SCS-C02 Infrastructure Security Practice Test 20 — 15 Questions

Question 1

An organization has a VPC with public and private subnets. A NAT Gateway is deployed in a public subnet to allow instances in private subnets to access the internet. The security team notices that instances in a private subnet can reach the internet, but cannot initiate connections to an on-premises network connected via AWS Direct Connect. The on-premises network advertises a specific route. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The private subnet route table has a route for the on-premises CIDR pointing to the NAT Gateway.. The most likely cause is that the private subnet's route table has a route for the on-premises CIDR pointing to the NAT Gateway instead of the Direct Connect virtual private gateway (VGW) or transit gateway. A NAT Gateway only translates traffic to the internet — it cannot forward traffic to on-premises networks, so the route is misdirected and the connection fails.

Answer

The security group assigned to the instances does not allow outbound traffic to the on-premises network.

Answer

The network ACL on the private subnet is blocking inbound traffic from the on-premises network.

Answer

The internet gateway is not attached to the VPC.

Question 2

A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?

Accepted Answer

Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.. Security groups can reference other security groups as sources in inbound rules, allowing granular traffic control between tiers without CIDR blocks. This approach allows the web tier security group to allow inbound from the internet, the app tier security group to allow inbound only from the web tier security group, and the database tier security group to allow inbound only from the app tier security group. Option B is incorrect because IAM policies control user permissions, not network traffic. Option C is incorrect because network ACLs with CIDR blocks are less specific and do not scale well, and placing tiers in separate subnets is not necessary. Option D is incorrect because placing all instances in public subnets unnecessarily exposes them to the internet, increasing security risk.

Answer

Use a single security group for all instances and use IAM policies to restrict access.

Answer

Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.

Answer

Place all instances in public subnets and restrict access using security groups.

Question 3

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize costs and avoid NAT Gateway or NAT Instance charges. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and configure the instance to download patches from S3.. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 over the AWS network without traversing the internet, avoiding NAT Gateway or NAT Instance charges. The patches can be stored in an S3 bucket and downloaded by the EC2 instance using the endpoint, which uses AWS PrivateLink and does not require an internet gateway or public IP.

Answer

Deploy a proxy instance in a public subnet and configure the private instance to use the proxy.

Answer

Use an egress-only internet gateway for the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table pointing to the internet gateway.

Question 4

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Accepted Answer

Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.. Option A is correct because placing the RDS for MySQL instance in a private subnet removes it from direct internet reachability, and restricting inbound traffic to only the application's security group enforces least-privilege network access at the database port (3306 for MySQL). Option E is correct because enabling encryption at rest with AWS KMS protects the underlying storage, automated backups, read replicas, and snapshots, so data cannot be read if the storage media is compromised. Option B is incorrect because disabling automated backups reduces recoverability and does not improve security. Option C is incorrect because Multi-AZ is a high-availability/fault-tolerance feature, not a security control. Option D is incorrect because assigning a public IP address exposes the database to the internet and increases the attack surface.

Answer

Disable automated backups to reduce storage costs.

Answer

Enable Multi-AZ deployment for fault tolerance.

Answer

Assign a public IP address to the RDS instance for easier access from the internet.

Question 5

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC Endpoint are allowed. Which policy element should be used in the bucket policy?

Accepted Answer

aws:SourceVpce. The aws:SourceVpce condition key is the correct choice because it specifically evaluates the VPC endpoint ID (e.g., vpce-12345678) that the request traversed to reach S3. When you attach a bucket policy that denies all traffic except requests originating from a particular VPC endpoint, you use a Condition block with StringEquals on aws:SourceVpce to match that endpoint ID. This is the only key that directly identifies the endpoint itself, making it the precise tool for restricting access to a specific VPC endpoint.

Answer

aws:SourceVpc

Answer

aws:VpcSourceIp

Answer

aws:SourceIp

Question 6

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. Which AWS service should be used to allow this without assigning a public IP address to the instance?

Accepted Answer

NAT Gateway. A NAT Gateway is the correct service because it allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download patches) while remaining unreachable from the internet and without needing a public IP. The NAT Gateway resides in a public subnet, has an Elastic IP, and performs source NAT (SNAT) on traffic from the private subnet, translating the private source IP to its own public IP. This satisfies the requirement of outbound-only internet access without exposing the instance.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

VPN Connection

Question 7

A company is designing a hybrid cloud architecture with an AWS Direct Connect connection. The company wants to ensure that traffic to and from the VPC goes through the Direct Connect connection and not over the internet. Which configuration should be used?

