SCS-C02 Infrastructure Security Practice Test 4 — 15 Questions

Question 1

A security engineer needs to ensure that an EC2 instance can only be launched using an approved Amazon Machine Image (AMI) from a specific AWS account. Which AWS service should be used to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Service Catalog. AWS Service Catalog allows you to create and manage a portfolio of approved products, such as EC2 instances launched from specific AMIs. By defining a product that uses an approved AMI from a particular AWS account and enforcing launch constraints, you can ensure that only that AMI is used. IAM policies alone cannot restrict the AMI ID at launch time because they lack the granularity to filter by source account or AMI ID in the ec2:RunInstances action.

Answer

IAM policies

Answer

AWS Config

Answer

AWS Image Builder

Question 2

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service provides a managed, highly available, and scalable solution for this requirement?

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway is a managed AWS service that provides outbound-only internet access for instances in private subnets. It is highly available within an Availability Zone (AZ) and scales automatically up to 45 Gbps, making it the ideal solution for private subnet internet access without the management overhead of a NAT instance.

Answer

NAT instance in a public subnet

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 3

An organization uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which approach would enforce this across all accounts?

Accepted Answer

Apply a Service Control Policy that denies PutBucketPolicy or PutBucketEncryption without encryption.. A Service Control Policy (SCP) is a centralized policy in AWS Organizations that can deny actions across all accounts in the organization. By denying the s3:PutBucketPolicy and s3:PutEncryptionConfiguration actions unless encryption is specified, the SCP enforces server-side encryption on all S3 buckets, regardless of individual account configurations. This approach is effective because SCPs are applied at the organization level and cannot be overridden by account administrators.

Answer

Create IAM roles in each account to enforce encryption.

Answer

Apply an S3 bucket policy to each bucket requiring encryption.

Answer

Use AWS Config rules to detect unencrypted buckets.

Question 4

A company is designing a network architecture for a multi-tier web application. The application consists of a public-facing ALB, web servers in private subnets, and an RDS database in isolated subnets. The security team requires that the web servers have no direct internet access. Which VPC configuration meets this requirement?

Accepted Answer

Private subnets with a NAT Gateway in a public subnet.. Placing web servers in private subnets with a NAT Gateway in a public subnet allows them to initiate outbound connections to the internet (e.g., for software updates) while preventing any inbound internet traffic from reaching them directly. The NAT Gateway translates private IPs to the public IP of the gateway, and the private subnets' route table points 0.0.0.0/0 to the NAT Gateway, not an Internet Gateway, ensuring no direct internet access.

Answer

Public subnets with an Internet Gateway.

Answer

Isolated subnets with no route to the internet.

Answer

Private subnets with a VPN connection to the corporate network.

Question 5

A company wants to use AWS WAF to protect its web application from common web exploits. Which AWS service must be integrated with AWS WAF to provide this protection?

Accepted Answer

Application Load Balancer or Amazon CloudFront. AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at Layer 7. It must be integrated with a service that can terminate HTTP/HTTPS connections and forward the traffic to WAF for inspection. Both Application Load Balancer (ALB) and Amazon CloudFront support this integration, allowing WAF to filter requests based on rules such as SQL injection or cross-site scripting. Security Groups and Network ACLs operate at the network and transport layers (Layers 3/4) and cannot provide Layer 7 inspection.

Answer

Security Groups

Answer

Amazon Route 53

Answer

Network ACLs

Question 6

A security engineer is designing a network segmentation strategy for a VPC that hosts sensitive data. The engineer needs to ensure that EC2 instances in a private subnet can communicate with an RDS database in a different private subnet, but cannot communicate with any other resources in the same VPC. Which configuration should be used?

Accepted Answer

Configure security groups for the EC2 instances that only allow outbound traffic to the RDS security group, and RDS security group allows inbound from the EC2 security group.. Security groups act as a virtual firewall at the instance level, allowing stateful traffic filtering. By configuring the EC2 security group to allow outbound traffic only to the RDS security group (using the security group ID as the destination), and the RDS security group to allow inbound traffic only from the EC2 security group, you create a precise, bidirectional allowlist. This ensures that EC2 instances can communicate exclusively with the RDS database, blocking all other traffic within the VPC without relying on IP addresses or subnet CIDRs.

Answer

Create a VPC peering connection between the subnets.

Answer

Assign the same security group to both the EC2 instances and the RDS database.

Answer

Use network ACLs with deny rules for all traffic except between the two subnets.

Question 7

A company uses AWS CloudFormation to deploy infrastructure. The security team needs to ensure that all CloudFormation stacks include a specific tag with a value that complies with corporate policies. Which AWS service can enforce this requirement?

Accepted Answer

AWS Service Catalog. AWS Service Catalog allows administrators to create and manage a portfolio of approved products (e.g., CloudFormation templates) with predefined constraints. One such constraint is a tag option, which enforces that every provisioned product (i.e., CloudFormation stack) includes a specific tag key and value, ensuring compliance with corporate policies. This is the only service among the options that can directly enforce mandatory tagging on CloudFormation stacks at provisioning time.

Answer

AWS Config

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Question 8

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. The security team wants to create a subnet for a legacy application that requires 2000 IP addresses. What is the smallest subnet CIDR that meets this requirement?

Accepted Answer

10.0.0.0/20. The /20 subnet provides 4096 total IP addresses (2^(32-20) = 4096), minus 5 reserved by AWS (network, VPC router, DNS, future, broadcast) leaves 4091 usable IPs, which exceeds the 2000 requirement. A /22 offers only 1024 usable IPs (1024 total - 5 = 1019), which is insufficient. The smallest subnet that meets the 2000-IP requirement is /20.

