SCS-C02 Infrastructure Security Practice Test 3 — 15 Questions

Question 1

A company is designing a multi-tier web application. The web servers must be accessible from the internet, but the application servers must only be accessible from the web servers. Which AWS feature should be used to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use security groups with rules that allow inbound traffic to the web servers from the internet, and allow inbound traffic to the application servers only from the web server security group.. Security groups are stateful and can reference other security groups as a source. By allowing inbound traffic to the web servers from the internet (0.0.0.0/0) and allowing inbound traffic to the application servers only from the web server security group, you ensure that only traffic originating from the web servers can reach the application servers. Option B is incorrect because VPC peering is for connecting separate VPCs, not for controlling traffic between tiers within the same VPC. Option C is incorrect because network ACLs are stateless and applied at the subnet level; while they could be used, security groups provide simpler instance-level control with stateful behavior. Option D is incorrect because a VPN connection is used for hybrid connectivity, not for isolating tiers within a VPC.

Answer

Use a VPC peering connection between the web tier and application tier subnets.

Answer

Use network ACLs to allow inbound traffic to the web tier from the internet and to the application tier only from the web tier.

Answer

Use a VPN connection to isolate the application tier from the web tier.

Question 2

A company uses AWS CloudFormation to deploy infrastructure. A security engineer needs to ensure that all CloudFormation stacks use a specific AWS KMS key for encrypting resources that support encryption. Which approach should be used?

Accepted Answer

Use AWS CloudFormation StackSets with a service-managed permission model to deploy stacks from a centrally managed template that includes the KMS key.. AWS CloudFormation StackSets with a service-managed permission model allow you to deploy a centrally managed template across multiple accounts and regions from a single administrator account. By hardcoding the KMS key ID directly in the template (or referencing a stack-set parameter that is locked down), you enforce that all stack instances use the specified KMS key for encryption-enabled resources, ensuring consistent compliance without relying on individual user input.

Answer

Use a CloudFormation template that includes the KMS key ID as a hardcoded value.

Answer

Use a CloudFormation parameter to accept the KMS key ID and validate it with a rule.

Answer

Use an AWS Organizations service control policy (SCP) to deny all CloudFormation actions unless a specific KMS key is used.

Question 3

A company wants to audit all API calls made to Amazon S3 within a specific AWS account. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs.. AWS CloudTrail is the service that records all API calls made to Amazon S3 (and other AWS services) within an AWS account, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. By delivering these logs to Amazon CloudWatch Logs, you can monitor, search, and set alarms on the API activity in real time, enabling comprehensive auditing of S3 operations.

Answer

Amazon Inspector and Amazon CloudWatch Logs.

Answer

Amazon GuardDuty and Amazon CloudWatch Logs.

Answer

AWS Config and Amazon CloudWatch Logs.

Question 4

A security engineer needs to ensure that an Amazon S3 bucket blocks all public access. Which S3 block public access settings should be enabled?

Accepted Answer

Block all public access. The 'Block all public access' setting in Amazon S3 is a single toggle that simultaneously enables all four individual block public access settings, ensuring that no public access is allowed through any mechanism—bucket policies, ACLs, or otherwise. This is the only setting that comprehensively blocks all public access to the S3 bucket and its objects, as required by the security engineer's goal.

Answer

Block public access to buckets and objects granted through new public bucket policies

Answer

Block public access to buckets and objects granted through new access control lists (ACLs)

Answer

Block public access to buckets and objects granted through any access control lists (ACLs)

Question 5

Which TWO actions are valid ways to restrict access to an Amazon S3 bucket using a bucket policy? (Choose two.)

Accepted Answer

Use the aws:SourceIp condition key to allow access only from a specific IP range.. The `aws:SourceIp` condition key in an S3 bucket policy allows you to restrict access based on the requester's IP address. This is a standard AWS IAM condition that evaluates the source IP of the request, enabling you to permit or deny access from a specific CIDR range. It is commonly used to limit S3 bucket access to a corporate network or a known set of public IPs.

Answer

Use the iam:RoleName condition key to allow access only from a specific IAM role.

