SCS-C02 Infrastructure Security Practice Test 22 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. Which method ensures that sensitive data, such as database passwords, is not exposed in the template or outputs?

Accepted Answer

Use a dynamic reference to a Systems Manager Parameter Store parameter.. Using a dynamic reference to an AWS Systems Manager Parameter Store parameter allows CloudFormation to retrieve the password at stack creation time without embedding it in the template or exposing it in outputs. The password is stored securely in Parameter Store, and CloudFormation resolves the reference dynamically, ensuring the sensitive value never appears in plaintext in the template, stack events, or outputs.

Answer

Use the 'NoEcho' property on the password parameter.

Answer

Store the password in the template outputs.

Answer

Hardcode the password in the template and use the 'NoEcho' property.

Question 2

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a default security group that allows all outbound traffic. The instance needs to download files from an S3 bucket in the same region. Which configuration allows this without internet access?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the private subnet's route table.. A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet. By adding a route to the private subnet's route table that points to the endpoint, traffic destined for S3 stays within the AWS network. The default security group's outbound rule permits all traffic, so no additional security group changes are needed.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet.

Answer

Create a NAT gateway in the public subnet and add a route to the private subnet's route table.

Question 3

A company is deploying a multi-tier web application across multiple Availability Zones. The application includes a web tier, application tier, and database tier. The security team requires that the web tier can communicate with the application tier only on port 8080, and the application tier can communicate with the database tier only on port 3306. Which security group configuration should be used?

Accepted Answer

In the application tier security group, allow inbound from the web tier security group on port 8080. In the database tier security group, allow inbound from the application tier security group on port 3306.. Referencing security groups as sources (security group referencing) is the AWS-recommended, least-privilege approach for tiered applications. The application tier SG allows inbound on 8080 only from the web tier SG, and the database tier SG allows inbound on 3306 only from the application tier SG. This ensures traffic is permitted based on the identity of the source instances, not on IP ranges, and it scales automatically as instances are added or removed.

Answer

In the database tier security group, allow inbound from the application tier's CIDR block on port 3306.

Answer

In the application tier security group, allow inbound from the web tier's CIDR block on port 8080.

Answer

In the web tier security group, allow outbound to 0.0.0.0/0 on port 8080.

Question 4

A company is designing a network architecture for a critical application that must be highly available and secure. Which TWO actions should be taken to ensure high availability of the network infrastructure?

Accepted Answer

Deploy resources across multiple Availability Zones.. Deploying resources across multiple Availability Zones (AZs) ensures that if one AZ experiences a failure (e.g., power outage, network disruption), the application can continue serving traffic from another AZ. This is the foundational principle of high availability in AWS, as each AZ is isolated but connected via low-latency links, allowing for fault tolerance without single points of failure.

Answer

Use a single internet gateway for the VPC.

Answer

Use a single Availability Zone for all resources to reduce complexity.

Answer

Place all instances in a public subnet for easy access.

Question 5

A security engineer needs to enable VPC Flow Logs to capture traffic metadata. Which THREE components are required to create a VPC Flow Log?

Accepted Answer

A CloudWatch Logs log group to publish the flow logs.. A CloudWatch Logs log group is required because VPC Flow Logs publish traffic metadata to CloudWatch Logs as the default destination. The flow logs are stored as log streams within the specified log group, enabling querying and monitoring via CloudWatch Logs Insights. Without a log group, there is no destination for the flow log records to be sent to.

Answer

An S3 bucket to store the flow logs.

Answer

An Amazon Kinesis Data Firehose delivery stream.

Question 6

A company is running a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application serves traffic on port 443. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic from the ALB security group on port 8080. The application works correctly. However, the security team wants to add an additional layer of defense by implementing a web application firewall (WAF) to block common web exploits. The team also wants to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) can access the application for administrative purposes on a separate path. The team has enabled AWS WAF on the ALB and associated a web ACL. They have also created a rule to allow traffic from the corporate IP range and block all other traffic. After deploying these changes, external users (not from corporate IP) cannot access the application at all. The company wants external users to be able to access the main application, but only corporate IPs should access the admin path. What should the security engineer do to fix the issue?

