SCS-C02 Infrastructure Security Practice Test 23 — 15 Questions

Question 1

A company has an EC2 instance that needs to access an S3 bucket. The security team wants to use the principle of least privilege. Which method should be used to grant access?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. It follows the principle of least privilege by using an IAM role with a scoped S3 access policy, which is then attached to the EC2 instance profile. This allows the EC2 instance to obtain temporary security credentials from the AWS STS service, avoiding long-term access keys and ensuring permissions are granted only as needed.

Answer

Use a security group to allow outbound traffic to S3.

Answer

Store AWS access keys on the instance and use them in the application.

Answer

Create a bucket policy that grants access to the EC2 instance ID.

Question 2

A company uses AWS WAF to protect its web application from common web exploits. The security team wants to block requests that contain SQL injection or cross-site scripting (XSS) in the query string. Which rule type should be used?

Accepted Answer

Managed rule group for SQL injection and XSS. AWS WAF managed rule groups, such as the AWS-AWSManagedRulesSQLiRuleSet and AWS-AWSManagedRulesXSSRuleSet, are pre-configured to inspect query strings for SQL injection and cross-site scripting (XSS) patterns. Using a managed rule group is the most efficient and accurate approach because it leverages AWS's continuously updated threat signatures, reducing false positives and administrative overhead compared to custom rules.

Answer

Custom regex pattern set

Answer

Rate-based rule

Answer

Geographic match rule

Question 3

A security engineer needs to ensure that all traffic to an EC2 instance in a VPC is inspected by a network firewall appliance. The firewall is deployed in a separate subnet. What is the MOST secure and scalable way to route traffic through the firewall?

Accepted Answer

Use a Gateway Load Balancer with a Gateway Load Balancer endpoint in each subnet.. A Gateway Load Balancer (GWLB) with a Gateway Load Balancer endpoint in each subnet provides transparent, scalable, and highly available traffic inspection. GWLB operates at Layer 3 (IP packets) and uses GENEVE encapsulation to forward traffic to the firewall appliance without modifying the source/destination IP addresses, ensuring all traffic to the EC2 instance is inspected. This architecture scales horizontally by adding more firewall instances behind the GWLB and avoids single points of failure.

Answer

Configure a NAT gateway in the firewall subnet and route all traffic through it.

Answer

Use an Application Load Balancer in front of the firewall.

Answer

Create a transit gateway and route traffic through the firewall subnet.

Question 4

A company uses AWS Shield Advanced to protect its web application against DDoS attacks. The application is behind an Application Load Balancer (ALB) with a web application firewall (AWS WAF) in front. The security team notices that some requests are being blocked by AWS WAF, but the source IP addresses are legitimate customers. What step should the team take to minimize false positives?

Accepted Answer

Implement rate-based rules with a count action and use the count data to create custom rules.. Rate-based rules with a count action allow the team to monitor request patterns without blocking legitimate traffic. The count action logs matching requests, enabling analysis to create custom rules that accurately distinguish between malicious and legitimate traffic. This approach minimizes false positives by basing rule logic on observed data rather than static thresholds.

Answer

Switch to using AWS Managed Rules for IP reputation lists.

Answer

Increase the WAF rate-based rule threshold to allow more requests.

Answer

Reconfigure the ALB idle timeout to a higher value.

Question 5

A company wants to securely store secrets used by an application running on EC2 instances. The secrets include database credentials and API keys. What is the MOST secure and manageable approach?

Accepted Answer

Use AWS Secrets Manager and attach an IAM role to the EC2 instance with permission to access the secrets.. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials and API keys. Attaching an IAM role to the EC2 instance allows the application to retrieve secrets securely without hardcoding credentials, and Secrets Manager supports automatic rotation, auditing via CloudTrail, and fine-grained access control. This is the most secure and manageable approach.

Answer

Store the secrets in the EC2 instance user data and retrieve them from the metadata service.

Answer

Embed the secrets in the application code and encrypt the code with a KMS key.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter and reference it in the application code.

Question 6

A security engineer is configuring a VPC with public and private subnets. The engineer needs to allow instances in the private subnet to download software updates from the internet. Which component should be added to the VPC?

