SCS-C02 Infrastructure Security Practice Test 5 — 15 Questions

Question 1

A company is designing a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates but cannot be directly accessed from the internet. Which AWS service or feature should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound traffic from the internet. An Internet Gateway (option D) would allow inbound traffic, which is not allowed. VPC Peering (option B) and AWS VPN (option C) do not provide internet access.

Answer

VPC Peering

Answer

AWS VPN

Answer

Internet Gateway

Question 2

Which TWO actions can be taken to protect an S3 bucket from accidental public access? (Choose 2.)

Accepted Answer

Enable S3 Block Public Access at the account level. Option A is correct because S3 Block Public Access enabled at the account level applies account-wide settings that override bucket policies and ACLs, preventing any bucket in the account from being made public—even accidentally—by blocking public ACLs and public bucket policies. Option B is correct because a bucket policy that denies s3:PutBucketPolicy unless the request originates from a specific VPC (using aws:SourceVpc in the condition) prevents unauthorized or accidental changes to the bucket policy that could open the bucket to public access, effectively locking down who can alter the policy. Option C is not correct because default encryption protects data at rest but does nothing to prevent public access to objects. Option D is not correct because MFA Delete protects against accidental or malicious deletion of object versions, not against public exposure. Option E is not correct because requiring MFA for all S3 actions adds authentication strength for IAM principals but does not by itself prevent a bucket or object from being made publicly accessible.

Answer

Enable default encryption for the bucket

Answer

Enable MFA Delete on the bucket

Answer

Use an IAM policy that requires MFA for all S3 actions

Question 3

A security engineer is reviewing AWS CloudTrail logs and notices repeated `UnauthorizedOperation` errors for `ec2:RunInstances` from a specific IAM user. The user has a policy that allows `ec2:RunInstances` with a condition `aws:RequestedRegion` set to `us-east-1`. The engineer confirms the user is launching instances in `us-east-1`. What is the most likely cause of the error?

Accepted Answer

The user is using an AWS CLI command that does not include the `--region` parameter, causing the request to go to a global endpoint.. The error occurs because the user's IAM policy condition `aws:RequestedRegion` evaluates the region specified in the request, not the physical region where the instance is launched. If the user runs an AWS CLI command without the `--region` parameter, the request goes to the global endpoint (iam.amazonaws.com) or the default region configured in the CLI, which may not be `us-east-1`. This causes the condition to fail, resulting in an `UnauthorizedOperation` error. Option A is incorrect because service-linked roles are not required for `ec2:RunInstances`. Option B is incorrect because the condition key `aws:RequestedRegion` does not require a `Resource` element; it works with the default resource `*`. Option C is incorrect because the error is `UnauthorizedOperation`, not an instance type error.

Answer

The user does not have a service-linked role for EC2.

Answer

The IAM policy lacks a `Resource` element specifying which instances can be launched.

Answer

The user is trying to launch an instance type that is not supported in us-east-1.

Question 4

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

Accepted Answer

Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.. It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.

Answer

Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Configure security groups to allow only HTTPS traffic.

Question 5

Which THREE are benefits of using AWS Systems Manager Session Manager to connect to EC2 instances? (Choose THREE.)

Accepted Answer

It allows closing inbound SSH and RDP ports on the instance.. Option A is correct because Session Manager uses the SSM Agent's outbound connection to the Systems Manager service, so you can remove inbound SSH (port 22) and RDP (port 3389) rules from the instance's security group, reducing the attack surface. Option C is correct because Session Manager provides shell access through the AWS Management Console, CLI, or SDK without needing a publicly reachable bastion host or jump box to broker the connection. Option E is correct because Session Manager can log session activity, and session-related API calls (such as StartSession) are recorded in AWS CloudTrail for auditing, with optional session output logging to S3 or CloudWatch Logs. Option B is not a Session Manager feature; it does not rotate SSH keys on instances. Option D is incorrect because the instance does not need an internet gateway or NAT gateway—it reaches the Systems Manager endpoints via VPC interface endpoints (PrivateLink) or, if needed, outbound connectivity, but no inbound path is required.

Answer

It automatically rotates SSH keys on the instance.

Answer

It requires an internet gateway or NAT gateway for the instance to communicate with the Session Manager service.

