SCS-C02 Infrastructure Security Practice Test 6 — 15 Questions

Question 1

Which TWO of the following are valid ways to control inbound traffic to an EC2 instance? (Select TWO.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are a valid method to control inbound traffic to an EC2 instance because they act as a stateless firewall at the subnet level. Each NACL rule evaluates inbound traffic based on source IP, protocol, and port, and rules are processed in order from lowest to highest number. Since NACLs are stateless, you must explicitly allow both inbound and outbound traffic for a response to return.

Answer

IAM policies

Answer

Amazon CloudWatch alarms

Answer

AWS Key Management Service (KMS)

Question 2

A company is using AWS WAF to protect a web application. The security team notices that a specific IP address is generating a high volume of requests and triggering the WAF rate-based rule. However, the IP address is a legitimate partner's static IP. What should the security team do to allow this IP while still protecting against other malicious traffic?

Accepted Answer

Add a rule with an IP set condition that allows the partner's IP as an exception to the rate-based rule.. AWS WAF allows you to add a rule with an IP set condition that explicitly allows traffic from the partner's static IP address. By placing this allow rule at a higher priority than the rate-based rule, the partner's requests bypass the rate limit while all other traffic is still subject to the rate-based rule. This approach ensures the legitimate partner is not blocked without weakening the overall security posture.

Answer

Create an IP set and whitelist the IP address in the web ACL default action.

Answer

Increase the rate limit for the rate-based rule to accommodate the partner's traffic.

Answer

Disable the rate-based rule for the partner's IP by modifying the rule scope.

Question 3

A security engineer is designing a VPC with public and private subnets. The VPC will host web servers in public subnets and database servers in private subnets. The web servers need to send traffic to the database servers, and the database servers must not have direct internet access. Which TWO configurations should the engineer implement?

Accepted Answer

Configure security group rules to allow inbound traffic from the web server security group to the database security group.. Security group rules are stateful and can reference other security groups as a source, allowing the web server security group to be specified as the source for inbound traffic to the database security group. This ensures that only traffic originating from the web servers is permitted to reach the database servers, providing a logical, application-layer firewall without exposing the databases to the internet. Option C is correct because omitting a route to an internet gateway from the private subnet's route table ensures that the database servers have no direct path to the internet, satisfying the requirement that they must not have direct internet access.

Answer

Use network ACLs to block all inbound traffic to the private subnets.

Answer

Attach an internet gateway to the VPC and route the private subnets to it.

Answer

Add a NAT gateway in the public subnet and route the private subnets to it.

Question 4

An organization has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that no Amazon EC2 instances are launched without an IAM instance profile that includes a specific role. Which preventive control should be implemented?

Accepted Answer

Create an SCP that denies ec2:RunInstances when the condition iam:InstanceProfile is not set to the required profile ARN.. AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to prevent actions across all principals. By using the `iam:InstanceProfile` condition key with the `ec2:RunInstances` action, the SCP denies the launch of any EC2 instance that does not have the required IAM instance profile attached. This is a preventive control that blocks the action before it occurs, ensuring compliance across the entire multi-account environment.

Answer

Attach an IAM policy to all users that denies ec2:RunInstances unless an instance profile is specified.

Answer

Create an SCP that denies ec2:RunInstances when the condition ec2:InstanceProfile is not set.

Answer

Use AWS Config rule ec2-instance-profile-attached to detect non-compliant instances and automatically terminate them.

Question 5

A security engineer is configuring a VPC with a public subnet for web servers and a private subnet for databases. The web servers need to download patches from the internet. Which TWO components are required to allow the web servers to access the internet while keeping the database servers isolated?

Accepted Answer

Internet gateway attached to the VPC.. Web servers in a private subnet require both an Internet Gateway (IGW) attached to the VPC and a NAT Gateway in a public subnet to access the internet. The IGW provides internet connectivity to the VPC, and the NAT Gateway allows instances in private subnets to initiate outbound connections to the internet while preventing inbound connections from the internet. The database servers remain isolated because they are in a private subnet without a NAT Gateway or direct route to the IGW.

Answer

VPC endpoint for Amazon S3.

Answer

Transit gateway between the public and private subnets.

Answer

Virtual private gateway attached to the VPC.

Question 6

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are not tampered with and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

Enable log file integrity validation in CloudTrail.. CloudTrail log file integrity validation uses a hash chain (SHA-256) to create a digest file that proves log files have not been modified, deleted, or tampered with since delivery. This feature allows you to verify that CloudTrail log files have remained unchanged, meeting the security team's requirement for integrity verification.

Answer

Enable MFA delete on the log bucket.

Answer

Enable server-side encryption with AWS KMS on the log bucket.

Answer

Enable S3 versioning on the log bucket.

Question 7

A company is deploying a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The security team wants to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Accepted Answer

AWS WAF.. AWS WAF is a web application firewall that helps protect web applications from common web exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and filter malicious traffic based on customizable rules, including managed rule groups for OWASP Top 10 threats.

Answer

AWS Network Firewall.

Answer

AWS Shield Advanced.

Answer

AWS Security Hub.

