SCS-C02 Infrastructure Security Practice Test 6 — 15 Questions

Question 1

A company wants to launch an Amazon EC2 instance that must be accessible via SSH from the company's corporate network (IP range 198.51.100.0/24). The instance should not be accessible from the internet. Which network configuration should the security engineer recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the instance in a private subnet, and add a security group rule that allows SSH inbound from 198.51.100.0/24.. To allow SSH from a specific corporate IP range while preventing internet access, place the instance in a private subnet (no route to internet gateway) and use a security group rule that allows SSH inbound from 198.51.100.0/24. This ensures the instance is not publicly accessible and only the corporate network can connect.

Answer

Place the instance in a private subnet with a route to an internet gateway, and add a security group rule that allows SSH inbound from 198.51.100.0/24.

Answer

Place the instance in a public subnet, and add a network ACL rule that denies all inbound traffic from 0.0.0.0/0.

Answer

Place the instance in a public subnet, and add a security group rule that allows SSH inbound from 0.0.0.0/0.

Question 2

Refer to the exhibit. A security engineer reviews this CloudFormation template snippet. What is the security concern with this configuration?

Accepted Answer

The security group allows SSH access from any IP address.. It suggests detaching the volume before taking a snapshot, which is the recommended practice to ensure a consistent snapshot. Detaching a volume while the instance is running is possible for non-root volumes after unmounting, but for root volumes the instance must be stopped first. The original explanation incorrectly indicated Option C as correct.

Answer

The AMI ID is hardcoded.

Answer

The template does not specify a VPC.

Answer

The instance type is too small.

Question 3

Which TWO actions can help protect against DDoS attacks at the network layer?

Accepted Answer

Configure security groups to restrict inbound traffic.. Option A is correct because security groups act as stateful virtual firewalls at the instance/ENI level, and restricting inbound rules to only required ports, protocols, and trusted source CIDRs reduces the attack surface available to volumetric and protocol-based DDoS traffic at the network layer. Option D is correct because AWS Shield Advanced provides enhanced DDoS protection at layers 3/4/7 with always-on detection, automatic inline mitigations, and access to the AWS DDoS Response Team (DRT) plus cost protection for scaling during attacks. Option B is not appropriate because network ACLs are stateless and denying all inbound traffic would block legitimate traffic entirely rather than selectively mitigating attacks. Option C is not the best fit here because AWS WAF operates at layer 7 to filter HTTP/HTTPS requests, not at the network layer. Option E is incorrect because VPC peering connects VPCs for private routing and does not distribute or absorb DDoS traffic.

Answer

Configure network ACLs to deny all inbound traffic.

Answer

Use AWS WAF to filter malicious requests.

Answer

Use VPC peering to distribute traffic.

Question 4

A company uses AWS PrivateLink to connect to a SaaS provider's VPC endpoint service. The security team wants to ensure that traffic between the company's VPC and the SaaS provider's VPC is encrypted in transit and that no other AWS service can access the data. Which configuration meets these requirements?

Accepted Answer

Use an AWS PrivateLink endpoint (interface endpoint) in the company's VPC to connect to the SaaS provider's VPC endpoint service.. AWS PrivateLink uses interface VPC endpoints (powered by AWS PrivateLink) to establish a private connection between the company's VPC and the SaaS provider's VPC endpoint service. Traffic stays within the AWS network and is encrypted in transit using TLS (Transport Layer Security) when the application layer uses HTTPS, ensuring no other AWS service can intercept the data. This meets both the encryption and exclusive access requirements without traversing the internet or relying on VPNs.

Answer

Use a Site-to-Site VPN connection between the VPC and the SaaS provider's on-premises network.

Answer

Create a VPC peering connection and use security groups to restrict traffic.

Answer

Use an AWS Transit Gateway with inter-region peering.

Question 5

A company has a VPC with multiple subnets and uses VPC Flow Logs to capture network traffic. The security team notices that some expected traffic is not appearing in the logs. What is a likely cause?

Accepted Answer

The traffic is to or from the Amazon DNS server (169.254.169.253).. VPC Flow Logs do not capture traffic to or from the Amazon DNS server at 169.254.169.253 (and the reserved 169.254.169.254 for instance metadata). This is a documented exclusion, so expected DNS traffic will be missing from the logs. The other options describe configurations or traffic types that Flow Logs do capture.

Answer

Flow Logs are published to an S3 bucket instead of CloudWatch Logs.

Answer

The traffic uses UDP protocol.

Answer

The traffic is blocked by a security group rule.

Question 6

A company wants to provide its developers with IAM roles that allow them to launch EC2 instances with specific security groups. The security team wants to ensure that developers cannot launch instances without a security group. How can this be enforced?

