SCS-C02 Infrastructure Security Practice Test 21 — 15 Questions

Question 1

A company has an Amazon RDS for MySQL database in a private subnet. The security team wants to ensure that only an application server in the same VPC can connect to the database. Which security group configuration should be used?

Accepted Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the security group ID of the application server.. Option C is correct because referencing the application server's security group ID as the source in the inbound rule for MySQL (port 3306) on the RDS security group allows traffic only from instances that are members of that security group, regardless of their IP addresses. This is the most secure and precise method, as it automatically adapts to changes in the application server's IP (e.g., after scaling or replacement) and avoids opening the database to the entire subnet or VPC CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the VPC's CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the subnet CIDR of the application server.

Answer

Inbound rule on the application server's security group: allow outbound MySQL to the RDS security group.

Question 2

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The security team wants to receive real-time notifications when a DDoS attack is detected. Which configuration should be used?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an Amazon SNS notification when a Shield Advanced event occurs.. Option B is correct because Shield Advanced sends events to CloudWatch Events, which can trigger a Lambda function to send notifications. Option A is wrong because CloudTrail does not capture DDoS events. Option C is wrong because VPC Flow Logs are for network traffic, not DDoS events. Option D is wrong because Shield Advanced does not directly integrate with SNS; it uses CloudWatch Events.

Answer

Enable VPC Flow Logs and create a CloudWatch alarm for high traffic volume.

Answer

Subscribe an SNS topic to Shield Advanced notifications directly.

Answer

Enable AWS CloudTrail and create a metric filter for DDoS events.

Question 3

A company has an S3 bucket that stores sensitive data. The security team wants to ensure that all objects in the bucket are encrypted at rest. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Use an SCP to deny the s3:PutObject action unless the request includes the x-amz-server-side-encryption header.. Option B and D are correct. Enabling default encryption ensures new objects are encrypted. Using SCPs can enforce that objects are encrypted. Option A is wrong because bucket policies cannot directly enforce encryption at rest; they can only require it via conditions but not prevent uploads without encryption if the user has permissions. Option C is wrong because CloudTrail does not enforce encryption. Option E is wrong because KMS keys do not automatically encrypt objects.

Answer

Use AWS KMS to create a customer master key and assign it to the bucket.

Answer

Enable AWS CloudTrail to log S3 API calls.

Answer

Add a bucket policy that denies s3:PutObject if the object is not encrypted.

Question 4

A company uses Amazon CloudFront to distribute content from an S3 bucket. The security team wants to ensure that only CloudFront can access the S3 bucket. Which configuration should be used?

Accepted Answer

Create an Origin Access Identity (OAI) and grant it read access to the S3 bucket.. Option A is correct because an Origin Access Identity (OAI) allows CloudFront to access S3. Option B is wrong because a bucket policy allowing CloudFront's IPs is not recommended as IPs can change. Option C is wrong because trusted signers are for signed URLs, not for origin access. Option D is wrong because a bucket policy allowing all principals is too permissive.

Answer

Set the bucket policy to allow all principals and rely on CloudFront to restrict access.

Answer

Configure the bucket policy to allow access only from CloudFront's IP addresses.

Answer

Use CloudFront trusted signers to restrict access to the S3 bucket.

Question 5

A company has an EC2 instance that needs to access an S3 bucket. The security team wants to use the principle of least privilege. Which method should be used to grant access?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. Option D is correct because an IAM role assigned to the EC2 instance is the best practice. Option A is wrong because access keys stored on the instance are less secure. Option B is wrong because a bucket policy with a principal of the instance ID is not possible; bucket policies use IAM principals. Option C is wrong because security groups do not grant access to S3.

Answer

Use a security group to allow outbound traffic to S3.

Answer

Store AWS access keys on the instance and use them in the application.

Answer

Create a bucket policy that grants access to the EC2 instance ID.

Question 6

A company uses AWS WAF to protect its web application from common web exploits. The security team wants to block requests that contain SQL injection or cross-site scripting (XSS) in the query string. Which rule type should be used?

Accepted Answer

Managed rule group for SQL injection and XSS. Option B is correct because AWS WAF has managed rule groups for SQL injection and XSS. Option A is wrong because rate-based rules are for rate limiting. Option C is wrong because geographic rules are for location-based blocking. Option D is wrong because regex patterns are custom, but managed rules are more comprehensive.

Answer

Custom regex pattern set

Answer

Rate-based rule

Answer

Geographic match rule

Question 7

A company wants to restrict access to an S3 bucket so that only objects uploaded with server-side encryption using AWS KMS are allowed. The bucket policy uses the 's3:x-amz-server-side-encryption' condition key. However, users can still upload unencrypted objects. What is the most likely reason?

Accepted Answer

The bucket policy uses an Allow effect instead of Deny for the condition.. Option C is correct because the condition key 's3:x-amz-server-side-encryption' must be combined with a Deny effect to block unencrypted uploads. Option A is wrong because the condition key is set to 'aws:kms', which is correct. Option B is wrong because the bucket policy does not need to explicitly deny the s3:PutObject action; a Deny with the condition works. Option D is wrong because the bucket policy is evaluated before the user policy.

Answer

The user's IAM policy overrides the bucket policy.

Answer

The condition key is misspelled.

Answer

The bucket policy does not explicitly deny s3:PutObject.

