SCS-C02 Infrastructure Security Practice Test 22 — 15 Questions

Question 1

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.. To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose. Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.

Answer

Deploy an HTTP forward proxy in the public subnet.

Answer

Set up a transit gateway and attach the VPC to it.

Answer

Create a gateway endpoint for Amazon S3.

Question 2

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Accepted Answer

AWS CloudTrail event history. D, and E are correct. CloudTrail logs all API calls, including who made the call. CloudTrail event history provides a view of the last 90 days. AWS Config records configuration changes, including security group creation. Option B is wrong because CloudWatch Logs does not capture API calls unless specifically configured. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 3

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

Accepted Answer

The network ACL denies inbound SSH from all IPs except the specific IP. A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction. Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Answer

The network ACL allows inbound SSH from 0.0.0.0/0

Answer

The security group rule is being overridden by a more restrictive security group attached to the same instance

Answer

The security group rule is being evaluated but the instance's operating system firewall is blocking SSH

Question 4

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

Accepted Answer

Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing any unsolicited inbound traffic from the internet. The private subnet route table sends 0.0.0.0/0 traffic to the NAT Gateway, which then forwards it through the Internet Gateway (IGW) attached to the VPC. This provides the highest security because the private instances remain unreachable from the internet, unlike using an IGW directly or a bastion host for routing.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it

Answer

Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

Answer

Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

Question 5

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

Accepted Answer

The source IP condition does not match the user's actual IP address. The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Answer

The bucket policy overrides the IAM policy

Answer

The policy does not allow the s3:GetObject action

Answer

The user is not assuming the correct IAM role

Question 6

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

Accepted Answer

The EC2 instances in this security group cannot initiate outbound connections. A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing. Option D is wrong because the security group does allow inbound HTTP.

Answer

The EC2 instances cannot receive inbound HTTP traffic

Answer

The security group allows all outbound traffic by default

Answer

Outbound traffic is allowed because security groups are stateful

Question 7

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

Accepted Answer

Create an Origin Access Control (OAC) for the S3 bucket origin. An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.

Answer

Create a Route 53 health check to verify CloudFront availability

Answer

Configure CloudFront signed URLs to restrict access

Answer

Attach a security group to the S3 bucket

Question 8

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering. AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS Shield Advanced

Question 9

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

Accepted Answer

Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured. Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Answer

Set up AWS Config rules to detect non-compliant buckets

Answer

Create an IAM role that requires encryption and attach it to all users

Answer

Use an S3 bucket policy with a condition for encryption

Question 10

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

Accepted Answer

Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.. It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.

Answer

Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Configure security groups to allow only HTTPS traffic.

Question 11

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Accepted Answer

Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.. Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.

Answer

Disable automated backups to reduce storage costs.

Answer

Enable Multi-AZ deployment for fault tolerance.

Answer

Assign a public IP address to the RDS instance for easier access from the internet.

Question 12

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Which step should be taken to secure the bucket while maintaining access for authorized users?

Accepted Answer

Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.. Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible. Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Answer

Use AWS Config to automatically block all public access.

Answer

Create an IAM role with S3 access and assign it to the bucket.

Answer

Add a Deny statement for any IP address outside the corporate network.

Question 13

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and update the route table.. A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.

Answer

Create an Interface VPC Endpoint for S3.

Answer

Route the traffic through a NAT Gateway to the internet.

Answer

Assign a public IP address to the EC2 instance and allow it to access S3 via internet.

Question 14

A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?

Accepted Answer

Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.. To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect. Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances. Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.

Answer

Create a resource-based policy on the RDS instance.

Answer

Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.

Answer

Create a security group rule that references the EC2 instance's security group.

Question 15

A security engineer is reviewing the following IAM policy attached to an S3 bucket: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

Accepted Answer

The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.. The bucket policy uses `"Principal": "*"` combined with `"Effect": "Allow"`, which explicitly grants public access to anyone who meets the condition. While the condition restricts access to the `10.0.0.0/8` IP range, the policy itself is still a public bucket policy — it allows any authenticated or unauthenticated user from that IP range to read objects. This violates the principle of least privilege and exposes sensitive data to any user on the corporate network, not just authorized IAM roles or users.

Answer

The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

Answer

The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

Answer

The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.