Accepted Answer

Attach a Virtual Private Gateway to the VPC and update the route tables to point to the Direct Connect virtual interface.. A Virtual Private Gateway (VGW) is the AWS-side anchor for an AWS Direct Connect private virtual interface (VIF). By attaching the VGW to the VPC and updating the VPC route tables to point the destination CIDR (e.g., the on-premises network) to the Direct Connect VIF, all traffic between the VPC and the on-premises network is forced through the Direct Connect link, bypassing the internet entirely.

Answer

Create a VPC Endpoint for each AWS service.

Answer

Set up a VPN connection over the internet as a backup.

Answer

Configure the Direct Connect connection and assign public IPs to instances.

Question 8

A company wants to block traffic from a specific IP address range from accessing an Application Load Balancer (ALB). Which AWS feature should be used?

Accepted Answer

AWS WAF. AWS WAF is the correct feature to block traffic from a specific IP address range from accessing an Application Load Balancer. WAF integrates directly with ALB and allows you to create rules based on IP addresses, which can be used to allow or block requests. Network ACLs and security groups operate at the network layer and are not specific to ALB traffic inspection.

Answer

Network ACL

Answer

Security Group for the ALB

Answer

Route53

Question 9

A company is running a critical application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB reaches the EC2 instances. How can this be achieved?

Accepted Answer

Reference the ALB's security group in the EC2 security group inbound rule.. You can reference the ALB's security group as the source in the EC2 instance's security group inbound rule. This allows traffic only from the ALB, regardless of the ALB's IP addresses (which can change if the ALB scales). The security group reference is resolved dynamically by AWS, ensuring that only traffic originating from the ALB's elastic network interfaces (ENIs) is permitted.

Answer

Use the ALB's private IP address in the EC2 security group.

Answer

Configure a Network ACL to allow only the ALB's subnet.

Answer

Use the ALB's public IP address in the EC2 security group.

Question 10

A company wants to ensure that all data sent to an S3 bucket is encrypted in transit. Which policy statement should be added to the bucket policy?

Accepted Answer

Deny if aws:SecureTransport is false. Deny if aws:SecureTransport is false. The aws:SecureTransport condition key evaluates to true when the request is made over HTTPS (TLS) and false when made over HTTP. To enforce encryption in transit, you must explicitly deny requests where aws:SecureTransport is false, ensuring that any unencrypted HTTP request is rejected. This is the standard pattern for S3 bucket policies to enforce TLS-only access.

Answer

Allow if aws:SecureTransport is false

Answer

Deny unless aws:SecureTransport is false

Answer

Allow if aws:SecureTransport is true

Question 11

A company is designing a new AWS account structure using AWS Organizations. The security team wants to restrict the use of specific AWS services across all member accounts. Which feature should they use?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are the correct feature because they allow you to centrally restrict which AWS services and actions are permitted across all member accounts in an AWS Organization. SCPs act as a permission guardrail that applies to all IAM users, roles, and root users within the affected accounts, enabling the security team to enforce service restrictions without modifying individual account configurations.

Answer

AWS Single Sign-On (SSO)

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM) cross-account roles

Question 12

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests and block malicious traffic based on customizable rules. This makes it the correct choice for the security team's requirement.

Answer

AWS Network Firewall

Answer

AWS Firewall Manager

Answer

AWS Shield Advanced

Question 13

A company has a VPC with a public subnet and a private subnet. An Amazon RDS instance is in the private subnet, and an application server is in the public subnet. The security team needs to allow the application server to connect to the RDS instance on port 3306 (MySQL). Which configuration will meet this requirement securely?

Accepted Answer

Add an inbound rule to the RDS security group that allows traffic from the security group of the application server on port 3306.. It uses a security group reference as the source in the inbound rule for the RDS security group. This allows traffic only from the specific application server(s) associated with that security group, regardless of their IP addresses, and automatically scales if the application server is replaced or scaled. This is the most secure and AWS-recommended method for controlling traffic between resources within a VPC.

Answer

Add an inbound rule to the RDS security group that allows traffic from the VPC CIDR on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from the subnet CIDR of the application server on port 3306.

Answer

Add an inbound rule to the RDS security group that allows traffic from 0.0.0.0/0 on port 3306.

Question 14

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that log files are not modified after they are created. Which feature should they enable?

Accepted Answer

Log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and RSA digital signatures to create digest files that let you verify log files have not been altered or deleted after delivery. It is the native CloudTrail feature designed specifically for tamper detection.

Answer

Server-side encryption with AWS KMS

Answer

S3 Object Lock

Answer

CloudWatch Logs integration

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is designed to centrally manage security policies across all accounts in an AWS Organization, including VPC security group rules. It allows you to define a security group policy that automatically applies to existing and new resources, ensuring consistent enforcement across the organization. This is the only service among the options that provides centralized, cross-account management of security groups.

Answer

AWS Network Firewall

Answer

AWS Config

Answer

Amazon Route 53 Resolver DNS Firewall