Accepted Answer

Add a condition in the IAM policy that requires the ec2:SecurityGroup parameter to have a specific value.. You can use a condition in the IAM policy to require the security group. Option A is wrong because default security group is always attached if none specified, so that doesn't enforce. Option B is wrong because that is the default behavior, but developers can still launch without specifying a security group. Option D is wrong because that would allow any security group.

Answer

Create a service control policy that allows only the use of specific security groups.

Answer

Use an SCP to deny launching instances without a security group.

Answer

Configure the VPC to have no default security group.

Question 7

A company has an S3 bucket that stores sensitive data. The security team wants to ensure that all objects in the bucket are encrypted at rest. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Use an SCP to deny the s3:PutObject action unless the request includes the x-amz-server-side-encryption header.. The correct combination is option A and D. Option A uses an SCP to deny s3:PutObject unless the request includes the x-amz-server-side-encryption header, which enforces encryption at upload time across the account. Option D enables default encryption on the S3 bucket using SSE-S3 or SSE-KMS, ensuring that any object uploaded without explicit encryption headers is automatically encrypted. Together, these actions guarantee that all objects in the bucket are encrypted at rest. Option B is incorrect because creating a KMS key and assigning it to the bucket does not automatically encrypt objects; additional configuration like default encryption is needed. Option C is incorrect because CloudTrail only logs API calls and does not enforce encryption. Option E is incorrect because while a bucket policy can deny unencrypted PutObject, it is not as effective as an SCP for organization-wide enforcement, and the combination of SCP and default encryption provides a more robust solution.

Answer

Use AWS KMS to create a customer master key and assign it to the bucket.

Answer

Enable AWS CloudTrail to log S3 API calls.

Answer

Add a bucket policy that denies s3:PutObject if the object is not encrypted.

Question 8

A company wants to restrict access to an S3 bucket so that only objects uploaded with server-side encryption using AWS KMS are allowed. The bucket policy uses the 's3:x-amz-server-side-encryption' condition key. However, users can still upload unencrypted objects. What is the most likely reason?

Accepted Answer

The bucket policy uses an Allow effect instead of Deny for the condition.. The bucket policy uses an Allow effect with the condition, but to enforce encryption, it must explicitly Deny requests that do not meet the condition. An Allow with a condition only grants access when the condition is met; it does not prevent other policies from allowing unencrypted uploads. Therefore, users can still upload unencrypted objects if another policy allows it.

Answer

The user's IAM policy overrides the bucket policy.

Answer

The condition key is misspelled.

Answer

The bucket policy does not explicitly deny s3:PutObject.

Question 9

A company runs a containerized application on Amazon ECS with Fargate. The security team wants to ensure that the containers can only communicate with specific external APIs and not with other containers in the same task. Which security control should be applied?

Accepted Answer

Attach a security group to the ECS task with outbound rules allowing only the specific API endpoints.. Security groups attached to ECS tasks in awsvpc mode can control inbound and outbound traffic at the task level, allowing restriction of communication to specific external API endpoints. Option A is incorrect because network ACLs operate at the subnet level and are stateless, not suitable for per-task granularity. Option B is incorrect because IAM policies control API authorization, not network traffic. Option D is incorrect because VPC endpoints are used for private connectivity to AWS services, not for restricting container outbound traffic to external APIs.

Answer

Configure network ACLs on the subnets where the tasks run.

Answer

Apply an IAM policy to the task execution role to restrict API calls.

Answer

Use VPC endpoints to restrict traffic to specific APIs.

Question 10

A company wants to automate security assessments of its AWS environment. Which TWO AWS services can be used to perform vulnerability scanning and compliance checks?

Accepted Answer

Amazon Inspector. (Amazon Inspector) is correct for vulnerability scanning. Option C (AWS Security Hub) is correct for compliance checks. Option A (AWS Shield) is for DDoS protection. Option D (AWS WAF) is for web application firewall. Option E (AWS Config) tracks resource changes but does not perform vulnerability scanning or compliance checks.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config

Question 11

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager (A) is correct because it is purpose-built for centrally managing and enforcing security policies, including AWS WAF rules, security groups, AWS Network Firewall policies, and Shield Advanced protections, across all accounts and resources in an AWS Organization. AWS Network Firewall (B) is correct because it provides managed, VPC-level network traffic inspection and filtering (stateful/stateless rules, IPS, domain filtering) that can be deployed and governed organization-wide via Firewall Manager policies, making it appropriate for centralized network security in a multi-account strategy. VPC Peering (C) is not a security management service; it only provides private connectivity between VPCs and does not centrally enforce or manage security policy. AWS WAF (D) protects web applications at Layer 7 (HTTP/HTTPS) and, while it can be governed centrally through Firewall Manager, it is not itself a network security management service for the whole organization. Amazon GuardDuty (E) is a threat detection service that identifies malicious activity, but it does not centrally manage or enforce network security controls.