Question 6

Which TWO are valid methods to secure data at rest in Amazon S3? (Choose TWO.)

Accepted Answer

Enabling default encryption on the S3 bucket.. Options A and E are correct. Enabling default encryption on an S3 bucket (SSE-S3, SSE-KMS, or SSE-C) ensures that all objects stored in the bucket are encrypted at rest, providing data confidentiality. S3 Block Public Access settings prevent public access to the bucket and its objects, which helps protect data at rest from unauthorized exposure. Option B is incorrect because MFA Delete adds an extra layer of protection for deletions, not encryption. Option C is incorrect because versioning helps with data recovery and protection against accidental deletions, but does not encrypt data. Option D is incorrect because a bucket policy restricting access to specific IP addresses controls network-level access but does not encrypt data at rest.

Answer

Enabling MFA Delete.

Answer

Enabling S3 Versioning.

Answer

Configuring an S3 bucket policy to restrict access to specific IP addresses.

Question 7

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Which combination of security groups should be used?

Accepted Answer

Web: 0.0.0.0/0 on ports 80/443; App: Web SG on port 8080; DB: App SG on port 3306. It properly restricts traffic: the web tier allows only HTTP/HTTPS from the internet (0.0.0.0/0 on ports 80/443), the application tier allows traffic only from the web security group on port 8080, and the database tier allows traffic only from the application security group on port 3306. This enforces the principle of least privilege. Option D is incorrect because it uses 'ports 8080' (plural) instead of 'port 8080' (singular), which is invalid syntax in AWS security group rules.

Answer

Web: 0.0.0.0/0 on ports 80/443 and SSH; App: Web SG on port 8080; DB: App SG on port 3306

Answer

Web: 0.0.0.0/0 on all ports; App: Web SG on all ports; DB: App SG on all ports

Answer

Web: 0.0.0.0/0 on ports 80/443; App: Web SG on ports 8080; DB: App SG on port 3306

Question 8

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Which step should be taken to secure the bucket while maintaining access for authorized users?

Accepted Answer

Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.. Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible. Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Answer

Use AWS Config to automatically block all public access.

Answer

Create an IAM role with S3 access and assign it to the bucket.

Answer

Add a Deny statement for any IP address outside the corporate network.

Question 9

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and update the route table.. A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.

Answer

Create an Interface VPC Endpoint for S3.

Answer

Route the traffic through a NAT Gateway to the internet.

Answer

Assign a public IP address to the EC2 instance and allow it to access S3 via internet.

Question 10

A security engineer is configuring a VPC with public and private subnets. The engineer wants to ensure that the private subnet instances cannot initiate outbound connections to the internet but can receive responses from the internet if initiated from within the VPC. Which TWO configurations should be used?

Accepted Answer

Configure the private subnet security group to allow inbound traffic from the public subnet's security group.. Allows inbound traffic from the public subnet (e.g., from a load balancer) but does not affect outbound initiation. Option B ensures the private subnet has no route to the internet, preventing instances from initiating outbound traffic. Options C and D would allow outbound initiation. Option E is insufficient because the route table is the primary control for outbound traffic.

Answer

Attach an Internet Gateway to the VPC and add a route to it in the private subnet route table.

Answer

Attach a NAT Gateway to the private subnet and add a route to it.

Answer

Configure the private subnet Network ACL to allow outbound traffic to 0.0.0.0/0.

Question 11

A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?

Accepted Answer

Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.. To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect. Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances. Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.

Answer

Create a resource-based policy on the RDS instance.

Answer

Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.

Answer

Create a security group rule that references the EC2 instance's security group.

Question 12

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation are encrypted at rest. Which THREE configuration steps should be taken?

