SCS-C02 Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are encrypted at rest and that access to the logs is controlled. Which actions should be taken? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable default encryption on the S3 bucket where CloudTrail logs are stored. Enabling default encryption on the S3 bucket ensures that all CloudTrail log files are encrypted at rest using server-side encryption (SSE-S3 or SSE-KMS), meeting the requirement for encryption at rest. Option C is correct because attaching an S3 bucket policy that restricts access to authorized principals provides fine-grained access control, ensuring only permitted users or roles can read or manage the logs, which satisfies the access control requirement.

Answer

Enable CloudTrail log file validation

Answer

Use AWS KMS to encrypt the CloudTrail log files

Answer

Store logs in Amazon CloudWatch Logs with encryption enabled

Question 2

A company is using AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt the data. Which KMS policy element should be used?

Accepted Answer

Principal. (Principal) is correct because in a KMS key policy, the Principal element specifies which IAM users, roles, or AWS services are allowed to perform actions on the key. By setting the Principal to the specific IAM role's ARN, only that role can decrypt the data, enforcing the security team's requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 3

A security engineer is designing a VPC with private subnets for an application that must access the internet for software updates. The VPC has a NAT gateway in a public subnet. The private subnet route table has a default route (0.0.0.0/0) pointing to the NAT gateway. Which additional security measure should be implemented to ensure that only the application instances can use the NAT gateway, and not any other resources in the VPC?

Accepted Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the NAT gateway's private IP address.. A network ACL (NACL) on the private subnet restricts outbound traffic from that subnet to only the NAT gateway's private IP address. This ensures that instances in the private subnet (the application instances) can only reach the internet via the NAT gateway. However, this does not by itself block resources in other subnets from using the NAT gateway; those subnets are prevented from using it because they do not have a route to the NAT gateway in their route tables. The NACL adds a defense-in-depth layer by restricting the destination of outbound traffic from the application subnet.

Answer

Enable VPC Flow Logs on the NAT gateway to detect unauthorized usage.

Answer

Create an IAM policy that allows only the application instances to use the NAT gateway.

Answer

Configure a security group for the NAT gateway that allows only the application instances' security group as source.

Question 4

A company wants to use AWS Direct Connect to establish a dedicated network connection from its on-premises data center to AWS. Which of the following is a security best practice when configuring Direct Connect?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. The security best practice for encrypting Direct Connect traffic is to establish an IPsec VPN tunnel over a private virtual interface (VIF). This adds Layer 3 encryption to the otherwise unencrypted dedicated connection, protecting data in transit. Option A is misleading because IPsec is not 'enabled' directly on a VIF; it requires a VPN connection. Option D (MACsec) provides Layer 2 encryption at the physical layer, but the question asks specifically for the recommended best practice, which is IPsec over private VIF.

Answer

Use a private virtual interface (VIF) and enable IPsec encryption for the traffic.

Answer

Use a public VIF to access all AWS services including VPC resources.

Answer

Use a private VIF and enable MACsec encryption at the physical layer.

Question 5

A company has an Amazon S3 bucket that stores sensitive data. The security team wants to ensure that all access to the bucket is made only via HTTPS. Which policy should be used?

Accepted Answer

Add a bucket policy that denies access when aws:SecureTransport is false.. The condition `aws:SecureTransport` evaluates to `false` when the request is made over HTTP instead of HTTPS. By adding a bucket policy that denies all S3 actions when `aws:SecureTransport` is `false`, the company enforces HTTPS-only access at the policy level, regardless of how the request originates.

Answer

Enable CloudFront with HTTPS-only viewer protocol policy.

Answer

Use a VPC endpoint for S3 with a bucket policy that restricts access to the VPC endpoint.

Answer

Enable 'Block public access' on the bucket.

Question 6

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which solution should be used?

Accepted Answer

Use AWS Firewall Manager to define security group policies and enforce them across accounts.. AWS Firewall Manager is the correct choice because it provides centralized management of security group rules across multiple accounts in an AWS Organization. It allows the security team to define a common security group policy and automatically enforce it across all member accounts, ensuring consistent security posture without manual intervention.

Answer

Use AWS Organizations Service Control Policies to restrict security group modifications.

Answer

Use AWS Config rules to automatically remediate non-compliant security groups.

Answer

Use AWS Network Firewall to inspect traffic and block unauthorized connections.

Question 7

A company is deploying a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances are in a private subnet. How should the security group for the EC2 instances be configured?

Accepted Answer

Allow inbound HTTP/HTTPS from the security group of the ALB.. The EC2 instances are in a private subnet and should only accept traffic from the ALB, not directly from the internet. By referencing the ALB's security group as the source, you ensure that only traffic that has passed through the ALB can reach the instances, maintaining a secure architecture. This follows the principle of least privilege and prevents bypassing the load balancer.

Answer

Allow inbound HTTP/HTTPS from the internet gateway.

Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0.

Answer

Allow inbound HTTP/HTTPS from the VPC CIDR.

