate-based rule, the partner's requests bypass the rate limit while all other traffic is still subject to the rate-based rule. This approach ensures the legitimate partner is not blocked without weakening the overall security posture.

Answer

Create an IP set and whitelist the IP address in the web ACL default action.

Answer

Increase the rate limit for the rate-based rule to accommodate the partner's traffic.

Answer

Disable the rate-based rule for the partner's IP by modifying the rule scope.

Question 14

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

Accepted Answer

Inbound rule: Allow HTTP/HTTPS from the ALB's security group.. Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.

Answer

Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.

Answer

Outbound rule: Allow all traffic to the ALB's security group only.

Answer

Outbound rule: Allow all traffic to 0.0.0.0/0.

Question 15

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all Amazon S3 buckets created by CloudFormation are encrypted by default. Which approach should be taken?

Accepted Answer

Use a bucket policy with a condition that denies s3:PutObject if the x-amz-server-side-encryption header is not present.. A bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to the bucket must include encryption headers. This enforces server-side encryption at the object level, which is the most direct way to guarantee encryption for all objects placed into S3 buckets created by CloudFormation.

Answer

Configure an IAM policy that requires all S3 operations to use encryption.

Answer

Set a bucket policy in the CloudFormation template that denies all actions unless encryption is enabled.

Answer

Enable AWS Config rule s3-bucket-server-side-encryption-enabled to enforce encryption.