SCS-C02 Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The connection is set up with a private VIF to a VPC using a virtual private gateway. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be implemented?

Accepted Answer

Set up an IPsec VPN over the Direct Connect private VIF. Option B (IPsec VPN over Direct Connect) is correct because it encrypts the traffic over the private VIF. Option A is wrong because Direct Connect itself does not encrypt. Option C is wrong because using a VPN over the internet is less secure and not over Direct Connect. Option D is wrong because TLS is for application layer, not network layer.

Answer

Configure TLS on the applications

Answer

Use a site-to-site VPN over the internet instead of Direct Connect

Answer

Enable encryption on the Direct Connect private VIF

Question 2

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. To restrict access to an S3 bucket so that only requests originating from a specific VPC endpoint are allowed, you must use the `aws:SourceVpce` condition key in the S3 bucket policy. This key evaluates the VPC endpoint ID (e.g., `vpce-1a2b3c4d`) of the request, ensuring that only traffic routed through that specific endpoint is granted access. The `aws:SourceVpc` key is used to restrict access based on the VPC ID, not the endpoint ID, and `aws:SourceIp` and `aws:VpcSourceIp` are not valid condition keys for VPC endpoint-based restrictions.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 3

A company is using AWS CloudFormation to deploy a multi-tier application. The security team requires that the database tier (RDS) be deployed in private subnets that are not directly routable from the application tier (EC2). The application tier must communicate with the database using an internal network path. Which solution meets these requirements?

Accepted Answer

Deploy the RDS instance in private subnets and use an RDS VPC Endpoint (Interface) in the application subnets. Option C (VPC Endpoint for RDS) is correct because it provides private connectivity without routing through subnets. Option A is wrong because direct routing would require routes. Option B is wrong because ClassicLink is legacy. Option D is wrong because a proxy is not needed.

Answer

Place the RDS instance in the same subnet as the application tier and use security groups

Answer

Use ClassicLink to connect the application tier to the RDS instance

Answer

Use a NAT Gateway in the application subnet to route traffic to the RDS instance

Question 4

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

Accepted Answer

AWS WAF. Option D (AWS WAF) is correct because it integrates with Shield Advanced for application layer DDoS mitigation. Option A (AWS Firewall Manager) is for managing rules. Option B (AWS Network Firewall) is for network layer. Option C (AWS GuardDuty) is for threat detection.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 5

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Accepted Answer

Create an S3 Gateway Endpoint in the VPC. A VPC Gateway Endpoint (option A) allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. This is the correct foundational component because it uses prefix lists in the route table to direct S3 traffic to the endpoint, bypassing the need for an Internet Gateway or NAT Gateway.

Answer

Attach an Internet Gateway to the VPC

Answer

Create an S3 Interface Endpoint in the VPC

Answer

Use a NAT Gateway to route the traffic to the internet

Question 6

A company wants to deploy a web application that must be accessible over HTTPS only. The application runs behind an Application Load Balancer (ALB). The security team wants to enforce HTTP Strict Transport Security (HSTS) to prevent downgrade attacks. Which configuration achieves this?

Accepted Answer

Configure the ALB to redirect HTTP traffic to HTTPS and have the application set the Strict-Transport-Security header in the response. Option C (Configure ALB to redirect HTTP to HTTPS and set the Strict-Transport-Security header) is correct. Option A is wrong because HSTS is a header, not a listener rule. Option B is wrong because HSTS is not a CloudFront feature. Option D is wrong because ALB can add custom headers.

Answer

Use AWS CloudFront with a custom header that enforces HSTS

Answer

Configure the ALB listener to use HTTPS only and set a custom header via a listener rule

Answer

Enable HSTS on the ALB via the AWS Management Console

Question 7

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are encrypted at rest and that access to the logs is controlled. Which actions should be taken? (Choose two.)

Accepted Answer

Enable default encryption on the S3 bucket where CloudTrail logs are stored. Option A (Enable S3 Server-Side Encryption) and Option B (Use S3 bucket policy to restrict access) are correct. Option C is wrong because CloudTrail does not support KMS per trail; it uses S3 SSE. Option D is wrong because CloudTrail does not support bucket policies for delivery. Option E is wrong because CloudWatch Logs can be encrypted but not the primary method for S3.

Answer

Enable CloudTrail log file validation

Answer

Use AWS KMS to encrypt the CloudTrail log files

Answer

Store logs in Amazon CloudWatch Logs with encryption enabled

Question 8

A company is using AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt the data. Which KMS policy element should be used?

Accepted Answer

Principal. Option B (Principal) is correct because it specifies who can use the key. Option A (Effect) is for allow/deny. Option C (Action) is for allowed operations. Option D (Resource) is for the key ARN.

Answer

Resource

Answer

Action

Answer

Effect

Question 9

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The security team wants to restrict access to the ALB so that it only accepts traffic from CloudFront. Which configuration should be used?

