SCS-C02 Infrastructure Security Practice Test 3 — 15 Questions

Question 1

A security engineer is configuring a VPC with a public subnet for web servers and a private subnet for databases. The web servers need to download patches from the internet. Which TWO components are required to allow the web servers to access the internet while keeping the database servers isolated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Internet gateway attached to the VPC.. Option A (Internet gateway attached to the VPC) is correct because an internet gateway is the horizontally scaled, redundant VPC component that enables communication between resources in the VPC and the internet; it must be attached to the VPC and referenced in the public subnet's route table (0.0.0.0/0) for the web servers to reach the internet. Option D (NAT gateway in the public subnet) is correct because a NAT gateway provides outbound-only internet access for instances in private subnets, so if any patching traffic originates from private resources it can egress via the NAT gateway placed in the public subnet with an Elastic IP, while remaining unreachable from inbound internet connections. Option B (VPC endpoint for Amazon S3) is not required here because it only provides private connectivity to S3 (via gateway or interface endpoint) and does not provide general internet access for patch downloads. Option C (Transit gateway between the public and private subnets) is incorrect because a transit gateway is a regional hub for connecting VPCs, VPNs, and on-premises networks, not a mechanism for public/private subnet internet routing. Option E (Virtual private gateway attached to the VPC) is incorrect because a virtual private gateway terminates Site-to-Site VPN or Direct Connect traffic, not internet access for public subnets.

Answer

VPC endpoint for Amazon S3.

Answer

Transit gateway between the public and private subnets.

Answer

Virtual private gateway attached to the VPC.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have encryption enabled. Which approach is MOST effective and scalable?

Accepted Answer

Apply a service control policy (SCP) that denies s3:CreateBucket unless the bucket has encryption enabled.. A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny the s3:CreateBucket action unless the bucket is created with encryption enabled, using a condition key like s3:x-amz-server-side-encryption. This approach is most effective and scalable as it prevents non-compliant buckets from being created in any account under the SCP's scope, enforcing the security team's requirement proactively across all accounts without relying on per-account policies or post-creation remediation.

Answer

Use an S3 bucket policy in each account to deny PutObject without encryption.

Answer

Use AWS Config rules to mark non-compliant buckets and automatically remediate.

Answer

Enable CloudTrail and monitor for buckets without encryption.

Question 3

A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)

Accepted Answer

Take a snapshot of the unencrypted instance, copy it with encryption, and restore.. Option E is correct because Amazon RDS for MySQL lets you enable encryption at rest at creation time by selecting an AWS KMS key, which encrypts the underlying storage, automated backups, read replicas, and snapshots. Option A is correct because an existing unencrypted instance cannot be encrypted in place, but you can snapshot it, copy the snapshot with encryption enabled (specifying a KMS key), and restore a new encrypted DB instance from that encrypted snapshot. Option D is correct because you can enable encryption on an existing read replica when its source DB instance is encrypted, since the replica inherits/uses KMS-based encryption for its storage. Option B is not correct because RDS does not allow enabling encryption on an existing DB instance via Modify; encryption must be set at creation or achieved through snapshot copy/restore. Option C is not correct because an encrypted read replica cannot be created from an unencrypted source DB instance; the source must already be encrypted.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Create a read replica with encryption enabled, even if the source is unencrypted.

Question 4

Refer to the exhibit. A security engineer creates the S3 bucket policy above to allow an IAM role to upload objects only from the corporate network IP range (10.0.0.0/16). However, users report that they can still upload objects from outside the range when assuming the role. What is the most likely cause?

Accepted Answer

The bucket policy uses Allow instead of Deny; an explicit Deny is needed to block requests that do not meet the condition.. An S3 bucket policy with an Allow effect grants access to anyone who meets the condition, but it does not explicitly deny requests that do not meet the condition. In IAM and resource-based policies, an Allow that includes a condition only applies when the condition is true; if the condition is false, the Allow is not evaluated, but other policies (like the IAM role's permissions) may still grant access. To block uploads from outside the corporate IP range, an explicit Deny with the same condition (or a NotIpAddress condition) is required to override any other Allow that might apply.

Answer

The condition key aws:SourceIp does not support the IP range 10.0.0.0/16 because it is a private IP range.

Answer

The IAM role's trust policy does not restrict who can assume the role.

Answer

The resource ARN should not include the trailing /*.

Question 5

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all Amazon S3 buckets across all accounts are encrypted with AWS KMS customer managed keys (CMKs). They have implemented a service control policy (SCP) that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms. Additionally, they have an SCP that denies s3:CreateBucket unless the bucket is configured with default encryption using KMS. Despite these policies, a developer in the production account reports that they were able to upload a sensitive object to an existing bucket without encryption. The developer used the AWS CLI with the command: aws s3 cp sensitive.txt s3://my-bucket/. The bucket does not have default encryption enabled. The SCPs are attached to the root organizational unit (OU) and are in effect. What is the MOST likely reason the upload succeeded?

