SCS-C02 Infrastructure Security Practice Test 7 — 15 Questions

Question 1

A security engineer is designing a network ACL for a public subnet containing an Application Load Balancer. The subnet must allow inbound HTTPS traffic from the internet and outbound traffic to the internet for patches. Which inbound rule should be added?

Accepted Answer

Allow TCP port 443 from 0.0.0.0/0. Option B is correct because HTTPS uses TCP port 443. Option A is wrong because HTTPS does not use UDP. Option C is wrong because the ALB should not allow all inbound traffic. Option D is wrong because ephemeral ports are for outbound, not inbound.

Answer

Allow TCP port 1024-65535 from 0.0.0.0/0

Answer

Allow UDP port 443 from 0.0.0.0/0

Answer

Allow all traffic from 0.0.0.0/0

Question 2

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team suspects that a DDoS attack is targeting the application. Which AWS service can be used to absorb and mitigate the attack at the network layer before traffic reaches the ALB?

Accepted Answer

AWS Shield Advanced. Option C is correct because AWS Shield Advanced provides enhanced DDoS mitigation for ALB. Option A is wrong because IAM is for access management. Option B is wrong because WAF is for application layer. Option D is wrong because NACLs are stateless and not designed for DDoS mitigation.

Answer

AWS WAF

Answer

AWS Identity and Access Management (IAM)

Answer

Network ACLs

Question 3

A company wants to allow an EC2 instance in a VPC to download patches from the internet but block all other outbound traffic. Which configuration should be used?

Accepted Answer

Place a NAT Gateway in a public subnet and route the EC2 instance's traffic through it. Option A is correct because a NAT Gateway in a public subnet allows outbound internet access while blocking inbound. Option B is wrong because an Internet Gateway directly attached would allow bidirectional traffic. Option C is wrong because a VPN does not provide internet access. Option D is wrong because VPC Peering does not provide internet access.

Answer

Use a Virtual Private Gateway and connect to a VPN

Answer

Attach an Internet Gateway and add a route 0.0.0.0/0 to the EC2 instance's route table

Answer

Use a VPC Peering connection to an external VPC with internet access

Question 4

A company has a security group that allows inbound SSH from a specific IP range. A security engineer notices that the security group rule is not being applied to a newly launched EC2 instance. What is the most likely cause?

Accepted Answer

The new EC2 instance was not launched with the correct security group. Option B is correct because security groups are attached at the instance level; a new instance must have the security group assigned. Option A is wrong because security groups are stateful. Option C is wrong because NACLs are subnet-level, not instance-level. Option D is wrong because the default security group does not automatically include custom rules.

Answer

The security group is using the default VPC security group

Answer

The security group is configured as stateless

Answer

The network ACL is blocking SSH traffic to the subnet

Question 5

A company uses AWS Systems Manager Session Manager to manage EC2 instances without opening inbound ports. Which IAM policy is required for an EC2 instance to allow Session Manager to connect?

Accepted Answer

AmazonSSMManagedInstanceCore. Option C is correct because SSM Agent requires the AmazonSSMManagedInstanceCore policy to communicate with Systems Manager. Option A is wrong because it is for admin users. Option B is wrong because it allows EC2 actions, not SSM. Option D is wrong because it allows full SSM access, which is excessive.

Answer

AmazonSSMFullAccess

Answer

AmazonEC2FullAccess

Answer

AdministratorAccess

Question 6

A security engineer needs to ensure that all traffic between two EC2 instances in different subnets is encrypted in transit. What is the most secure and efficient solution?

Accepted Answer

Set up an IPsec VPN between the instances. Option A is correct because an IPSec VPN provides encryption in transit. Option B is wrong because VPC Peering does not encrypt traffic. Option C is wrong because security groups do not encrypt. Option D is wrong because NACLs do not encrypt.

Answer

Configure network ACLs to allow traffic

Answer

Use VPC Peering

Answer

Configure security groups to allow traffic

Question 7

A company's security team wants to detect and block malicious SQL injection attempts against an Application Load Balancer. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that can be associated with an Application Load Balancer to inspect HTTP/HTTPS requests for malicious patterns, such as SQL injection attempts. It uses managed rule sets (e.g., AWS Managed Rules for SQL injection) to detect and block these attacks in real time, making it the correct choice for this use case.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Shield Advanced

Question 8

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy type should be used?

Accepted Answer

S3 bucket policy with aws:SourceVpc condition. Option B is correct because an S3 bucket policy with a condition for aws:SourceVpc can restrict access to a VPC. Option A is wrong because IAM policies grant permissions to users, not network restrictions. Option C is wrong because VPC Endpoint policies control actions on the endpoint, not the bucket. Option D is wrong because NACLs are for subnets, not S3.

Answer

IAM policy

Answer

Network ACL

Answer

VPC Endpoint policy

Question 9

Which TWO of the following are valid methods to protect sensitive data in transit between an on-premises data center and AWS? (Select TWO.)