Accepted Answer

Modify the WAF rule to allow traffic from the corporate IP range on the admin path and allow all traffic on the main application path.. The correct action is to modify the WAF rule to allow traffic from corporate IPs on the admin path and allow all other traffic on the main application path. Currently, the WAF rule blocks all non-corporate traffic, which prevents external users from accessing the main application. By creating separate conditions for the admin path (corporate IPs only) and the main path (allow all), the security team can achieve the desired access control. Option A is incorrect because it would block external users at the security group level. Option B is unnecessary and adds complexity. Option C removes the WAF protection entirely. Therefore, option D is the correct solution.

Answer

Configure the security group of the ALB to allow only corporate IPs.

Answer

Create two separate ALBs, one for admin traffic and one for main traffic.

Answer

Remove the WAF rule that blocks all non-corporate traffic and rely on security groups.

Question 7

A company is designing a VPC for a three-tier web application that must be accessible from the internet only via HTTPS. The web servers must be able to initiate outbound connections to the internet for software updates, but the database servers must have no direct internet access. Which architecture meets these requirements?

Accepted Answer

Web servers in private subnets with a route to a NAT Gateway, database servers in private subnets with no route to the NAT Gateway, both behind an Application Load Balancer in public subnets. Web servers in private subnets behind an Application Load Balancer (ALB) in public subnets can receive internet traffic via the ALB, and they can initiate outbound internet connections via a NAT Gateway. Database servers in private subnets with no route to the NAT Gateway have no internet access, meeting the requirement. This architecture isolates the database tier while allowing web tier outbound updates.

Answer

Web servers in private subnets, database servers in public subnets, both behind an Application Load Balancer

Answer

Web servers in public subnets, database servers in private subnets with a route to a NAT Gateway in a public subnet

Answer

Web servers in public subnets with Elastic IPs, database servers in private subnets with a route to an internet gateway

Question 8

A security engineer is reviewing the following IAM policy attached to an S3 bucket: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

Accepted Answer

The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.. The bucket policy uses `"Principal": "*"` combined with `"Effect": "Allow"`, which explicitly grants public access to anyone who meets the condition. While the condition restricts access to the `10.0.0.0/8` IP range, the policy itself is still a public bucket policy — it allows any authenticated or unauthenticated user from that IP range to read objects. This violates the principle of least privilege and exposes sensitive data to any user on the corporate network, not just authorized IAM roles or users.

Answer

The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

Answer

The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

Answer

The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.

Question 9

A company uses AWS Systems Manager Session Manager to provide SSH access to EC2 instances without needing to open inbound ports. The security team wants to ensure that all session activity is logged and that only authorized users can start sessions. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable AWS CloudTrail to log StartSession API calls.. Option B is correct because Session Manager records session activity through the StartSession API, and enabling AWS CloudTrail captures those API calls for auditing who started sessions and when. Option D is correct because IAM policies scoping the ssm:StartSession action to specific users or roles enforce authorization, ensuring only approved principals can initiate sessions. Option A is incorrect because Session Manager does not rely on SSH key pairs; it uses the SSM Agent and IAM credentials, so requiring SSH keys does not meet the logging or authorization goal. Option C is incorrect because VPC Flow Logs capture IP traffic metadata, not the session-level activity or API authorization events the team needs. Option E is incorrect because Session Manager is designed to avoid inbound ports and security groups restricting inbound traffic to Session Manager endpoints is neither required nor how access control is enforced.

Answer

Configure the EC2 instances to require SSH key pairs for authentication.

Answer

Enable VPC Flow Logs to monitor network traffic.

Answer

Use security groups to restrict inbound traffic to the Session Manager endpoints.

Question 10

A security engineer is configuring a Network ACL for a public subnet that hosts a web server. The web server must accept HTTPS (TCP 443) traffic from the internet and respond. It must also be able to initiate outbound connections to the internet for software updates (HTTPS). What is the MINIMUM set of rules required for the inbound and outbound Network ACL?

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0 (for return traffic) and allow TCP 443 to 0.0.0.0/0 (for updates).. Network ACLs are stateless, meaning they require explicit rules for both inbound and outbound traffic. For the web server to accept HTTPS requests from the internet, an inbound rule allowing TCP 443 from 0.0.0.0/0 is needed. For the server to respond to those requests, an outbound rule allowing ephemeral ports (TCP 1024-65535) to 0.0.0.0/0 is required to handle return traffic. Additionally, to allow the server to initiate outbound HTTPS connections for software updates, a separate outbound rule allowing TCP 443 to 0.0.0.0/0 is necessary.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0 and TCP 22 from a management IP; Outbound: allow all traffic to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to a specific software update server IP.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow all traffic to 0.0.0.0/0.

