SCS-C02 Infrastructure Security Practice Test 5 — 15 Questions

Question 1

A security engineer is designing a VPC with public and private subnets. The private subnets must be able to download software updates from the internet. Which TWO components can provide this functionality without exposing the private instances to inbound internet traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT gateway. A NAT gateway is a managed AWS service that enables instances in a private subnet to initiate outbound traffic to the internet (e.g., for downloading software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address, allowing return traffic to be routed back correctly. This meets the requirement of outbound-only internet access without exposing private instances to inbound traffic.

Answer

Internet gateway

Answer

VPC endpoint

Answer

Egress-only internet gateway

Question 2

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that the logs are protected from unauthorized access and deletion. Which TWO actions should be taken?

Accepted Answer

Enable server-side encryption using AWS KMS (SSE-KMS) on the S3 bucket.. Enabling server-side encryption using AWS KMS (SSE-KMS) on the S3 bucket that stores CloudTrail logs ensures that the log files are encrypted at rest, protecting them from unauthorized access. This encryption uses envelope encryption with a customer-managed or AWS-managed KMS key, providing an additional layer of access control via KMS key policies and IAM policies. Option C is correct because CloudTrail log file validation creates a signed digest file for each log file, allowing you to verify that the logs have not been tampered with, deleted, or modified after delivery. This uses SHA-256 hashing and digital signing with the private key of AWS, ensuring integrity and authenticity of the log files.

Answer

Use S3 bucket ACLs to restrict access.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) for CloudTrail.

Question 3

A company is designing a security group for a web server that must allow HTTP (80) and HTTPS (443) traffic from the internet. The server also needs to make outbound connections to an Amazon RDS database on port 3306 and to the internet for software updates. Which THREE rules should be included in the security group? (Select THREE.)

Accepted Answer

Inbound: HTTPS (443) from 0.0.0.0/0. The web server needs to accept HTTP (80) and HTTPS (443) traffic from the internet, so inbound rules allowing 0.0.0.0/0 on ports 80 and 443 are required (Options C and E). Additionally, the server must make outbound connections to the internet for software updates, which requires an outbound rule allowing HTTPS (443) to 0.0.0.0/0 (Option D). Thus, the three correct rules are: inbound HTTP, inbound HTTPS, and outbound HTTPS to 0.0.0.0/0. Note that outbound MySQL to the VPC CIDR block is not required for this question's focus on internet-facing and update connections.

Answer

Inbound: MySQL (3306) from the VPC CIDR block

Answer

Outbound: MySQL (3306) to the VPC CIDR block

Question 4

Refer to the exhibit. The bucket policy allows access from a specific IP range and denies access over HTTP. A user from IP 198.51.100.5 makes a GET request over HTTPS. What will happen?

Accepted Answer

Denied because no explicit allow matches the request.. In AWS S3 bucket policies, an explicit Deny always overrides any Allow, but the request must first match a Deny condition. Here, the Deny condition applies to HTTP requests, but the request is HTTPS, so the Deny does not apply. However, the bucket policy only allows access from a specific IP range, and the user's IP (198.51.100.5) is not within that allowed range. Since no explicit Allow matches the request, the default implicit Deny applies, resulting in access being denied.

Answer

Denied because of the explicit Deny statement.

Answer

Allowed because the request is over HTTPS.

Answer

Allowed because the Deny condition is not satisfied.

Question 5

Refer to the exhibit. A security engineer runs the iptables command on an EC2 instance in a VPC. The instance has a security group that allows all outbound traffic and inbound SSH from 0.0.0.0/0, HTTP from 0.0.0.0/0, and HTTPS from 0.0.0.0/0. A user from IP 203.0.113.5 tries to connect to the instance over HTTP. What will happen?

Accepted Answer

The connection is dropped by iptables.. The iptables command shown in the exhibit (not provided here but implied to have a default DROP or REJECT policy on the INPUT chain, or a specific rule that drops HTTP traffic) overrides the security group's permissive rules. Security groups act as a virtual firewall at the instance level, but iptables operates within the instance's OS kernel netfilter framework and is evaluated after the security group. Since iptables drops the HTTP connection, the packet is discarded before reaching the application, regardless of the security group allowing HTTP from 0.0.0.0/0.

Answer

The connection succeeds because the security group allows HTTP.

Answer

The connection succeeds because iptables allows HTTP from anywhere.

Answer

The connection is dropped by the security group.

Question 6

A security engineer is designing a network ACL for a public subnet containing an Application Load Balancer. The subnet must allow inbound HTTPS traffic from the internet and outbound traffic to the internet for patches. Which inbound rule should be added?

Accepted Answer

Allow TCP port 443 from 0.0.0.0/0. HTTPS traffic uses TCP port 443, and the network ACL must explicitly allow inbound TCP traffic on port 443 from the internet (0.0.0.0/0) to reach the Application Load Balancer. Network ACLs are stateless, so each direction requires a separate rule; this inbound rule permits the initial HTTPS connection requests.