Question 8

A security engineer is tasked with securing an Amazon RDS for MySQL database. The database must be accessible only from a specific set of EC2 instances. Which THREE steps should the engineer take?

Accepted Answer

Enable encryption at rest for the RDS instance.. Enabling encryption at rest for the RDS instance ensures that data stored on the underlying storage is encrypted using AWS Key Management Service (KMS). This is a security best practice for protecting sensitive data at rest, and it does not conflict with the requirement to restrict network access. Encryption at rest is independent of network access controls and is essential for compliance with many security frameworks.

Answer

Disable encryption at rest to improve performance.

Answer

Associate the RDS instance with a public subnet for easier access.

Question 9

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled in all regions. Which approach should be used?

Accepted Answer

Enable AWS CloudTrail from the master account as an organization trail.. AWS Organizations allows you to create an organization trail from the management account that automatically applies to all member accounts and all regions. This ensures CloudTrail is enabled across the entire organization without requiring per-account configuration, and it centralizes log delivery to a single Amazon S3 bucket for auditing.

Answer

Create an SCP that requires CloudTrail to be enabled.

Answer

Enable CloudTrail in each account using a cross-account IAM role.

Answer

Use AWS Config rules to detect non-compliant accounts and automatically enable CloudTrail.

Question 10

A company has an Amazon S3 bucket that stores sensitive data. The security team needs to ensure that all access to the bucket is encrypted in transit. Which condition should be added to the bucket policy?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key in an S3 bucket policy enforces that all requests to the bucket must be made over HTTPS (TLS). When set to `false`, any HTTP request is denied, ensuring data is encrypted in transit. This directly addresses the security team's requirement to encrypt all access to the bucket during transmission.

Answer

aws:SourceIp

Answer

s3:x-amz-server-side-encryption

Answer

aws:UserAgent

Question 11

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow all EC2 actions except deleting volumes in the Production environment. However, the user reports being able to delete volumes that are tagged with Environment=Production. What is the reason for this behavior?

Accepted Answer

The condition in the Deny statement uses StringNotEquals, which denies deletion for non-Production volumes, not Production volumes.. The Deny statement uses the StringNotEquals condition operator with ec2:ResourceTag/Environment=Production. This means the Deny applies when the tag value is NOT equal to Production, so it denies deletion for non-Production volumes but allows deletion for Production volumes. To deny deletion of Production volumes, the policy should use StringEquals instead of StringNotEquals.

Answer

The policy is not attached to the correct IAM entity.

Answer

The Deny statement should use iam:ResourceTag instead of ec2:ResourceTag.

Answer

The Allow statement uses a wildcard for the action, which overrides the Deny statement.

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have encryption enabled. Which approach is MOST effective and scalable?

Accepted Answer

Apply a service control policy (SCP) that denies s3:CreateBucket unless the bucket has encryption enabled.. A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny the s3:CreateBucket action unless the bucket is created with encryption enabled, using a condition key like s3:x-amz-server-side-encryption. This approach is most effective and scalable as it prevents non-compliant buckets from being created in any account under the SCP's scope, enforcing the security team's requirement proactively across all accounts without relying on per-account policies or post-creation remediation.

Answer

Use an S3 bucket policy in each account to deny PutObject without encryption.

Answer

Use AWS Config rules to mark non-compliant buckets and automatically remediate.

Answer

Enable CloudTrail and monitor for buckets without encryption.

Question 13

A company needs to securely store database credentials used by a Lambda function. The credentials must be automatically rotated. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets throughout their lifecycle. It natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB databases without requiring custom code, and it integrates directly with Lambda via the AWS SDK to retrieve secrets on demand.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all CloudFormation stacks include a specific tag "Environment" with a value of "Production" or "Development". Which approach should be used?

Accepted Answer

Use AWS CloudFormation Guard to validate that the template includes the required tag with allowed values.. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to validate CloudFormation templates before they are used to create or update stacks. By writing a Guard rule that checks for the 'Environment' tag with allowed values of 'Production' or 'Development', you can enforce this requirement at the template level, preventing non-compliant stacks from being deployed. This approach is proactive, catching violations during the authoring or CI/CD pipeline stage rather than after deployment.

Answer

Apply an IAM policy that requires the tag on all CloudFormation actions.

Answer

Use AWS Config to detect and automatically remediate non-compliant stacks.

Answer

Create an SCP to deny CloudFormation stacks that do not have the required tag.

Question 15

A company wants to ensure that all Amazon S3 bucket policies comply with a security baseline that prohibits public read access. Which TWO methods can be used to detect non-compliant buckets? (Choose TWO.)

Accepted Answer

Use IAM Access Analyzer to review bucket policies for public access.. IAM Access Analyzer reviews resource policies to identify resources shared with an external entity. For S3 buckets, it can analyze bucket policies and detect if they grant public read access (i.e., access to 'Principal': '*'). This directly identifies non-compliant buckets against the security baseline that prohibits public read access.

Answer

Enable AWS CloudTrail to monitor GetPublicAccessBlock calls.

Answer

Use Amazon Inspector to scan bucket policies.

Answer

Use AWS Trusted Advisor to check S3 bucket permissions.