Question 8

A security engineer is troubleshooting why an EC2 instance in a private subnet cannot access the internet through a NAT gateway. The route table for the private subnet has a default route pointing to the NAT gateway. The NAT gateway is in a public subnet with a route to an internet gateway. What is the most likely cause of the issue?

Accepted Answer

The NAT gateway does not have an Elastic IP address associated.. A NAT gateway requires an Elastic IP (EIP) address to function as a bridge between a private subnet and the internet. Without an EIP, the NAT gateway cannot perform source network address translation (SNAT) to map private IPs to a public IP, so outbound traffic from the EC2 instance fails even though the route table points to the NAT gateway and the NAT gateway is in a public subnet with an internet gateway route.

Answer

The EC2 instance's security group is blocking outbound traffic.

Answer

The NAT gateway's security group is blocking outbound traffic.

Answer

The NAT gateway does not have a route to the internet gateway in its route table.

Question 9

A company wants to securely store and manage SSL/TLS certificates for use with CloudFront. Which AWS service should be used?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like CloudFront. ACM integrates directly with CloudFront to automatically renew certificates before expiration, eliminating manual renewal overhead. It also handles the complex certificate chain and private key management securely, ensuring HTTPS termination at CloudFront edge locations.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Question 10

A company has a VPC with multiple subnets across multiple Availability Zones. The security team wants to inspect all traffic between subnets for malicious activity. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed stateful firewall service that can inspect all traffic between subnets within a VPC, including east-west traffic, for malicious activity. It provides deep packet inspection (DPI) at Layers 3–7, supporting Suricata-compatible rules to detect and block threats like malware or intrusion attempts. This makes it the correct choice for the security team's requirement to inspect inter-subnet traffic.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Security groups

Question 11

A security engineer is configuring a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which TWO security group configurations should be used? (Choose TWO.)

Accepted Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0 on the web tier security group.. The web tier must be accessible from the internet, and allowing inbound HTTP (port 80) and HTTPS (port 443) from 0.0.0.0/0 permits any internet client to reach the web servers. Option D is correct because the application tier must be accessible only from the web tier, and referencing the web tier security group as the source for HTTP/HTTPS traffic ensures that only instances in that security group can initiate connections to the application tier, implementing least-privilege access.

Answer

Allow inbound SSH from 0.0.0.0/0 on the web tier security group.

Answer

Allow inbound HTTP/HTTPS from the web tier security group on the database tier security group.

Answer

Allow inbound HTTP/HTTPS from the internet on the database tier security group.

Question 12

A company has an Amazon S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. However, users are still able to access the bucket from outside the VPC. Which THREE steps should the security engineer take to troubleshoot this issue? (Choose THREE.)

Accepted Answer

Check the VPC endpoint policy to ensure it allows the actions the users are performing.. The VPC endpoint policy acts as an additional access control layer. Even if the bucket policy correctly restricts access to the VPC endpoint, the endpoint policy must explicitly allow the actions (e.g., s3:GetObject) that users are performing. If the endpoint policy denies or does not include those actions, the request will fail at the endpoint level, but if it is too permissive, it can allow access from outside the intended VPC if the bucket policy condition is misconfigured. Checking the endpoint policy ensures that it does not inadvertently grant broader permissions than intended.

Answer

Verify that the security group associated with the VPC endpoint allows inbound traffic.

Answer

Ensure the VPC endpoint is in the same region as the S3 bucket.

Question 13

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. A user from IP address 203.0.113.10 tries to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because HTTP is used.. The bucket policy includes a condition that denies access when the request uses HTTP (aws:SecureTransport equals false). Even though the IP address 203.0.113.10 matches the allowed IP range in the policy, the explicit deny for HTTP requests overrides the allow. Since the user is using HTTP, the request is denied.

Answer

The request is allowed because the IP address matches the allow statement.

Answer

The request is denied because the IP is not in the allowed range.

Answer

The request is allowed because the user is using a valid IP.

Question 14

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to an S3 bucket. What does this policy allow?

Accepted Answer

Allows a role to describe, start, and stop EC2 instances in the account.. The policy allows a specified role (from the same account) to perform EC2 actions: DescribeInstances, StartInstances, and StopInstances. Even though the policy is attached to an S3 bucket, AWS resource-based policies can grant permissions to any service action, and the principal is a role ARN in the same account, enabling the role to manage EC2 instances.

Answer

Allows a role from another account to describe, start, and stop EC2 instances in the current account.

Answer

Allows all IAM users in the account to view EC2 instances.

Answer

Allows an IAM user to list and manage objects in the S3 bucket.

Question 15

A company wants to restrict access to an Amazon S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. To enforce that all objects uploaded to an S3 bucket use SSE-KMS, you should use the bucket policy condition key `s3:x-amz-server-side-encryption` and set its value to `aws:kms`. This ensures the encryption header is `aws:kms` without requiring a specific KMS key. The key `s3:x-amz-server-side-encryption-aws-kms-key-id` is used only when you need to require a particular KMS key ARN.

Answer

s3:x-amz-server-side-encryption-customer-key

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

kms:EncryptionContext