Answer

Use the aws:SourceVpce condition key to allow access only from a specific VPC.

Answer

Use the kms:EncryptionContext condition key to require that objects are encrypted with a specific KMS key.

Question 6

Which TWO of the following are valid methods to secure data at rest in Amazon S3? (Choose two.)

Accepted Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).. Both SSE-C and client-side encryption are valid methods for securing data at rest in Amazon S3. SSE-C uses server-side encryption with customer-provided keys, while client-side encryption encrypts data before uploading. Although SSE-S3 is also valid, the question focuses on two specific methods: customer-controlled encryption and client-side encryption.

Answer

Enable S3 Object Lock.

Answer

Enable S3 Transfer Acceleration.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3).

Question 7

A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances in private subnets. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which security group configuration should be applied to the EC2 instances?

Accepted Answer

Allow inbound HTTP/HTTPS from the security group attached to the ALB.. Referencing the security group of the Application Load Balancer as the source in the inbound rule ensures that only traffic coming from the ALB can reach the EC2 instances. Option B is incorrect because network ACLs are stateless and cannot reference security groups; they also operate at the subnet level, not at the instance level. Option C is incorrect because allowing traffic from 0.0.0.0/0 would expose the instances to the internet. Option D is incorrect because allowing traffic from the VPC CIDR would permit any instance in the VPC to access the EC2 instances, not just the ALB.

Answer

Configure the network ACL to allow traffic from the ALB's private IP addresses.

Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0.

Answer

Allow inbound HTTP/HTTPS from the VPC CIDR block.

Question 8

A security engineer is designing a VPC with public and private subnets in two Availability Zones. The company requires that all outbound traffic from private subnets to the internet must go through a single, centrally managed NAT gateway. Which combination of resources and route table entries should be used?

Accepted Answer

A single NAT gateway in a public subnet, and a default route (0.0.0.0/0) in each private subnet route table pointing to that NAT gateway.. A single NAT gateway placed in a public subnet (with an Internet Gateway route) can be used by multiple private subnets across different Availability Zones. Each private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface (ENI) or NAT Gateway ID, ensuring all outbound traffic from private instances is source-NATed through that single, centrally managed device.

Answer

A single NAT gateway in a private subnet, and a default route in each private subnet pointing to the NAT gateway.

Answer

One NAT gateway per private subnet, each with a route to an internet gateway.

Answer

One NAT gateway per Availability Zone, with routes to the internet gateway.

Question 9

A company has a VPC with a public subnet and a private subnet. The public subnet hosts a NAT instance (Amazon Linux) that provides internet access to instances in the private subnet. The security team notices that the NAT instance is receiving high inbound traffic on port 22 from an external IP address. The team wants to block this traffic at the network layer without affecting other traffic. What is the most effective solution?

Accepted Answer

Add a network ACL rule on the public subnet to deny inbound traffic from the specific IP on port 22.. A network ACL (NACL) operates at the subnet level (layer 3/4) and is stateless, meaning it can explicitly deny inbound traffic from a specific IP on port 22 before it reaches the NAT instance. This blocks the traffic at the network layer without affecting other traffic, as NACLs evaluate rules in order and deny rules override allow rules for the specified traffic. Unlike security groups, NACLs do not require the traffic to first reach the instance, making them ideal for blocking unwanted traffic at the subnet boundary.

Answer

Move the NAT instance to a private subnet and use a NAT gateway instead.

Answer

Modify the security group attached to the NAT instance to block inbound SSH from the specific IP.

Answer

Use AWS WAF to block the IP address.

Question 10

A company is using AWS CloudFormation to deploy a web application. The template includes an EC2 instance with a security group that allows inbound HTTP traffic from 0.0.0.0/0. The security team wants to ensure that this security group is never used in production. Which AWS service can automatically remediate this noncompliant configuration?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., 'restricted-ssh' or 'incoming-ssh-disabled') that can evaluate security group configurations against desired compliance. When a noncompliant resource is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation documents (e.g., AWSConfigRemediation-RevokeUnusedSecurityGroupIngress) to remove the overly permissive inbound rule. This directly addresses the security team's requirement to prevent the use of a security group allowing HTTP traffic from 0.0.0.0/0 in production.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 11

A company has a VPC with multiple subnets. The security team wants to control traffic between subnets using a stateful firewall that can automatically allow return traffic. Which AWS service should be used?

