SCS-C02 Infrastructure Security Practice Test 4 — 15 Questions

Question 1

A company has the S3 bucket policy shown in the exhibit. The bucket contains sensitive data that should only be accessible from within the corporate network (10.0.0.0/16). However, users inside the corporate network report that they cannot access objects in the bucket. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Users are accessing the bucket through a VPC endpoint, which changes the source IP.. The condition uses IpAddress, which evaluates the source IP of the request. If users are accessing via a VPC endpoint, the source IP is not the client IP but the endpoint's private IP, which may not be in the specified range. Option A is wrong because a condition exists. Option C is wrong because IAM roles are not relevant to the public policy. Option D is wrong because SSL is not required by the policy.

Answer

Users do not have the appropriate IAM role assigned.

Answer

The policy does not have a Deny statement.

Answer

The bucket policy requires SSL but the connection is not using HTTPS.

Question 2

A company has a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL database. The security team has implemented security groups and network ACLs. Recently, a vulnerability scan revealed that the RDS database is accessible from the internet. The security engineer investigates and finds that the database security group allows inbound traffic on port 3306 from 0.0.0.0/0. The engineer also checks the network ACLs and finds that inbound rules allow traffic on port 3306 from 0.0.0.0/0, and outbound rules allow all traffic. The database is in a private subnet. Which combination of steps should the engineer take to remediate the issue while maintaining application functionality?

Accepted Answer

Update the database security group to allow inbound traffic on port 3306 from the VPC CIDR range. No changes to network ACL are needed.. The database security group is the actual enforcement point for instance-level access, and the application tier (EC2 instances in the Auto Scaling group) resides within the VPC CIDR range. Changing the inbound rule from 0.0.0.0/0 to the VPC CIDR (e.g., 10.0.0.0/16) restricts access to only resources inside the VPC, which includes the application servers. Network ACLs are stateless and operate at the subnet level; since the database is in a private subnet and the application traffic originates from within the VPC, the existing NACL rules (allowing 3306 from 0.0.0.0/0 and all outbound) do not need modification to maintain functionality—they already permit the necessary traffic. This approach removes internet exposure while preserving application connectivity.

Answer

Update the network ACL inbound rule to allow traffic only from the ALB security group. The security group is already correctly configured.

Answer

Update the database security group to allow inbound traffic on port 3306 only from the ALB security group. Update the network ACL inbound rule to allow traffic from the ALB security group.

Answer

Move the database to a public subnet and restrict the security group to the ALB security group.

Question 3

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to ensure that only specific IAM roles can use a particular KMS key to encrypt and decrypt data. What is the most secure way to achieve this?

Accepted Answer

Create a KMS key policy that grants access only to the specific IAM roles using the kms:CallerArn condition.. A KMS key policy is the primary access control for a KMS key, and using the 'kms:CallerArn' condition (or specifying the IAM role ARNs as principals) restricts which roles can call Encrypt/Decrypt. Because KMS key policies are evaluated as a resource-based policy, they are the most direct and secure way to limit key usage to specific roles.

Answer

Create an IAM policy that allows kms:Encrypt and kms:Decrypt for the roles and attach it to the roles.

Answer

Create a KMS key policy that grants access to the account and use IAM policies to restrict the roles.

Answer

Create a KMS key policy with Principal "*" and a condition that the request originates from the roles.

Question 4

A security engineer is configuring a VPC for a new application. Which TWO actions will improve network security? (Choose two.)

Accepted Answer

Use network ACLs to allow or deny traffic at the subnet level.. Option C is correct because network ACLs are stateless, subnet-level firewalls that evaluate allow/deny rules for inbound and outbound traffic, giving you an explicit means to block unwanted CIDR ranges or ports before traffic reaches instances. Option E is correct because security groups act as stateful, instance-level (ENI-level) virtual firewalls that permit only the specified protocols, ports, and source/destination security groups or CIDRs, which is the primary mechanism for restricting access to EC2 resources. Option A is not marked correct here because VPC endpoints (Interface endpoints via PrivateLink or Gateway endpoints for S3/DynamoDB) primarily provide private connectivity to AWS services and reduce exposure, but the question's intended security controls are the ACL and security group filtering mechanisms. Option B is not correct because a NAT gateway merely enables outbound IPv4 internet access for private subnets and does not itself restrict or filter traffic. Option D is not correct because VPC Flow Logs are a monitoring and auditing capability that records IP traffic metadata to CloudWatch Logs or S3; they provide visibility but do not enforce or improve network security controls by themselves.