Answer

10.0.0.0/24

Answer

10.0.0.0/22

Answer

10.0.0.0/19

Question 9

A company uses AWS Organizations and wants to restrict the use of specific instance types across all accounts. Which TWO actions should be taken to enforce this restriction?

Accepted Answer

Apply a Service Control Policy (SCP) that denies ec2:RunInstances with noncompliant instance types.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By applying an SCP that denies ec2:RunInstances when the instance type does not match an allowed list, you can effectively prevent any user or role in any account from launching noncompliant instance types, even if they have full IAM permissions to do so.

Answer

Restrict instance types at the VPC level using network ACLs.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Create an IAM role that denies launch of noncompliant instances.

Question 10

A security engineer is designing a secure VPC architecture for a web application that must be accessible from the internet. The application runs on EC2 instances in private subnets. Which THREE components are required to provide secure internet connectivity?

Accepted Answer

Public subnets with routes to the IGW. A is correct because public subnets require routes to the Internet Gateway (IGW) in their route tables to allow traffic from the internet to reach resources in those subnets. For the web application's EC2 instances in private subnets to initiate outbound internet connectivity (e.g., for software updates), a NAT Gateway must be placed in a public subnet with a route to the IGW, and the private subnet's route table must point 0.0.0.0/0 traffic to the NAT Gateway. The IGW attached to the VPC is the foundational component that enables bidirectional internet traffic for the VPC, but it must be explicitly associated with route tables of public subnets.

Answer

Virtual Private Gateway (VGW)

Answer

Transit Gateway

Question 11

A company wants to ensure that all Amazon EC2 instances in a VPC can only be accessed via SSH from a specific IP address range (203.0.113.0/24). Which VPC component should be used to enforce this restriction?

Accepted Answer

Network ACL. A network ACL is a stateless firewall that controls inbound and outbound traffic at the subnet level. It can be configured with rules to allow SSH traffic only from the specified IP range (203.0.113.0/24) and deny all other inbound traffic, effectively enforcing the restriction. Security groups (Option A) are stateful and attached to instances, but they cannot explicitly deny traffic; they only allow. Route tables (Option B) control traffic routing, not filtering. Internet gateways (Option D) allow internet access but do not provide traffic filtering.

Answer

Security group

Answer

Route table

Answer

Internet gateway

Question 12

A security engineer needs to ensure that an EC2 instance can only be launched using an approved Amazon Machine Image (AMI) from a specific AWS account. Which AWS service should be used to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

x-amz-server-side-encryption-customer-algorithm and x-amz-server-side-encryption-customer-key. SSE-C requires the client to provide both the encryption algorithm and the encryption key in the PUT request headers. The `x-amz-server-side-encryption-customer-algorithm` header must be set to `AES256`, and the `x-amz-server-side-encryption-customer-key` header must contain the base64-encoded 256-bit key. Without these headers, S3 will not apply customer-provided encryption keys, and the object will not be encrypted with SSE-C.

Answer

x-amz-server-side-encryption: AES256

Answer

x-amz-server-side-encryption: aws:kms

Answer

x-amz-server-side-encryption-bucket-key-enabled: true

Question 13

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that no sensitive data, such as database passwords, is exposed in plaintext in the CloudFormation templates. What is the MOST secure way to handle secrets?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager with dynamic references in the template.. AWS Systems Manager Parameter Store and AWS Secrets Manager support dynamic references in CloudFormation templates, allowing you to reference secret values without exposing them in plaintext. CloudFormation resolves these references at deployment time, retrieving the actual secret value from the secure store, and never stores the secret in the template or stack metadata. This approach ensures secrets are managed, rotated, and audited centrally, adhering to security best practices.

Answer

Use AWS KMS to encrypt the secrets and include the ciphertext in the template.

Answer

Store the secrets in an encrypted S3 bucket and include the S3 URL in the template.

Answer

Pass the secrets as plaintext parameters to the stack at launch time.

Question 14

A company's security team discovers that an Amazon EC2 instance has been compromised and is sending outbound traffic to a known malicious IP address. The instance is in a VPC with a security group that allows all outbound traffic. What is the FASTEST way to stop the outbound traffic without affecting other instances?

Accepted Answer

Modify the security group attached to the instance to revoke all outbound rules.. Security groups are stateful and act as a virtual firewall at the instance level. By revoking all outbound rules in the security group attached to the compromised EC2 instance, you immediately block all outbound traffic from that specific instance without affecting any other instances in the VPC. This is the fastest and most targeted action because it requires no changes to subnet-level configurations or instance termination.

Answer

Modify the network ACL of the subnet to deny outbound traffic to the malicious IP.

Answer

Change the route table of the subnet to route traffic to a blackhole.

Answer

Terminate the compromised EC2 instance immediately.

Question 15

A company wants to allow a developer to launch EC2 instances only in a specific subnet. The developer should not be able to use any other subnet. Which IAM policy action should be used to enforce this?

Accepted Answer

ec2:RunInstances. The ec2:RunInstances action is the correct IAM action to control EC2 instance launches. By attaching a condition key such as ec2:SubnetId to the ec2:RunInstances action in an IAM policy, you can restrict the developer to launching instances only in a specific subnet. Other actions like ModifySubnetAttribute, CreateTags, or DescribeSubnets do not govern the launch of new instances.

Answer

ec2:ModifySubnetAttribute

Answer

ec2:CreateTags

Answer

ec2:DescribeSubnets