SCS-C02 Infrastructure Security Practice Test 5 — 15 Questions

Question 1

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Accepted Answer

An internet gateway attached to the VPC.. Options A, B, and E are correct. A NAT gateway or NAT instance in a public subnet provides outbound internet access. Route tables in private subnets must have a default route pointing to the NAT device. An internet gateway is needed to provide internet connectivity to the public subnet. Option C is wrong because a VPC gateway endpoint is for S3/DynamoDB, not general internet. Option D is wrong because AWS WAF is a web application firewall.

Answer

AWS WAF attached to the NAT gateway.

Answer

A VPC gateway endpoint for S3.

Question 2

A company is using AWS Organizations to manage multiple accounts. The security team wants to restrict the use of specific instance types across all accounts. Which two AWS services can enforce this restriction? (Choose TWO.)

Accepted Answer

Service control policies (SCPs). Options B and D are correct. SCPs in AWS Organizations can deny specific instance types across all accounts. AWS Config rules can evaluate instance types and trigger remediation. Option A is wrong because IAM policies are per-account and cannot be applied across all accounts centrally. Option C is wrong because CloudTrail only logs. Option E is wrong because VPC flow logs monitor network traffic.

Answer

IAM policies

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Use an HTTPS listener on the ALB and configure the target group with HTTPS.. Option D is correct because HTTPS listeners on the ALB terminate the client's TLS connection and establish a new TLS connection to the target group, ensuring encryption. Option A is wrong because HTTP does not encrypt traffic. Option B is wrong because security group rules do not enforce encryption. Option C is wrong because TCP listeners do not provide encryption.

Answer

Use a TCP listener on the ALB and a TCP target group.

Answer

Configure security group inbound rules to allow only HTTPS traffic.

Answer

Use an HTTP listener on the ALB and HTTP on the target group.

Question 4

A security engineer needs to ensure that an EC2 instance can only be launched using an approved Amazon Machine Image (AMI) from a specific AWS account. Which AWS service should be used to enforce this requirement?

Accepted Answer

AWS Service Catalog. Option A is correct because AWS Service Catalog allows organizations to create and manage a catalog of approved products, including EC2 instances with specific AMIs. Option B is wrong because AWS Config can detect noncompliant instances but does not prevent launch. Option C is wrong because IAM policies can restrict actions but not specific AMIs. Option D is wrong because EC2 Image Builder builds images but does not enforce their use.

Answer

IAM policies

Answer

AWS Config

Answer

AWS Image Builder

Question 5

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service provides a managed, highly available, and scalable solution for this requirement?

Accepted Answer

NAT Gateway in a public subnet. Option B is correct because a NAT Gateway provides outbound internet access for instances in private subnets and is managed by AWS. Option A is wrong because a NAT instance is not managed. Option C is wrong because an Internet Gateway is used for public subnets. Option D is wrong because a VPN connection is for hybrid networking, not internet access.

Answer

NAT instance in a public subnet

Answer

Internet Gateway attached to the VPC

Answer

AWS Site-to-Site VPN connection

Question 6

An organization uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which approach would enforce this across all accounts?

Accepted Answer

Apply a Service Control Policy that denies PutBucketPolicy or PutBucketEncryption without encryption.. Option D is correct because a Service Control Policy (SCP) can deny actions that create or modify S3 buckets without encryption. Option A is wrong because AWS Config is detective. Option B is wrong because IAM roles in each account require manual setup. Option C is wrong because S3 Bucket Policies are per-bucket and not centralized.

Answer

Create IAM roles in each account to enforce encryption.

Answer

Apply an S3 bucket policy to each bucket requiring encryption.

Answer

Use AWS Config rules to detect unencrypted buckets.

Question 7

A company is designing a network architecture for a multi-tier web application. The application consists of a public-facing ALB, web servers in private subnets, and an RDS database in isolated subnets. The security team requires that the web servers have no direct internet access. Which VPC configuration meets this requirement?

Accepted Answer

Private subnets with a NAT Gateway in a public subnet.. Option B is correct because private subnets with a NAT Gateway allow outbound internet access for updates while preventing inbound internet traffic. Option A is wrong because public subnets have direct internet access. Option C is wrong because isolated subnets cannot access the internet even for updates. Option D is wrong because a VPN does not provide internet access.

Answer

Public subnets with an Internet Gateway.

Answer

Isolated subnets with no route to the internet.

Answer

Private subnets with a VPN connection to the corporate network.

Question 8

A company wants to use AWS WAF to protect its web application from common web exploits. Which AWS service must be integrated with AWS WAF to provide this protection?

