SCS-C02 Infrastructure Security Practice Test 20 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a default security group that allows all outbound traffic. The instance needs to download files from an S3 bucket in the same region. Which configuration allows this without internet access?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the private subnet's route table.. A VPC gateway endpoint for S3 allows private instances to access S3 without internet. Option C is correct. NAT gateway (A) would require internet. Internet gateway (B) would expose instance. Direct Connect (D) is for on-premises.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet.

Answer

Create a NAT gateway in the public subnet and add a route to the private subnet's route table.

Question 2

A company is deploying a multi-tier web application across multiple Availability Zones. The application includes a web tier, application tier, and database tier. The security team requires that the web tier can communicate with the application tier only on port 8080, and the application tier can communicate with the database tier only on port 3306. Which security group configuration should be used?

Accepted Answer

In the application tier security group, allow inbound from the web tier security group on port 8080. In the database tier security group, allow inbound from the application tier security group on port 3306.. Using security group IDs as sources in rules allows traffic only from specific resources. Option D is correct. CIDR blocks (A, B) are less specific. Ephemeral ports (C) are not needed for ingress rules.

Answer

In the database tier security group, allow inbound from the application tier's CIDR block on port 3306.

Answer

In the application tier security group, allow inbound from the web tier's CIDR block on port 8080.

Answer

In the web tier security group, allow outbound to 0.0.0.0/0 on port 8080.

Question 3

A company is designing a network architecture for a critical application that must be highly available and secure. Which TWO actions should be taken to ensure high availability of the network infrastructure?

Accepted Answer

Deploy resources across multiple Availability Zones.. Deploying resources across multiple Availability Zones (A) and using Elastic IP addresses for failover (C) improve availability. Option A and C are correct. Single AZ (B) is not high availability. Internet gateway (D) is a single point of failure if not redundant. Public subnet (E) doesn't guarantee availability.

Answer

Use a single internet gateway for the VPC.

Answer

Use a single Availability Zone for all resources to reduce complexity.

Answer

Place all instances in a public subnet for easy access.

Question 4

A security engineer needs to enable VPC Flow Logs to capture traffic metadata. Which THREE components are required to create a VPC Flow Log?

Accepted Answer

A CloudWatch Logs log group to publish the flow logs.. A CloudWatch Logs log group is required because VPC Flow Logs publish traffic metadata to CloudWatch Logs as the default destination. The flow logs are stored as log streams within the specified log group, enabling querying and monitoring via CloudWatch Logs Insights. Without a log group, there is no destination for the flow log records to be sent to.

Answer

An S3 bucket to store the flow logs.

Answer

An Amazon Kinesis Data Firehose delivery stream.

Question 5

Which TWO actions can help protect against DDoS attacks at the network layer?

Accepted Answer

Use AWS WAF to filter malicious requests.. AWS Shield Advanced (A) provides DDoS protection, and using AWS WAF (B) helps filter malicious traffic. Option A and B are correct. Security groups (C) are stateful firewalls, not DDoS protection. NACLs (D) are stateless firewalls. VPC peering (E) is for connectivity.

Answer

Configure security groups to restrict inbound traffic.

Answer

Configure network ACLs to deny all inbound traffic.

Answer

Use VPC peering to distribute traffic.

Question 6

A company is running a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application serves traffic on port 443. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic from the ALB security group on port 8080. The application works correctly. However, the security team wants to add an additional layer of defense by implementing a web application firewall (WAF) to block common web exploits. The team also wants to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) can access the application for administrative purposes on a separate path. The team has enabled AWS WAF on the ALB and associated a web ACL. They have also created a rule to allow traffic from the corporate IP range and block all other traffic. After deploying these changes, external users (not from corporate IP) cannot access the application at all. The company wants external users to be able to access the main application, but only corporate IPs should access the admin path. What should the security engineer do to fix the issue?