Answer

Configure VPC endpoints to connect to AWS services privately.

Answer

Deploy a NAT gateway to allow outbound internet access.

Answer

Enable VPC Flow Logs to analyze traffic patterns.

Question 5

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?

Accepted Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}. It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}

Question 6

A company is using an Application Load Balancer (ALB) to distribute traffic to EC2 instances in a VPC. The Security Engineer notices that the ALB health checks are failing. Which configuration change should the Engineer make to resolve the issue?

Accepted Answer

Add a rule to the target instances' security group to allow inbound traffic from the VPC CIDR on the health check port.. The ALB health checks originate from private IP addresses within the VPC subnet, not from the internet. Therefore, the target instances' security group must allow inbound traffic from the VPC CIDR (or the ALB subnet CIDR) on the health check port. Option B correctly configures this, enabling the ALB to successfully reach the health check endpoint on the EC2 instances.

Answer

Add a rule to the target instances' security group to allow inbound traffic from 0.0.0.0/0 on the health check port.

Answer

Add a rule to the ALB's security group to allow inbound traffic from the internet on the health check port.

Answer

Add a rule to the ALB's security group to allow outbound traffic to the target instances on the health check port.

Question 7

A company has an AWS Direct Connect connection to its on-premises data center. The company wants to ensure that all traffic between the data center and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Use a Direct Connect gateway with a public virtual interface and an IPsec VPN.. It combines a Direct Connect public virtual interface with an IPsec VPN to encrypt all traffic between the on-premises data center and AWS. The public VIF provides a private, low-latency connection to AWS public services, while the IPsec VPN (typically using IKEv2 and ESP) adds encryption over that physical link, ensuring confidentiality and integrity. This meets the requirement of encrypting all traffic without relying on the public internet.

Answer

Use a Site-to-Site VPN connection over the internet.

Answer

Use AWS PrivateLink with TLS termination.

Answer

Use Direct Connect as is because it is already encrypted.

Question 8

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Accepted Answer

Create a NAT Gateway in the public subnet.. Option C is correct because a NAT Gateway must be created in a public subnet (with an Elastic IP) so that instances in private subnets can initiate outbound internet traffic while remaining unreachable from the internet. Option E is correct because the private subnet's route table must contain a route for 0.0.0.0/0 pointing to that NAT Gateway, which is what actually directs the web server's outbound patch-download traffic through the NAT. Together, C and E give the web server outbound-only internet access without exposing the database. Option A is unnecessary and does not provide the required outbound path by itself, since a bastion host is for inbound administrative access, not general internet egress. Option B only enables private access to Amazon S3 and does not provide general internet access for patch downloads. Option D is wrong because attaching an Internet Gateway and routing 0.0.0.0/0 to it in the private subnet's route table would make the private subnet public, exposing the database.

Answer

Create a bastion host in the public subnet and configure the web server to use it as a proxy.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

Question 9

A company has multiple AWS accounts and wants to centralize VPC flow log analysis. Flow logs are enabled for all VPCs and are published to Amazon S3 buckets in each account. A security engineer needs to aggregate these logs into a single S3 bucket in the centralized logging account. What should the security engineer do?

Accepted Answer

Create an S3 bucket policy on the centralized bucket that allows the source accounts to write objects.. An S3 bucket policy on the centralized logging account can grant the s3:PutObject permission to the source accounts' VPC flow log delivery service (or their root accounts), allowing them to write objects directly into the centralized bucket. This approach avoids data duplication, reduces costs, and simplifies management by eliminating the need for replication or streaming services.

Answer

Set up VPC peering between each account and the centralized logging account, then configure flow logs to write directly to the centralized bucket.

Answer

Configure S3 Replication between each account's flow log bucket and the centralized bucket.

Answer

Use Amazon CloudWatch Logs to stream flow logs to the centralized S3 bucket.

Question 10

A security engineer notices that an Amazon EC2 instance is sending suspicious outbound traffic to an unknown IP address. The instance is part of an Auto Scaling group. The engineer needs to immediately stop the traffic without affecting the availability of the application. What should the engineer do?