Answer

VPC Peering

Answer

AWS WAF

Answer

Amazon GuardDuty

Question 12

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Accepted Answer

Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.. Option C is correct because an IAM policy attached to the role must include the s3:ExistingObjectTag condition key to grant access only to objects that already carry the specified tag value, ensuring the role's permissions are tag-scoped. Option D is correct because a bucket policy can also enforce tag-based access using the s3:ExistingObjectTag condition key, which evaluates the tags on the existing object at request time. Option E is correct because an explicit Deny in the bucket policy for requests where the object lacks the required tag provides a hard guardrail that overrides any Allow, ensuring untagged objects cannot be accessed. Option A is not required because S3 Inventory is a reporting tool for listing objects and metadata, not an enforcement mechanism for tag-based access control. Option B is not required because CloudTrail object-level logging records access events for auditing, but it does not restrict or authorize access to objects based on tags.

Answer

Use S3 Inventory to list objects and their tags.

Answer

Enable S3 object-level logging in CloudTrail.

Question 13

A healthcare company runs a HIPAA-compliant application on AWS. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances behind an Auto Scaling group. The EC2 instances store sensitive patient data in an S3 bucket encrypted with SSE-KMS. The security team recently enabled AWS CloudTrail and Amazon GuardDuty. During a routine audit, they notice that an EC2 instance is making repeated API calls to the S3 bucket from an IP address outside the corporate network. The security team suspects the instance is compromised. What is the MOST effective immediate step to contain the potential breach while maintaining availability of the application?

Accepted Answer

Revoke the IAM role attached to the instance by removing the S3 permissions from the role.. The most effective immediate step to contain a potential breach while maintaining availability is to revoke the IAM role's permissions that allow the instance to access the S3 bucket. This immediately stops the unauthorized API calls without disrupting the application's other functions or terminating the instance. It aligns with the principle of least privilege and allows the security team to investigate further while keeping the application running.

Answer

Remove the security group that allows outbound traffic from the instance.

Answer

Stop the EC2 instance and detach it from the Auto Scaling group.

Answer

Terminate the EC2 instance immediately.

Question 14

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for whitelisting by third-party services. Which TWO actions should the engineer take?

Accepted Answer

Deploy a NAT Gateway in a public subnet and assign an Elastic IP.. Option D is correct because a NAT Gateway must be placed in a public subnet, and associating an Elastic IP with it provides the single, static public IP address that all outbound traffic from the private subnets will use, satisfying the third-party whitelisting requirement. Option E is correct because the VPC must have an Internet Gateway attached so that the public subnet (and thus the NAT Gateway) can reach the internet; without an IGW, the NAT Gateway cannot forward traffic to external destinations. Option A is incorrect because VPC Peering to another VPC with an IGW does not by itself provide a single whitelisted egress IP for the private subnets and adds unnecessary complexity. Option B is incorrect because a NAT Gateway cannot be deployed in a private subnet—it must reside in a public subnet with a route to an Internet Gateway. Option C is incorrect because routing a private subnet's default route directly to an Internet Gateway is not possible for private instances without public IPs and would not provide a single egress IP.

Answer

Use a VPC Peering connection to a central VPC with an Internet Gateway.

Answer

Deploy a NAT Gateway in a private subnet.

Answer

Configure the private subnet route table with a default route to an Internet Gateway.

Question 15

A company is deploying a new web application on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and the EC2 instances be encrypted using TLS. The ALB uses a certificate from AWS Certificate Manager (ACM). The EC2 instances are Linux-based and have a self-signed certificate installed. The security engineer configured the ALB target group to use HTTPS on port 443, and the EC2 security group allows inbound traffic on port 443 from the ALB security group. However, when testing, the application returns a 502 Bad Gateway error. The ALB health checks are failing. What is the likely cause?

Accepted Answer

The ALB is configured to verify the certificate on the backend instances, and the self-signed certificate is not trusted.. The ALB can be configured to verify the backend certificate when establishing TLS connections. By default, this verification is disabled, but it can be enabled via a target group attribute. In this scenario, the security team requires encrypted traffic between ALB and EC2, and they configured the target group to use HTTPS. If the target group has certificate verification enabled (e.g., via a mutual authentication policy), the ALB will check that the backend certificate is trusted. The self-signed certificate on the EC2 instances is not trusted by the ALB, causing the TLS handshake to fail. This leads to the health checks failing and the ALB returning 502 Bad Gateway errors. The other options are less likely because the question states health checks are failing; if the web server were not running or the security group were misconfigured, the health check would also fail but the specific mention of a self-signed certificate points to certificate verification as the root cause.

Answer

The EC2 instances are not running a web server listening on port 443.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB on the health check port.

Answer

The target group health check is configured to use the same port as the traffic port (443), but the health check path is incorrect.