Answer

Allow TCP port 1024-65535 from 0.0.0.0/0

Answer

Allow UDP port 443 from 0.0.0.0/0

Answer

Allow all traffic from 0.0.0.0/0

Question 7

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team suspects that a DDoS attack is targeting the application. Which AWS service can be used to absorb and mitigate the attack at the network layer before traffic reaches the ALB?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protections against larger and more sophisticated DDoS attacks, including network-layer (Layer 3/4) attacks such as UDP floods, SYN floods, and reflection attacks. It integrates directly with Application Load Balancers to absorb and mitigate malicious traffic before it reaches the ALB, ensuring the application remains available. This makes it the correct choice for mitigating a DDoS attack at the network layer.

Answer

AWS WAF

Answer

AWS Identity and Access Management (IAM)

Answer

Network ACLs

Question 8

A company wants to allow an EC2 instance in a VPC to download patches from the internet but block all other outbound traffic. Which configuration should be used?

Accepted Answer

Place a NAT Gateway in a public subnet and route the EC2 instance's traffic through it. A NAT Gateway in a public subnet allows outbound traffic from private subnets to the internet while preventing inbound traffic from the internet. By routing the EC2 instance's traffic through the NAT Gateway, the instance can download patches (outbound) but cannot be reached from the internet, satisfying the requirement to block all other outbound traffic (i.e., only patch downloads are allowed, but the NAT Gateway itself does not filter by destination; additional security group or NACL rules would be needed to restrict to patch servers only).

Answer

Use a Virtual Private Gateway and connect to a VPN

Answer

Attach an Internet Gateway and add a route 0.0.0.0/0 to the EC2 instance's route table

Answer

Use a VPC Peering connection to an external VPC with internet access

Question 9

A company has a security group that allows inbound SSH from a specific IP range. A security engineer notices that the security group rule is not being applied to a newly launched EC2 instance. What is the most likely cause?

Accepted Answer

The new EC2 instance was not launched with the correct security group. The most likely cause is that the new EC2 instance was not launched with the correct security group. Security groups act as virtual firewalls for instances, and an instance can only be associated with security groups at launch time. If the engineer launched the instance without explicitly selecting the security group that allows inbound SSH from the specific IP range, the instance would default to the VPC's default security group, which typically does not have the same custom SSH rule. This is a common operational oversight when automating or manually launching instances.

Answer

The security group is using the default VPC security group

Answer

The security group is configured as stateless

Answer

The network ACL is blocking SSH traffic to the subnet

Question 10

A company uses AWS Systems Manager Session Manager to manage EC2 instances without opening inbound ports. Which IAM policy is required for an EC2 instance to allow Session Manager to connect?

Accepted Answer

AmazonSSMManagedInstanceCore. The AmazonSSMManagedInstanceCore policy grants the minimum permissions required for an EC2 instance to communicate with the Systems Manager service via the SSM Agent, including sending heartbeats, receiving commands, and establishing Session Manager connections. Session Manager does not require inbound ports; it relies on the instance initiating outbound HTTPS connections (port 443) to the SSM endpoints, so the instance needs only the permissions in this managed policy to function as a managed node.

Answer

AmazonSSMFullAccess

Answer

AmazonEC2FullAccess

Answer

AdministratorAccess

Question 11

A security engineer needs to ensure that all traffic between two EC2 instances in different subnets is encrypted in transit. What is the most secure and efficient solution?

Accepted Answer

Set up an IPsec VPN between the instances. An IPsec VPN between the two EC2 instances provides end-to-end encryption of all traffic at the network layer, regardless of the application protocol. This ensures that data in transit between the instances is encrypted using IPsec (ESP/AH), which is the most secure and efficient solution for encrypting traffic between two specific instances in different subnets without relying on the underlying network infrastructure.

Answer

Configure network ACLs to allow traffic

Answer

Use VPC Peering

Answer

Configure security groups to allow traffic

Question 12

A company's security team wants to detect and block malicious SQL injection attempts against an Application Load Balancer. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that can be associated with an Application Load Balancer to inspect HTTP/HTTPS requests for malicious patterns, such as SQL injection attempts. It uses managed rule sets (e.g., AWS Managed Rules for SQL injection) to detect and block these attacks in real time, making it the correct choice for this use case.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Shield Advanced

Question 13

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy type should be used?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. An S3 bucket policy with the `aws:SourceVpc` condition key allows you to restrict access to the bucket so that only requests originating from a specific VPC are permitted. This is the correct approach because S3 bucket policies are resource-based policies that can evaluate the source VPC of a request via the VPC endpoint, providing a direct and granular access control mechanism for VPC-restricted access.

Answer

IAM policy

Answer

Network ACL

Answer

VPC Endpoint policy

Question 14

Which TWO of the following are valid methods to protect sensitive data in transit between an on-premises data center and AWS? (Select TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (Option B) creates an encrypted tunnel between an on-premises VPN device and a Virtual Private Gateway in AWS, using IPSec to protect data in transit. This ensures confidentiality and integrity of data crossing the public internet, making it a valid method for securing sensitive data between an on-premises data center and AWS.

Answer

AWS Transit Gateway

Answer

Internet Gateway

Answer

VPC Peering

Question 15

Which THREE of the following are best practices for securing an Amazon RDS database instance? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS. Enabling encryption at rest using AWS KMS ensures that the underlying storage for the RDS instance, automated backups, read replicas, and snapshots are encrypted using AES-256. This protects data at rest from unauthorized physical access or storage media theft, and is a fundamental security best practice for compliance frameworks like PCI DSS and HIPAA.

Answer

Enable public accessibility for ease of management

Answer

Use the default database port