Accepted Answer

Update the security group attached to the instance to deny outbound traffic to the suspicious IP address.. Modifying the security group's outbound rules to remove the rule that allows traffic to the suspicious IP address effectively blocks the traffic at the instance level without terminating the instance. Security groups are stateful and allow-only; they do not support explicit deny rules. By removing the allow rule, the traffic is implicitly denied. This approach maintains application availability because the instance remains in the Auto Scaling group and continues to serve legitimate traffic.

Answer

Add a network ACL rule to deny outbound traffic to the suspicious IP address.

Answer

Terminate the instance immediately.

Answer

Detach the instance from the Auto Scaling group.

Question 11

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS Shield Advanced. AWS WAF (option D) is the correct service for filtering and blocking common web exploits like SQL injection and cross-site scripting, since it inspects HTTP/HTTPS requests against rule sets (AWS Managed Rules or custom rules) and can be attached directly to an ALB. AWS Shield Advanced (option B) is also correct because it provides enhanced DDoS protection and, when combined with AWS WAF, delivers layered protection for internet-facing applications on EC2 behind an ALB. Together, WAF handles application-layer (L7) exploit mitigation while Shield Advanced defends against volumetric and sophisticated DDoS attacks. Amazon GuardDuty (A) is a threat-detection service that identifies malicious activity but does not block SQLi/XSS traffic. Network ACLs (C) operate at the subnet level on IP/port/protocol and cannot inspect HTTP payloads for web exploits. Amazon CloudFront (E) is a CDN that can integrate with AWS WAF, but by itself it does not provide the required web exploit protection.

Answer

Amazon GuardDuty

Answer

Network ACLs

Answer

Amazon CloudFront

Question 12

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Accepted Answer

AWS CloudTrail event history. AWS CloudTrail event history (A) is correct because it provides a 90-day record of management events, including the CreateSecurityGroup API call, with the identity (user or role) that made the request. AWS CloudTrail (D) is correct because it delivers the same event data to an S3 bucket or CloudWatch Logs, allowing the engineer to query historical API activity beyond 90 days and identify the caller. AWS Config (E) is correct because it records resource configuration changes, including security group creation, and the configuration item includes details about who made the change and when. Amazon CloudWatch Logs (B) is not correct because it stores log data from services but does not natively capture AWS API call identity without CloudTrail integration. VPC Flow Logs (C) is not correct because it only captures IP traffic metadata for network interfaces and does not record API calls or the IAM principal that performed them.

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all new member accounts automatically deny public access to S3 buckets. Which policy should be attached to the root organizational unit?

Accepted Answer

Attach a service control policy (SCP) to the root OU. Service control policies (SCPs) are the only AWS Organizations policy type that can be attached to an organizational unit (OU) or the root and enforce permission guardrails across all member accounts. Attaching an SCP to the root OU applies it to every account in the organization, so any attempt to enable public S3 access (e.g., PutPublicAccessBlock, PutBucketPolicy with a public statement) is denied by the SCP. This is the centralized, scalable way to enforce the requirement without touching each bucket or account individually.

Answer

Attach an S3 bucket policy to each bucket

Answer

Attach an IAM policy to the root user

Answer

Attach a trust policy to the OrganizationAccountAccessRole

Question 14

A security engineer is configuring an AWS WAF web ACL for an Application Load Balancer. The engineer wants to block requests that contain cross-site scripting (XSS) and also limit the rate of requests from a single IP. Which THREE rule groups should be added?

Accepted Answer

Rate-based rule. Options B, C, and D are correct. A Rate-based rule (B) limits the rate of requests from a single IP, meeting the rate-limiting requirement. The AWS Managed Rules for SQL injection (C) and Cross-site scripting (D) directly address the XSS and SQL injection threats. Option A (IP reputation) blocks based on known malicious IPs, not rate or XSS. Option E (Geographic match) restricts by location, not behavior.

Answer

AWS Managed Rules - IP reputation rule group

Answer

Geographic match rule

Question 15

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

Accepted Answer

Create an Origin Access Control (OAC) for the S3 bucket origin. An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.

Answer

Create a Route 53 health check to verify CloudFront availability

Answer

Configure CloudFront signed URLs to restrict access

Answer

Attach a security group to the S3 bucket