Accepted Answer

Create an AWS Config rule to check for unencrypted S3 buckets.. Option A is correct because an AWS Config rule (for example, the managed rule s3-bucket-server-side-encryption-enabled) continuously evaluates S3 buckets and flags any that are not encrypted at rest, giving the security team detection and compliance visibility over buckets created by CloudFormation. Option C is correct because an SCP attached at the AWS Organizations level can explicitly deny s3:CreateBucket (or s3:PutBucketEncryption) requests that lack encryption, providing a preventive guardrail that blocks non-compliant bucket creation across all accounts. Option D is correct because defining the BucketEncryption property (with ServerSideEncryptionConfiguration such as AES256 or aws:kms) in the CloudFormation template ensures every bucket the stack creates is encrypted at rest by design. Option B is not correct because a CloudFormation stack policy only protects specific resources from unintended stack updates; it does not enforce encryption at creation and can be bypassed by direct S3 API calls. Option E is not correct because IAM roles grant permissions but cannot inspect or condition on whether a bucket is encrypted, so a role alone cannot guarantee encryption at rest.

Answer

Use a CloudFormation stack policy to prevent updates that remove encryption.

Answer

Create an IAM role that only allows creation of encrypted buckets.

Question 13

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all security groups restrict SSH access to only the company's VPN public IP address range (203.0.113.0/24). A developer creates a stack that includes a security group with SSH open to 0.0.0.0/0. The stack deploys successfully. Which action should the security team take to prevent this in the future?

Accepted Answer

Use an AWS Config managed rule to detect security groups with unrestricted SSH access and trigger an automatic remediation.. AWS Config managed rules can continuously evaluate security group configurations against a desired baseline (e.g., 'restricted-ssh' or 'vpc-sg-open-only-to-authorized-ports') and, combined with AWS Config remediation actions (SSM Automation documents), automatically revoke non-compliant ingress rules. This provides both detection and enforcement across all accounts and regions, which is exactly what the security team needs to prevent future misconfigurations.

Answer

Create an AWS CloudFormation stack policy to block security groups with SSH open to 0.0.0.0/0.

Answer

Implement a service control policy (SCP) to deny the ec2:AuthorizeSecurityGroupIngress action for port 22 from 0.0.0.0/0.

Answer

Add an IAM policy to deny the ec2:AuthorizeSecurityGroupIngress action for port 22 from 0.0.0.0/0.

Question 14

A company has a VPC with public and private subnets. The private subnets contain Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which combination of controls should the security team implement? (Choose TWO.)

Accepted Answer

Ensure that the route tables for the subnets containing RDS instances do not have a route to an internet gateway.. Option A is correct because an RDS instance can only be reached from the internet if its subnet's route table provides a path to an internet gateway (or a NAT device that forwards to one); removing the IGW route from the private subnet route tables ensures there is no internet route to the database. Option B is correct because security groups are stateful and enforce instance-level access control, so restricting inbound rules to specific trusted CIDR ranges (and not allowing 0.0.0.0/0) prevents any internet host from opening a connection to the RDS listener port. Option C is wrong because placing RDS in a public subnet exposes it to the internet-facing route table, and NACLs alone do not make that placement safe. Option D is wrong because a blanket NACL deny of all inbound traffic would also block legitimate application traffic from the VPC, and NACLs are stateless subnet-level filters, not the recommended primary control here. Option E is wrong because AWS WAF attaches to Application Load Balancers, API Gateway, and CloudFront, not to RDS instances, so it cannot protect a database endpoint.

Answer

Place the RDS instances in public subnets with network ACLs blocking inbound traffic.

Answer

Add a network ACL rule to deny all inbound traffic to the RDS subnets.

Answer

Use an AWS WAF web ACL attached to the RDS instances.

Question 15

Refer to the exhibit. A security engineer is reviewing VPC Flow Logs and sees the above entry. The engineer notices that traffic from IP 203.0.113.10 to an instance in the VPC on port 443 is being accepted. The security group for the instance only allows inbound HTTPS from the VPC CIDR (10.0.0.0/16). What is the most likely reason the traffic is accepted?

Accepted Answer

The VPC Flow Logs capture traffic before security group evaluation.. VPC Flow Logs capture traffic after network ACL evaluation but before security group evaluation. Therefore, the flow log shows ACCEPT because the network ACL allowed the traffic, but the security group would have subsequently dropped it. This explains why the flow log entry appears despite the security group denying traffic from 203.0.113.10.

Answer

The network ACL associated with the subnet has an inbound rule allowing port 443 from 203.0.113.10/32.

Answer

The network ACL inbound rule is evaluated before the security group inbound rule.

Answer

The security group has a default rule that allows all inbound traffic from the internet.