Accepted Answer

Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.. Option B is correct because configuring the ALB security group to allow traffic only from CloudFront's IP ranges ensures that only CloudFront can reach the ALB. Option A is wrong because CloudFront does not require a VPC origin; ALB is a regional endpoint. Option C is wrong because the ALB cannot authenticate the CloudFront user agent. Option D is wrong because CloudFront cannot use an IAM role to access the ALB.

Answer

Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.

Answer

Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.

Answer

Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.

Question 10

A security engineer is designing a VPC with private subnets for an application that must access the internet for software updates. The VPC has a NAT gateway in a public subnet. The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT gateway. Which additional security measure should be implemented to ensure that only the application instances can use the NAT gateway, and not any other resources in the VPC?

Accepted Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the NAT gateway's private IP address.. Option D is correct because using a VPC endpoint for the NAT gateway is not possible; a network ACL on the private subnet can restrict outbound traffic to the NAT gateway's IP, ensuring only that traffic can exit. Option A is wrong because security groups cannot reference the NAT gateway as a destination; they control inbound/outbound traffic based on IP/CIDR. Option B is wrong because there is no IAM policy for NAT gateway usage. Option C is wrong because a flow log does not block traffic; it only monitors.

Answer

Enable VPC Flow Logs on the NAT gateway to detect unauthorized usage.

Answer

Create an IAM policy that allows only the application instances to use the NAT gateway.

Answer

Configure a security group for the NAT gateway that allows only the application instances' security group as source.

Question 11

A company wants to use AWS Direct Connect to establish a dedicated network connection from its on-premises data center to AWS. Which of the following is a security best practice when configuring Direct Connect?

Accepted Answer

Use a private virtual interface (VIF) and enable IPsec encryption for the traffic.. Option A is correct because using a private VIF ensures traffic goes over the AWS private network, not the internet, and encrypting with IPsec adds a layer of security. Option B is wrong because MACsec is for physical layer security, not required for private VIF. Option C is wrong because public VIF is for public services and is less secure. Option D is wrong because a VPN over Direct Connect is redundant if private VIF is used.

Answer

Use a public VIF to access all AWS services including VPC resources.

Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.

Answer

Use a private VIF and enable MACsec encryption at the physical layer.

Question 12

A company has an Amazon S3 bucket that stores sensitive data. The security team wants to ensure that all access to the bucket is made only via HTTPS. Which policy should be used?

Accepted Answer

Add a bucket policy that denies access when aws:SecureTransport is false.. Option D is correct because a bucket policy with a condition that denies access if aws:SecureTransport is false ensures HTTPS only. Option A is wrong because CloudFront does not enforce HTTPS for S3 origin. Option B is wrong because S3 does not have an HTTPS-only bucket policy setting; it requires a custom policy. Option C is wrong because a VPC endpoint does not enforce HTTPS.

Answer

Enable CloudFront with HTTPS-only viewer protocol policy.

Answer

Use a VPC endpoint for S3 with a bucket policy that restricts access to the VPC endpoint.

Answer

Enable 'Block public access' on the bucket.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which solution should be used?

Accepted Answer

Use AWS Firewall Manager to define security group policies and enforce them across accounts.. Option B is correct because AWS Firewall Manager allows centralized management of security group rules across accounts and resources. Option A is wrong because AWS Config can evaluate compliance but not enforce rules. Option C is wrong because Service Control Policies (SCPs) control permissions at the account level, not network rules. Option D is wrong because AWS Network Firewall is for network traffic inspection, not security group management.

Answer

Use AWS Organizations Service Control Policies to restrict security group modifications.

Answer

Use AWS Config rules to automatically remediate non-compliant security groups.

Answer

Use AWS Network Firewall to inspect traffic and block unauthorized connections.

Question 14

A company is deploying a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances are in a private subnet. How should the security group for the EC2 instances be configured?

Accepted Answer

Allow inbound HTTP/HTTPS from the security group of the ALB.. Option A is correct because the security group should allow HTTP/S traffic from the ALB's security group, which is a best practice for least privilege. Option B is wrong because allowing all IPs exposes instances to direct internet traffic. Option C is wrong because the ALB is in a public subnet, not the VPC CIDR. Option D is wrong because the instances are in a private subnet and should not receive traffic from the internet.

Answer

Allow inbound HTTP/HTTPS from the internet gateway.

Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0.

Answer

Allow inbound HTTP/HTTPS from the VPC CIDR.

Question 15

A security engineer is troubleshooting why an EC2 instance in a private subnet cannot access the internet through a NAT gateway. The route table for the private subnet has a default route pointing to the NAT gateway. The NAT gateway is in a public subnet with a route to an internet gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT gateway does not have an Elastic IP address associated.. Option C is correct because the NAT gateway must have an associated Elastic IP to communicate with the internet. Option A is wrong because the security group of the NAT gateway must allow outbound traffic, but the default is permissive. Option B is wrong because the NAT gateway itself does not need a route to the internet gateway; its public subnet does. Option D is wrong because security groups are not applied to NAT gateways in the same way; they are applied to the ENI.

Answer

The EC2 instance's security group is blocking outbound traffic.

Answer

The NAT gateway's security group is blocking outbound traffic.

Answer

The NAT gateway does not have a route to the internet gateway in its route table.