Accepted Answer

Modify the WAF rule to allow traffic from the corporate IP range on the admin path and allow all traffic on the main application path.. The correct action is to create a WAF rule that allows traffic from corporate IPs on the admin path and allows all other traffic on the main path, instead of blocking all non-corporate traffic. Option A is correct. Option B would allow all traffic, defeating the purpose. Option C is too permissive. Option D doesn't address the WAF issue.

Answer

Configure the security group of the ALB to allow only corporate IPs.

Answer

Create two separate ALBs, one for admin traffic and one for main traffic.

Answer

Remove the WAF rule that blocks all non-corporate traffic and rely on security groups.

Question 7

A company is designing a VPC for a three-tier web application that must be accessible from the internet only via HTTPS. The web servers must be able to initiate outbound connections to the internet for software updates, but the database servers must have no direct internet access. Which architecture meets these requirements?

Accepted Answer

Web servers in private subnets with a route to a NAT Gateway, database servers in private subnets with no route to the NAT Gateway, both behind an Application Load Balancer in public subnets. Option D is correct because it uses a public subnet for the NAT Gateway and the ALB, private subnets for web servers (with a route to NAT for outbound) and database servers (no route to NAT). Option A is wrong because it gives database servers a route to NAT. Option B is wrong because it places web servers in public subnets with direct internet access, which is less secure. Option C is wrong because it places database servers in public subnets.

Answer

Web servers in private subnets, database servers in public subnets, both behind an Application Load Balancer

Answer

Web servers in public subnets, database servers in private subnets with a route to a NAT Gateway in a public subnet

Answer

Web servers in public subnets with Elastic IPs, database servers in private subnets with a route to an internet gateway

Question 8

A security engineer is reviewing the following IAM policy attached to an S3 bucket: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

Accepted Answer

The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.. Option B is correct because the policy allows anonymous access; any user from the specified IP range can access objects. Option A is wrong because the condition does restrict by IP. Option C is wrong because the bucket policy does not block public access if the bucket policy explicitly allows it. Option D is wrong because the policy does not open the entire bucket; it only allows GetObject.

Answer

The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

Answer

The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

Answer

The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.

Question 9

A company uses AWS Systems Manager Session Manager to provide SSH access to EC2 instances without needing to open inbound ports. The security team wants to ensure that all session activity is logged and that only authorized users can start sessions. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable AWS CloudTrail to log StartSession API calls.. Option A and D are correct. Enabling CloudTrail logging captures API calls like StartSession. Using IAM policies with conditions to allow specific users is the standard way to control access. Option B is not needed because Session Manager doesn't require SSH keys. Option C is not the primary method; IAM policies are used. Option E is unrelated.

Answer

Configure the EC2 instances to require SSH key pairs for authentication.

Answer

Enable VPC Flow Logs to monitor network traffic.

Answer

Use security groups to restrict inbound traffic to the Session Manager endpoints.

Question 10

A security engineer is configuring a Network ACL for a public subnet that hosts a web server. The web server must accept HTTPS (TCP 443) traffic from the internet and respond. It must also be able to initiate outbound connections to the internet for software updates (HTTPS). What is the MINIMUM set of rules required for the inbound and outbound Network ACL?

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0 (for return traffic) and allow TCP 443 to 0.0.0.0/0 (for updates).. Option A is correct because inbound allows HTTPS from anywhere (0.0.0.0/0) and outbound allows ephemeral ports for return traffic and destination 0.0.0.0/0 for the outbound updates. Option B is wrong because it allows all inbound traffic. Option C is wrong because it allows all outbound traffic, which is not minimal but acceptable, but it also allows inbound SSH, which is not needed. Option D is wrong because it restricts outbound to only the update server, which may be too restrictive.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0 and TCP 22 from a management IP; Outbound: allow all traffic to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to a specific software update server IP.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow all traffic to 0.0.0.0/0.

Question 11

A company uses AWS PrivateLink to connect to a SaaS provider's VPC endpoint service. The security team wants to ensure that traffic between the company's VPC and the SaaS provider's VPC is encrypted in transit and that no other AWS service can access the data. Which configuration meets these requirements?