Accepted Answer

Security groups. Security groups act as a stateful virtual firewall for EC2 instances and other resources at the subnet or instance level. They automatically allow return traffic regardless of inbound or outbound rules, which satisfies the requirement for a stateful firewall that controls traffic between subnets.

Answer

Network ACLs

Answer

AWS Firewall Manager

Answer

AWS WAF

Question 12

A security engineer is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. Both instances have security groups that allow all traffic from each other's security group. However, traffic is still blocked. What is the most likely cause?

Accepted Answer

The network ACL for one or both subnets is blocking the traffic.. The most likely cause is that the network ACL (NACL) for one or both subnets is blocking the traffic. Security groups are stateful and allow traffic based on rules, but NACLs are stateless and require explicit inbound and outbound rules for traffic to flow. Even if security groups permit all traffic between the instances, a NACL denying the traffic (e.g., by having a default deny rule or missing ephemeral port ranges) will block it. Since the instances are in different subnets, the NACL associated with each subnet must allow the traffic in both directions.

Answer

The instances are in different VPCs.

Answer

The route tables do not have a route between the subnets.

Answer

VPC Flow Logs are not enabled.

Question 13

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The security team wants to inspect all traffic between VPCs before it reaches its destination. Which architecture should be used?

Accepted Answer

Use a Transit Gateway with a central inspection VPC that hosts security appliances and route all inter-VPC traffic through it.. AWS Transit Gateway can route inter-VPC traffic through a central inspection VPC that hosts security appliances (e.g., firewalls, IDS/IPS). By attaching the Transit Gateway to the inspection VPC and configuring route tables to force all traffic between VPCs to pass through the inspection VPC, the security team can inspect all traffic before it reaches its destination. This architecture provides centralized, scalable traffic inspection without requiring traffic to leave the AWS network.

Answer

Use a VPN CloudHub to connect VPCs and inspect traffic at the VPN endpoint.

Answer

Use AWS Direct Connect to connect VPCs and inspect traffic on-premises.

Answer

Use VPC Peering and configure security groups on each VPC to allow only necessary traffic.

Question 14

A company wants to allow only specific IP addresses to access an S3 bucket. Which two methods can achieve this? (Choose TWO.)

Accepted Answer

Use an IAM policy with a condition that limits access to specific IP addresses.. IAM policies can include a condition key like `aws:SourceIp` to restrict API calls to specific IP addresses. Since S3 API requests are authenticated via IAM, this condition effectively limits which IPs can perform operations on the bucket. Option E is correct because S3 bucket policies also support the `aws:SourceIp` condition key, allowing you to define IP-based access restrictions directly on the bucket resource itself, independent of the requester's IAM identity.

Answer

Configure a network ACL on the subnet that blocks traffic from all but specific IPs.

Answer

Enable VPC Flow Logs to filter traffic from specific IPs.

Answer

Attach a security group to the S3 bucket that allows traffic only from specific IPs.

Question 15

A company is using AWS Organizations to manage multiple accounts. The security team wants to restrict the use of specific instance types across all accounts. Which two AWS services can enforce this restriction? (Choose TWO.)

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in your organization. By creating an SCP that denies the launch of specific instance types (e.g., using a Deny effect with a condition like ec2:InstanceType), you can enforce this restriction across all member accounts, even preventing actions by account administrators. AWS Config rules can evaluate the configuration of resources against desired policies; a managed rule like `ec2-instance-type-allowed` can be used to detect and flag non-compliant instances, and combined with auto-remediation actions (e.g., AWS Systems Manager Automation), it can enforce the restriction by terminating or stopping non-compliant instances.

Answer

IAM policies

Answer

VPC Flow Logs

Answer

AWS CloudTrail