Accepted Answer

The SCP does not apply to the management account of the organization.. The SCP denies PutObject without the encryption header, but the command did not specify the header. However, SCPs do not affect the root user? No, root user is not used here. The developer used an IAM role. SCPs apply to all IAM principals. The issue might be that the SCP uses a condition key that is not evaluated properly? Another common issue: SCPs cannot deny actions that are performed by the AWS service itself? No. The most likely reason is that the SCP was not applied to the production account because it was attached to the root OU, but the production account might be in a different OU that does not inherit the SCP? Or the SCP might have been disabled? Or the developer might be using an IAM role that has a service-linked role? Actually, a known limitation: SCPs do not affect the management account. If the production account is the management account, SCPs do not apply. That is a classic gotcha. The question says "multi-account AWS environment using AWS Organizations" but does not specify that the production account is the management account. But it's plausible. Another possibility: The SCP denies s3:PutObject without the header, but the CLI command might automatically add the header if the bucket has default encryption? No, bucket does not have default encryption. The SCP should deny. So the most likely cause is that the production account is the management account of the organization, and SCPs do not apply to the management account.

Answer

The SCP uses the wrong condition key; it should use s3:x-amz-server-side-encryption instead.

Answer

The SCP was not attached to the production account's OU.

Answer

The developer used an IAM role that bypasses SCPs.

Question 6

Which TWO AWS services can be used to encrypt data at rest in an Amazon S3 bucket? (Choose two.)

Accepted Answer

SSE-KMS. SSE-KMS (option C) is correct because it is a server-side encryption mode in which Amazon S3 encrypts objects at rest using keys managed by AWS KMS, providing envelope encryption and auditability via CloudTrail. SSE-S3 (option D) is also correct because it is a server-side encryption mode where S3 manages the AES-256 data keys and applies encryption at rest automatically to objects. SSL/TLS (option A) is not correct because it only encrypts data in transit between the client and S3, not data at rest. Client-side encryption (option B) is not correct in this context because the encryption is performed by the client before uploading, so it is not an AWS service encrypting data at rest in the bucket. AWS Shield (option E) is not correct because it is a managed DDoS protection service and does not provide encryption.

Answer

SSL/TLS

Answer

Client-side encryption

Answer

AWS Shield

Question 7

A company runs a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) in a public subnet, EC2 instances in private subnets for the web tier, and an RDS MySQL database in a private subnet. The security team has noticed that the EC2 instances are receiving traffic from unexpected IP addresses on port 22 (SSH). The instances were launched with a default security group that allowed SSH from 0.0.0.0/0. The security engineer has corrected the security group to allow SSH only from the company's bastion host security group. However, the engineer also wants to implement defense-in-depth by adding a network ACL to the private subnet to block SSH from all sources except the bastion host's private IP (10.0.1.10). The private subnet's current network ACL allows all inbound and outbound traffic. The engineer creates a new network ACL with the following rules: Inbound: Rule 100: Allow SSH from 10.0.1.10/32; Rule 200: Deny SSH from 0.0.0.0/0; Rule *: Deny all. Outbound: Rule 100: Allow all. After associating this new NACL with the private subnet, the engineer finds that SSH connections from the bastion host are still being blocked. What is the most likely cause?

Accepted Answer

The outbound rule of the network ACL does not allow ephemeral ports for return traffic.. The most likely cause is that the outbound rule of the network ACL does not allow ephemeral ports for return traffic. Network ACLs are stateless, so the same rule evaluation must apply to both directions. Although the outbound rule allows all traffic, it could be misconfigured or not correctly allowing the ephemeral ports used for SSH responses. However, the more direct issue is that the inbound rule only allows SSH from the bastion IP, but the outbound rule must also allow the return traffic. Since the question states SSH connections are blocked, the outbound rule might be missing specific ephemeral port ranges, or the 'Allow all' rule may not be properly implemented. Option A is the best explanation.

Answer

The new network ACL was not associated with the private subnet.

Answer

The security group on the EC2 instances still allows SSH from 0.0.0.0/0.

Answer

The network ACL rules are out of order; the deny rule should be before the allow rule.

Question 8

A company has a requirement to block traffic from specific IP addresses known to be malicious. The company has an Application Load Balancer (ALB) that fronts a web application. The security engineer needs to implement a solution that can block these IP addresses at the edge before they reach the ALB. Which AWS service should be used?

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. AWS WAF can be associated with an Application Load Balancer and allows you to block traffic based on IP addresses using IP set rules. This enables blocking at the edge before traffic reaches the ALB. Option A is incorrect because security groups are instance-level firewalls and cannot be attached to an ALB. Option B is incorrect as AWS Shield Advanced provides DDoS protection but does not support IP-based blocking by itself. Option C is incorrect because network ACLs operate at the subnet level, not at the ALB level, and cannot block traffic specifically destined for the ALB.

Answer

Configure security groups on the ALB to deny traffic from those IP addresses.

Answer

Enable AWS Shield Advanced and configure rate-based rules.

Answer

Add a network ACL rule to the ALB's subnet to deny the IP addresses.

Question 9

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.