Accepted Answer

Use an AWS PrivateLink endpoint (interface endpoint) in the company's VPC to connect to the SaaS provider's VPC endpoint service.. Option C is correct because PrivateLink uses AWS PrivateLink endpoints, which encrypt traffic within AWS and are isolated. Option A is wrong because VPC peering does not encrypt traffic by default. Option B is wrong because VPN is not needed. Option D is wrong because Transit Gateway is for routing, not encryption.

Answer

Use a Site-to-Site VPN connection between the VPC and the SaaS provider's on-premises network.

Answer

Create a VPC peering connection and use security groups to restrict traffic.

Answer

Use an AWS Transit Gateway with inter-region peering.

Question 12

A company has a security group rule that allows inbound traffic from 0.0.0.0/0 on port 22. The security engineer wants to restrict SSH access to only the company's public IP range (203.0.113.0/24). What is the correct way to update the security group rule?

Accepted Answer

Modify the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Option A is correct because you can modify the CIDR of an existing rule. Option B is wrong because security groups don't have a default deny rule; you need to remove the old rule. Option C is wrong because security groups are stateful. Option D is wrong because removing the rule without adding a new one would block all SSH.

Answer

Remove the existing inbound rule and do not add any new rule; SSH access will be denied by default.

Answer

Add a new inbound rule with source 203.0.113.0/24 and the security group will automatically deny all other traffic.

Answer

Change the outbound rules to restrict traffic.

Question 13

A company uses an AWS Network Firewall to inspect traffic between subnets in a VPC. The security team wants to ensure that all traffic from the web tier to the database tier passes through the firewall. The web servers are in subnet A, and the database servers are in subnet B. What routing configuration is required?

Accepted Answer

Add a route in the route table for subnet A with destination subnet B CIDR and target the firewall endpoint. Add a similar route in subnet B's route table with destination subnet A CIDR and target the firewall endpoint.. Option C is correct because you need a route table for subnet A that sends traffic destined for subnet B to the firewall endpoint, and a route table for subnet B that sends return traffic to the firewall. Options A and B are wrong because they don't route return traffic properly. Option D is wrong because you need two route tables.

Answer

Add a route in the route table associated with subnet A that sends all traffic to the firewall endpoint.

Answer

Add a route in the route table associated with subnet B that sends all traffic to the firewall endpoint.

Answer

Associate both subnets with the same route table and add a route to the firewall endpoint for all traffic.

Question 14

A company has a VPC with multiple subnets and uses VPC Flow Logs to capture network traffic. The security team notices that some expected traffic is not appearing in the logs. What is a likely cause?

Accepted Answer

The traffic is to or from the Amazon DNS server (169.254.169.253).. Option B is correct because Flow Logs do not capture traffic to the Amazon DNS server (unless you specifically enable that). Option A is wrong because Flow Logs can be published to CloudWatch Logs. Option C is wrong because Flow Logs capture accepted traffic even if it is rejected later. Option D is wrong because Flow Logs capture all IP traffic, not just TCP.

Answer

Flow Logs are published to an S3 bucket instead of CloudWatch Logs.

Answer

The traffic uses UDP protocol.

Answer

The traffic is blocked by a security group rule.

Question 15

A company wants to provide its developers with IAM roles that allow them to launch EC2 instances with specific security groups. The security team wants to ensure that developers cannot launch instances without a security group. How can this be enforced?

Accepted Answer

Add a condition in the IAM policy that requires the ec2:SecurityGroup parameter to have a specific value.. Option C is correct because you can use a condition in the IAM policy to require the security group. Option A is wrong because default security group is always attached if none specified, so that doesn't enforce. Option B is wrong because that is the default behavior, but developers can still launch without specifying a security group. Option D is wrong because that would allow any security group.

Answer

Create a service control policy that allows only the use of specific security groups.

Answer

Use an SCP to deny launching instances without a security group.

Answer

Configure the VPC to have no default security group.