Accepted Answer

Application Load Balancer or Amazon CloudFront. Option B is correct because AWS WAF is integrated with CloudFront and ALB to filter requests. Option A is wrong because Network ACLs are stateless and not application-layer. Option C is wrong because Security Groups are stateful firewalls at the instance level. Option D is wrong because Route 53 is DNS, not a web traffic endpoint.

Answer

Security Groups

Answer

Amazon Route 53

Answer

Network ACLs

Question 9

A security engineer is designing a network segmentation strategy for a VPC that hosts sensitive data. The engineer needs to ensure that EC2 instances in a private subnet can communicate with an RDS database in a different private subnet, but cannot communicate with any other resources in the same VPC. Which configuration should be used?

Accepted Answer

Configure security groups for the EC2 instances that only allow outbound traffic to the RDS security group, and RDS security group allows inbound from the EC2 security group.. Option D is correct because a combination of security groups and network ACLs can enforce least-privilege rules. Option A is wrong because VPC peering is for cross-VPC. Option B is wrong because a single security group shared would allow broader communication. Option C is wrong because NACLs alone are not enough for instance-level granularity.

Answer

Create a VPC peering connection between the subnets.

Answer

Assign the same security group to both the EC2 instances and the RDS database.

Answer

Use network ACLs with deny rules for all traffic except between the two subnets.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. The security team needs to ensure that all CloudFormation stacks include a specific tag with a value that complies with corporate policies. Which AWS service can enforce this requirement?

Accepted Answer

AWS Service Catalog. Option A is correct because AWS Service Catalog can enforce tag requirements on provisioned products. Option B is wrong because AWS Config can detect but not enforce. Option C is wrong because IAM policies can require tags but not specific values. Option D is wrong because CloudTrail logs API calls but does not enforce.

Answer

AWS Config

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Question 11

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. The security team wants to create a subnet for a legacy application that requires 2000 IP addresses. What is the smallest subnet CIDR that meets this requirement?

Accepted Answer

10.0.0.0/20. Option C is correct because a /20 subnet provides 4096 IP addresses (minus 5 reserved), which is the smallest that can accommodate 2000. Option A /24 provides 256 IPs, too small. Option B /22 provides 1024 IPs, too small. Option D /19 provides 8192 IPs, larger than needed.

Answer

10.0.0.0/24

Answer

10.0.0.0/22

Answer

10.0.0.0/19

Question 12

A company uses AWS Organizations and wants to restrict the use of specific instance types across all accounts. Which TWO actions should be taken to enforce this restriction?

Accepted Answer

Apply a Service Control Policy (SCP) that denies ec2:RunInstances with noncompliant instance types.. Options B and D are correct. SCPs can deny actions based on instance type, and AWS Config can detect noncompliant instances. Option A is wrong because IAM roles do not restrict resource types. Option C is wrong because CloudTrail does not enforce. Option E is wrong because VPC does not relate to instance types.

Answer

Restrict instance types at the VPC level using network ACLs.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Create an IAM role that denies launch of noncompliant instances.

Question 13

A security engineer is designing a secure VPC architecture for a web application that must be accessible from the internet. The application runs on EC2 instances in private subnets. Which THREE components are required to provide secure internet connectivity?

Accepted Answer

Public subnets with routes to the IGW. Options A, C, and D are correct. An Internet Gateway is needed for public subnets, a NAT Gateway in a public subnet provides outbound access for private instances, and public subnets host the NAT Gateway and potentially an ALB. Option B is wrong because a Virtual Private Gateway is for VPN connections. Option E is wrong because a Transit Gateway is not required.

Answer

Virtual Private Gateway (VGW)

Answer

Transit Gateway

Question 14

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Accepted Answer

AWS WAF. Options B and C are correct. AWS WAF provides application-layer protection (e.g., SQL injection), and Security Groups act as a virtual firewall for network-layer protection. Option A is wrong because NACLs are network-layer but stateless and less granular. Option D is wrong because GuardDuty is a threat detection service, not a prevention firewall. Option E is wrong because Shield Advanced provides DDoS protection but is not a firewall.

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 15

A company wants to ensure that all Amazon EC2 instances in a VPC can only be accessed via SSH from a specific IP address range (203.0.113.0/24). Which VPC component should be used to enforce this restriction?

Accepted Answer

Network ACL. Option A is correct because a network ACL is a stateless firewall that controls inbound and outbound traffic at the subnet level, and can restrict SSH access to a specific IP range. Option B is wrong because security groups are stateful and cannot deny traffic by IP in a single rule (they only allow). Option C is wrong because an internet gateway is not a security control. Option D is wrong because a route table only controls traffic routing, not filtering.

Answer

Security group

Answer

Route table

Answer

Internet gateway