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (Option B) creates an encrypted tunnel between an on-premises VPN device and a Virtual Private Gateway in AWS, using IPSec to protect data in transit. This ensures confidentiality and integrity of data crossing the public internet, making it a valid method for securing sensitive data between an on-premises data center and AWS.

Answer

AWS Transit Gateway

Answer

Internet Gateway

Answer

VPC Peering

Question 10

Which THREE of the following are best practices for securing an Amazon RDS database instance? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS. Options A, B, and E are correct because encryption at rest, private subnet, and strong passwords are security best practices. Option C is wrong because public accessibility should be disabled. Option D is wrong because default ports should be changed or firewalled, but this is not a primary best practice compared to the others.

Answer

Enable public accessibility for ease of management

Answer

Use the default database port

Question 11

Which TWO of the following are valid ways to control inbound traffic to an EC2 instance? (Select TWO.)

Accepted Answer

Network ACLs. Options A and D are correct because security groups are stateful firewalls for instances, and NACLs are stateless firewalls for subnets. Option B is wrong because IAM does not control network traffic. Option C is wrong because CloudWatch monitors, not controls. Option E is wrong because KMS manages encryption keys.

Answer

IAM policies

Answer

Amazon CloudWatch alarms

Answer

AWS Key Management Service (KMS)

Question 12

A company is using AWS WAF to protect a web application. The security team notices that a specific IP address is generating a high volume of requests and triggering the WAF rate-based rule. However, the IP address is a legitimate partner's static IP. What should the security team do to allow this IP while still protecting against other malicious traffic?

Accepted Answer

Add a rule with an IP set condition that allows the partner's IP as an exception to the rate-based rule.. Option C is correct because adding a WAF IP set condition that allows the partner's IP as an exception to the rate-based rule ensures that legitimate traffic is not blocked while other traffic is still subject to the rule. Option A is wrong because whitelisting the IP in the web ACL would bypass all rules, not just the rate-based rule. Option B is wrong because increasing the rate limit would affect all traffic, potentially allowing malicious traffic. Option D is wrong because WAF rate-based rules cannot be disabled for a specific IP directly; an IP set condition is needed.

Answer

Create an IP set and whitelist the IP address in the web ACL default action.

Answer

Increase the rate limit for the rate-based rule to accommodate the partner's traffic.

Answer

Disable the rate-based rule for the partner's IP by modifying the rule scope.

Question 13

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

Accepted Answer

Inbound rule: Allow HTTP/HTTPS from the ALB's security group.. Option A is correct because allowing inbound traffic from the ALB's security group ensures only ALB traffic reaches the instances. Option D is correct because blocking all outbound traffic to 0.0.0.0/0 prevents instances from initiating internet connections. Option B is wrong because allowing inbound from 0.0.0.0/0 would permit direct access to instances. Option C is wrong because allowing outbound to 0.0.0.0/0 would allow internet connections. Option E is wrong because allowing outbound only to the ALB does not prevent instances from reaching the internet via other paths.

Answer

Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.

Answer

Outbound rule: Allow all traffic to the ALB's security group only.

Answer

Outbound rule: Allow all traffic to 0.0.0.0/0.

Question 14

A company wants to restrict access to an Amazon S3 bucket so that only users from a specific AWS account can upload objects. Which policy mechanism should be used?

Accepted Answer

Create a bucket policy with a condition that checks the aws:SourceAccount condition key.. Option D is correct because a bucket policy with a condition that checks the aws:SourceAccount condition key ensures that only requests originating from the specified account are allowed. Option A is wrong because IAM policies are attached to users/groups/roles, not to the bucket itself. Option B is wrong because S3 access control lists (ACLs) can grant access to other AWS accounts but do not support condition keys to restrict based on source account. Option C is wrong because a pre-signed URL grants time-limited access but does not restrict to a specific account.

Answer

Attach an IAM policy to the bucket that denies access to all users except those from the allowed account.

Answer

Generate a pre-signed URL for each upload request.

Answer

Configure the bucket ACL to grant access only to the allowed account's canonical user ID.

Question 15

A security engineer is designing a VPC with public and private subnets. The VPC will host web servers in public subnets and database servers in private subnets. The web servers need to send traffic to the database servers, and the database servers must not have direct internet access. Which TWO configurations should the engineer implement?

Accepted Answer

Configure security group rules to allow inbound traffic from the web server security group to the database security group.. Option A is correct because security group rules can allow traffic between web and database servers based on the security group ID. Option D is correct because a NAT gateway is not needed for private subnets that don't need internet access; however, the database servers must not have internet access, so a NAT gateway should not be used. Actually, the correct combination is A and C: Use security group rules (A) and ensure no route to an internet gateway for private subnets (C). Option E is also correct? No, E is about NAT gateway which would give internet access. So correct: A and C.

Answer

Use network ACLs to block all inbound traffic to the private subnets.

Answer

Attach an internet gateway to the VPC and route the private subnets to it.

Answer

Add a NAT gateway in the public subnet and route the private subnets to it.