Answer

Amazon S3 server-side encryption

Answer

RDS encryption feature

Answer

SSL/TLS certificates

Question 10

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

Accepted Answer

Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.. An EC2 instance in a private subnet cannot use a public IP address for internet access, as the private subnet's route table directs default traffic to a NAT gateway, not an internet gateway. The public IP is irrelevant because the instance's traffic must traverse the NAT gateway, which requires the instance to have no public IP and the private subnet route to point to the NAT gateway. Removing the public IP ensures the instance uses the NAT gateway's Elastic IP for outbound traffic, resolving the internet access issue.

Answer

Attach an Elastic IP to the instance.

Answer

Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.

Answer

Allow outbound traffic in the instance's security group.

Question 11

A company has a VPC with a CIDR of 10.0.0.0/16. They have two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). They have an Application Load Balancer in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access the internet for updates. The security engineer has set up a NAT gateway in each public subnet. The route table for the private subnets has a default route pointing to the NAT gateway in the same Availability Zone. However, the EC2 instances are unable to reach the internet. What is the most likely cause?

Accepted Answer

The route tables for the public subnets do not have a default route (0.0.0.0/0) to the Internet Gateway.. The most likely cause is that the public subnets' route tables lack a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). For a NAT gateway to function, it must be placed in a public subnet with a route to the IGW so it can translate private IPs and forward traffic to the internet. Without this route, the NAT gateway cannot send traffic to the IGW, breaking outbound connectivity for EC2 instances in private subnets that rely on it.

Answer

The security groups for the EC2 instances do not allow outbound traffic.

Answer

The NAT gateways do not have route propagation enabled.

Answer

The NAT gateways are in the same Availability Zone.

Question 12

A company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Application Load Balancer (ALB) to distribute traffic. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0 and a security group for the EC2 instances that allows inbound HTTP from the ALB's security group. Recently, the company experienced a security incident where an attacker exploited a vulnerability in the application to gain access to an EC2 instance and then moved laterally to the database. The database is in a private subnet and uses a security group that allows inbound traffic from the EC2 instance security group on port 3306 (MySQL). The security team wants to prevent lateral movement in the future. Which of the following is the MOST effective course of action?

Accepted Answer

Implement a host-based firewall on each EC2 instance to restrict outbound connections to only the database endpoint.. A host-based firewall on each EC2 instance can enforce egress filtering at the OS level, restricting outbound connections to only the database endpoint (specific IP/port). This directly addresses lateral movement because even if an attacker compromises the instance, they cannot initiate connections to other internal targets. Security groups are stateful and cannot restrict egress based on destination hostname, so host-based controls provide the granularity needed.

Answer

Use VPC peering to isolate the database subnet from the application subnet.

Answer

Deploy AWS WAF in front of the ALB to block known malicious IPs.

Answer

Create a network ACL for the private subnet that denies outbound traffic from the EC2 instances to the database subnet.

Question 13

A company is migrating its on-premises data center to AWS. The company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect its on-premises network (192.168.0.0/16) to the VPC using an AWS Site-to-Site VPN. The security engineer has configured the virtual private gateway (VGW) and the customer gateway (CGW) with the correct settings. The VPN tunnel status is UP, but the on-premises servers cannot ping the EC2 instances in the VPC. The EC2 instances have security groups that allow ICMP traffic from the on-premises network. The VPC route table has a route for the on-premises network pointing to the VGW. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway.. While the scenario states that the VPC route table has a route for the on-premises CIDR pointing to the VGW, this refers to the main route table. The EC2 instances are likely in a subnet that uses a custom route table, which may not have this route. Without the route in the subnet's route table, the VPC cannot forward reply traffic from the EC2 instances back to the on-premises network via the VPN tunnel, causing ping failures. The tunnel status (UP) and security group configuration are correct, so the issue is the missing route in the subnet's route table.

Answer

The customer gateway is not configured with the correct public IP address of the VGW.

Answer

The VPN tunnel is not configured with the correct pre-shared key.

Answer

The security group for the EC2 instances does not allow inbound ICMP from the on-premises network.

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with server-side encryption (SSE-S3) and that no public access is allowed. The team has created an SCP that denies the s3:PutBucketPublicAccessBlock action and also denies s3:PutBucketPolicy if the policy would grant public access. However, the team discovers that some buckets in the production account still have public access enabled. The SCP is applied to the root OU, which includes the production account. What is the most likely reason that the SCP is not being enforced?

Accepted Answer

The production account is the management account of the organization, and SCPs do not affect the management account.. SCPs are AWS Organizations guardrails that restrict the maximum permissions available to accounts within the organization, but they explicitly do NOT apply to the management (payer) account. Even when an SCP is attached at the root OU, the management account is exempt from SCP enforcement, so any S3 bucket in that account can still be made public regardless of the deny statements. This is why the production account's buckets still allow public access despite the SCP being correctly attached.

Answer

The SCP does not have an explicit allow for the actions it denies; SCPs require an explicit allow to take effect.

Answer

The SCP only applies to IAM users and roles, not to the root user.

Answer

The SCP is not attached to the production account's OU; it is attached to the root OU.

Question 15

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

Accepted Answer

Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Answer

Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.

Answer

Add a network ACL to the private subnet that denies inbound HTTP traffic.