Accepted Answer

NAT gateway in a public subnet.. A NAT gateway placed in a public subnet allows instances in a private subnet to initiate outbound connections to the internet (e.g., to download software updates) while remaining unreachable from the internet. The NAT gateway performs source NAT, translating the private IPs to its own Elastic IP, and returns responses to the originating instances. This is the standard AWS pattern for giving private subnets outbound-only internet access.

Answer

VPN connection to on-premises.

Answer

VPC endpoint for Amazon S3.

Answer

Bastion host in a public subnet.

Question 7

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The company has a VPC with public and private subnets. The security team wants to ensure that all traffic between on-premises and the VPC goes through a set of security appliances (firewalls) deployed in the VPC. The appliances are in separate subnets. Currently, traffic is routed directly via the virtual private gateway. What is the MOST secure and scalable way to force traffic through the security appliances?

Accepted Answer

Deploy a Gateway Load Balancer and create Gateway Load Balancer endpoints in each subnet. Update the route tables to point to the endpoints.. Using a Gateway Load Balancer with Gateway Load Balancer endpoints in each subnet allows transparent traffic inspection and scaling. Option A is wrong because a NAT gateway only handles outbound traffic, not bidirectional inspection. Option B is wrong because a transit gateway does not force traffic through appliances; additional routing and appliance VPCs are needed. Option D is wrong because a VPN connection does not inherently route through VPC appliances; it would require custom routing.

Answer

Place the security appliances in a public subnet and route traffic through a NAT gateway.

Answer

Create a transit gateway and attach the Direct Connect virtual interface to it. Then route traffic through the appliance subnets.

Answer

Set up a VPN connection from on-premises to the VPC and route traffic through the appliance subnets.

Question 8

A startup is building a web application on AWS. They have an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. They want to protect the application from common web exploits like SQL injection and cross-site scripting. They also need to allow only traffic from certain geographic regions. Which AWS service should they use to achieve these requirements?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting. It also allows you to create geo-match conditions to allow or block traffic based on geographic regions, meeting both requirements.

Answer

AWS Shield Advanced

Answer

Security groups on the ALB

Answer

Network ACLs on the ALB subnets

Question 9

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. The bucket policy must deny all requests that do not come from the VPC endpoint. Which TWO statements are true for this configuration?

Accepted Answer

Use the aws:SourceVpce condition key in the bucket policy.. Option C is correct because the aws:SourceVpce condition key is the specific global condition key that evaluates the VPC endpoint ID (vpce-xxxxxxxx) from which the request originates, allowing the policy to match traffic coming through that endpoint. Option D is correct because to block everything except the endpoint, the statement must use "Effect": "Deny" combined with a condition such as "StringNotEquals": {"aws:SourceVpce": "vpce-12345678"}, which denies any request whose source VPC endpoint does not match the specified one. Option A is not appropriate because aws:SourceIp matches public IP addresses and cannot reliably identify traffic originating from a VPC endpoint, which uses private IPs and is better identified by its endpoint ID. Option B is incorrect because the Principal element identifies the AWS identity (account, user, or role) making the request, not the VPC endpoint; the endpoint is referenced through the aws:SourceVpce condition key instead. Option E is incorrect because an explicit Allow is not required for this restriction; a Deny with a negated condition is sufficient to block all non-endpoint requests, and adding an Allow would not by itself enforce the restriction.

Answer

Use the aws:SourceIp condition key to restrict IP addresses.

Answer

Set the Principal to the VPC endpoint ID.

Answer

Ensure the bucket policy has an explicit Allow for the VPC endpoint.

Question 10

A company runs a multi-tier web application on AWS. The web tier uses an Application Load Balancer (ALB) in a public subnet, and the application tier runs on EC2 instances in private subnets. The security team recently ran a vulnerability scan and found that the application instances are accessible from the internet on port 8080. The EC2 instances have a security group that allows inbound traffic on port 8080 from the ALB's security group only. However, the ALB's security group allows inbound traffic on port 8080 from 0.0.0.0/0. The architecture also includes a NAT Gateway for outbound internet access from private subnets. The security engineer needs to ensure that only the ALB can communicate with the application instances on port 8080, and that the application instances cannot be directly accessed from the internet. What should the security engineer do?