Question 11

A company has a security group rule that allows inbound traffic from 0.0.0.0/0 on port 22. The security engineer wants to restrict SSH access to only the company's public IP range (203.0.113.0/24). What is the correct way to update the security group rule?

Accepted Answer

Modify the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.. Modifying the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24 directly restricts SSH access to the company's public IP range. Security groups are stateful and allow you to edit rules in place, so this is the simplest and most accurate method.

Answer

Remove the existing inbound rule and do not add any new rule; SSH access will be denied by default.

Answer

Add a new inbound rule with source 203.0.113.0/24 and the security group will automatically deny all other traffic.

Answer

Change the outbound rules to restrict traffic.

Question 12

A company uses an AWS Network Firewall to inspect traffic between subnets in a VPC. The security team wants to ensure that all traffic from the web tier to the database tier passes through the firewall. The web servers are in subnet A, and the database servers are in subnet B. What routing configuration is required?

Accepted Answer

Add a route in the route table for subnet A with destination subnet B CIDR and target the firewall endpoint. Add a similar route in subnet B's route table with destination subnet A CIDR and target the firewall endpoint.. AWS Network Firewall is a stateful, managed firewall that inspects traffic only when that traffic is explicitly routed to its firewall endpoint. To inspect east-west traffic between subnet A (web tier) and subnet B (database tier), both directions must be routed through the firewall endpoint. This means adding a route in subnet A's route table for the destination subnet B CIDR pointing to the firewall endpoint, and a reciprocal route in subnet B's route table for the destination subnet A CIDR pointing to the firewall endpoint. This ensures that traffic from A to B and B to A is symmetrically inspected, which is required for stateful inspection to work correctly.

Answer

Add a route in the route table associated with subnet A that sends all traffic to the firewall endpoint.

Answer

Add a route in the route table associated with subnet B that sends all traffic to the firewall endpoint.

Answer

Associate both subnets with the same route table and add a route to the firewall endpoint for all traffic.

Question 13

A company has an Amazon RDS for MySQL database in a private subnet. The security team wants to ensure that only an application server in the same VPC can connect to the database. Which security group configuration should be used?

Accepted Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the security group ID of the application server.. Referencing the application server's security group ID as the source in the inbound rule for MySQL (port 3306) on the RDS security group allows traffic only from instances that are members of that security group, regardless of their IP addresses. This is the most secure and precise method, as it automatically adapts to changes in the application server's IP (e.g., after scaling or replacement) and avoids opening the database to the entire subnet or VPC CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the VPC's CIDR.

Answer

Inbound rule on the RDS security group: allow MySQL on port 3306 from the subnet CIDR of the application server.

Answer

Inbound rule on the application server's security group: allow outbound MySQL to the RDS security group.

Question 14

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The security team wants to receive real-time notifications when a DDoS attack is detected. Which configuration should be used?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an Amazon SNS notification when a Shield Advanced event occurs.. AWS Shield Advanced integrates with Amazon CloudWatch Events (now Amazon EventBridge) to emit events when DDoS attacks are detected. The standard pattern is to create an EventBridge rule that matches Shield Advanced events and triggers a Lambda function, which then publishes to an SNS topic for real-time notification. This is the documented, supported mechanism for proactive DDoS alerting.

Answer

Enable VPC Flow Logs and create a CloudWatch alarm for high traffic volume.

Answer

Subscribe an SNS topic to Shield Advanced notifications directly.

Answer

Enable AWS CloudTrail and create a metric filter for DDoS events.

Question 15

A company uses Amazon CloudFront to distribute content from an S3 bucket. The security team wants to ensure that only CloudFront can access the S3 bucket. Which configuration should be used?

Accepted Answer

Create an Origin Access Identity (OAI) and grant it read access to the S3 bucket.. An Origin Access Identity (OAI) is a special CloudFront user that you can associate with a distribution, and then the S3 bucket policy can grant read access to that OAI, ensuring that only CloudFront can access the bucket. Option A is incorrect because allowing all principals is too permissive. Option B is incorrect because CloudFront IP addresses can change, so this is not a reliable method. Option D is incorrect because trusted signers are used for signed URLs/cookies to control who can access content, not to restrict origin access.

Answer

Set the bucket policy to allow all principals and rely on CloudFront to restrict access.

Answer

Configure the bucket policy to allow access only from CloudFront's IP addresses.

Answer

Use CloudFront trusted signers to restrict access to the S3 bucket.