Question 8

A security engineer needs to ensure that all traffic to an EC2 instance in a VPC is inspected by a network firewall appliance. The firewall is deployed in a separate subnet. What is the MOST secure and scalable way to route traffic through the firewall?

Accepted Answer

Use a Gateway Load Balancer with a Gateway Load Balancer endpoint in each subnet.. Option B is correct because a Gateway Load Balancer with a Gateway Load Balancer endpoint in each subnet allows scaling and transparent inspection. Option A is wrong because a NAT gateway only handles outbound traffic. Option C is wrong because an ALB is for load balancing at layer 7, not for traffic inspection routing. Option D is wrong because a transit gateway is for connecting VPCs, not for routing traffic through a firewall.

Answer

Configure a NAT gateway in the firewall subnet and route all traffic through it.

Answer

Use an Application Load Balancer in front of the firewall.

Answer

Create a transit gateway and route traffic through the firewall subnet.

Question 9

A company uses AWS Shield Advanced to protect its web application against DDoS attacks. The application is behind an Application Load Balancer (ALB) with a web application firewall (AWS WAF) in front. The security team notices that some requests are being blocked by AWS WAF, but the source IP addresses are legitimate customers. What step should the team take to minimize false positives?

Accepted Answer

Implement rate-based rules with a count action and use the count data to create custom rules.. Option D is correct because rate-based rules allow legitimate traffic while limiting excessive requests. Option A is wrong because increasing the threshold may allow more attacks. Option B is wrong because using AWS Managed Rules for IP reputation could block legitimate IPs. Option C is wrong because reconfiguring the ALB idle timeout does not affect WAF blocking.

Answer

Switch to using AWS Managed Rules for IP reputation lists.

Answer

Increase the WAF rate-based rule threshold to allow more requests.

Answer

Reconfigure the ALB idle timeout to a higher value.

Question 10

A company wants to securely store secrets used by an application running on EC2 instances. The secrets include database credentials and API keys. What is the MOST secure and manageable approach?

Accepted Answer

Use AWS Secrets Manager and attach an IAM role to the EC2 instance with permission to access the secrets.. Option A is correct because AWS Secrets Manager integrates with IAM roles for access and can rotate secrets. Option B is wrong because storing secrets in the instance metadata is insecure. Option C is wrong because parameter store with encrypt parameter is secure but has fewer features than Secrets Manager. Option D is wrong because embedding in code is not secure.

Answer

Store the secrets in the EC2 instance user data and retrieve them from the metadata service.

Answer

Embed the secrets in the application code and encrypt the code with a KMS key.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter and reference it in the application code.

Question 11

A security engineer is configuring a VPC with public and private subnets. The engineer needs to allow instances in the private subnet to download software updates from the internet. Which component should be added to the VPC?

Accepted Answer

NAT gateway in a public subnet.. Option A is correct because a NAT gateway allows outbound internet access from private subnets. Option B is wrong because a bastion host is for SSH/RDP access, not internet access. Option C is wrong because a VPC endpoint is for private access to AWS services. Option D is wrong because a VPN connection is for hybrid networking.

Answer

VPN connection to on-premises.

Answer

VPC endpoint for Amazon S3.

Answer

Bastion host in a public subnet.

Question 12

A company runs a containerized application on Amazon ECS with Fargate. The security team wants to ensure that the containers can only communicate with specific external APIs and not with other containers in the same task. Which security control should be applied?

Accepted Answer

Attach a security group to the ECS task with outbound rules allowing only the specific API endpoints.. Option D is correct because security groups for ECS tasks in awsvpc mode can control inbound/outbound traffic. Option A is wrong because IAM policies control API calls, not network traffic. Option B is wrong because network ACLs are stateless and applied at subnet level, not per task. Option C is wrong because VPC endpoints are for accessing AWS services, not for container communication.

Answer

Configure network ACLs on the subnets where the tasks run.

Answer

Apply an IAM policy to the task execution role to restrict API calls.

Answer

Use VPC endpoints to restrict traffic to specific APIs.

Question 13

A company wants to automate security assessments of its AWS environment. Which TWO AWS services can be used to perform vulnerability scanning and compliance checks?

Accepted Answer

Amazon Inspector. Option A (Amazon Inspector) is correct for vulnerability scanning. Option D (AWS Security Hub) is correct for compliance checks. Option B (AWS Config) tracks resource changes but does not scan vulnerabilities. Option C (AWS Shield) is for DDoS protection. Option E (AWS WAF) is for web application firewall.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config

Question 14

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Accepted Answer

AWS Firewall Manager. Option B (AWS Network Firewall) is correct for centrally managing firewall rules. Option D (AWS Firewall Manager) is correct for centrally managing firewall policies across accounts. Option A (Amazon GuardDuty) is threat detection. Option C (AWS WAF) is web application firewall but not for network-level security. Option E (VPC Peering) is a connectivity option, not a management service.

Answer

VPC Peering

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 15

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Accepted Answer

Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.. Option A (Enable S3 object-level logging) is not required for access control. Option B (Create a bucket policy with a condition based on s3:ExistingObjectTag) is correct. Option C (Attach an IAM policy to the role with condition) is correct. Option D (Set S3 bucket policy to deny untagged objects) is correct. Option E (Use S3 inventory) is for reporting, not access control.

Answer

Use S3 Inventory to list objects and their tags.

Answer

Enable S3 object-level logging in CloudTrail.