Accepted Answer

Modify the ALB security group to remove the inbound rule for port 8080 from 0.0.0.0/0, and configure the ALB listener to forward traffic from port 80/443 to port 8080 on the target group.. The ALB security group should only allow inbound traffic on the listener ports (80/443) from the internet, not port 8080. The ALB listener then forwards to the target group on port 8080, and the EC2 security group already restricts 8080 to the ALB's security group. Removing the 0.0.0.0/0 rule on 8080 from the ALB SG closes the exposure while preserving the ALB-to-instance path.

Answer

Change the EC2 instance security group to allow inbound traffic on port 8080 from 0.0.0.0/0, and rely on the subnet network ACL to block traffic.

Answer

Add a rule to the EC2 security group that denies inbound traffic from 0.0.0.0/0 on port 8080.

Answer

Place the EC2 instances in a public subnet and use a network ACL to block inbound traffic on port 8080 from the internet.

Question 11

A company uses AWS Organizations to manage multiple accounts. The security team must enforce that all Amazon S3 buckets across all accounts are encrypted with AWS KMS. The team has enabled S3 default encryption for new buckets, but existing buckets may not be encrypted. They need to automatically remediate any non-compliant buckets. The team has AWS Config and AWS Lambda available. What is the MOST operationally efficient solution?

Accepted Answer

Use AWS Config with the s3-bucket-server-side-encryption-enabled rule and configure an AWS Systems Manager Automation document to remediate non-compliant buckets.. Use AWS Config with the s3-bucket-server-side-encryption-enabled rule to detect non-compliant S3 buckets. Then configure an automatic remediation action using an AWS Systems Manager Automation document to enable encryption on those buckets. This approach is serverless, automated, and operationally efficient as it does not require manual intervention or separate compute resources.

Answer

Manually review all buckets using the S3 console and enable encryption for those that are not encrypted.

Answer

Write a script that runs daily on an EC2 instance to list all buckets and enable encryption on any that are not encrypted.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and send an SNS notification to the security team to manually remediate.

Question 12

Refer to the exhibit. A security engineer is unable to SSH into an EC2 instance in subnet-12345678. The instance's security group allows inbound SSH from 10.0.0.0/8, and the instance has a public IP. What is the most likely reason for the failure?

Accepted Answer

The security group inbound rule restricts SSH to the 10.0.0.0/8 range, blocking the engineer's IP.. The network ACL allows inbound SSH from 0.0.0.0/0, but the security group only allows SSH from 10.0.0.0/8. Since the engineer is connecting from an IP outside that range, the security group blocks the connection.

Answer

The security group egress rule is blocking return traffic.

Answer

The network ACL's default deny rule (32767) is blocking all inbound traffic.

Answer

The network ACL inbound rule for SSH is misconfigured, denying all traffic.

Question 13

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

Accepted Answer

Failure, because the Deny statement blocks HTTP requests.. The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Answer

Success, because the Allow statement is evaluated first.

Answer

Failure, because the user's IP is not in the allowed range.

Answer

Success, because the user's IP is within the allowed range.

Question 14

Refer to the exhibit. A security engineer is investigating a potential unauthorized VPC creation. What does the evidence suggest?

Accepted Answer

The user admin created two VPCs, but one was deleted shortly after creation.. The CloudTrail log shows two CreateVpc events by user admin. One VPC exists (vpc-12345678), but the other (vpc-87654321) does not exist, indicating that it was deleted after creation. This could indicate malicious activity where a VPC was created and then deleted to cover tracks.

Answer

The CloudTrail log is incomplete; both VPCs exist.

Answer

Both VPCs were created successfully and still exist.

Answer

The user admin only created one VPC; the second event is a duplicate.

Question 15

Refer to the exhibit. A security engineer reviews the AWS WAF web ACL configuration. What is the effect of this configuration?

Accepted Answer

It blocks IPs that send more than 2000 requests and allows requests containing '

Answer

It allows all traffic because the rules are misconfigured.

Answer

It blocks both SQL injection and XSS attacks.

Answer

It blocks SQL injection attacks and allows XSS attacks.