SCS-C02 Infrastructure Security Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.. The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive. The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.

Answer

The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.

Answer

The security group allows outbound all traffic, which violates the principle of least privilege.

Answer

The instance type t2.micro is not available in the specified subnet's Availability Zone.

Question 2

Refer to the exhibit. A security engineer applies the IAM policy to a user, and then successfully runs the CLI command. Later, the user attempts to upload an object without specifying the ACL. What will happen?

Accepted Answer

The upload fails because the Deny statement explicitly denies any PutObject that does not have the ACL set to bucket-owner-full-control.. The IAM policy explicitly denies PutObject when the ACL is not set to bucket-owner-full-control. Since the user does not specify an ACL, the condition 'StringNotEquals' evaluates to true, triggering the Deny.

Answer

The upload succeeds because the bucket policy allows it.

Answer

The upload succeeds because the Allow statement allows PutObject without condition.

Answer

The upload fails because the bucket policy requires ACL to be bucket-owner-full-control.

Question 3

Refer to the exhibit. An application running on EC2 behind an ALB is unreachable from the internet. The ALB health checks are failing. What is the most likely cause?

Accepted Answer

The network ACL inbound rule only allows traffic from 10.0.0.0/16 on ports 80 and 443, but the ALB is in a different subnet (public subnet) with a different CIDR (e.g., 10.0.2.0/24). The ALB's traffic to the instance must come from its private IP, which is in the same VPC but may not be within 10.0.0.0/16 if the VPC CIDR is not /16.. The network ACL inbound rules only allow traffic from 10.0.0.0/16 on ports 80 and 443. The ALB's private IP addresses are in the public subnet, which has a different CIDR (e.g., 10.0.2.0/24). If the VPC CIDR is not 10.0.0.0/16 (e.g., /20), the ALB's IPs may not be allowed. This causes health checks to be blocked. Therefore, option D is correct.

Answer

The security group inbound rule allows HTTP from 0.0.0.0/0, but it should only allow traffic from the ALB's security group.

Answer

The network ACL outbound rules deny all traffic, so the instance cannot send responses back to the ALB.

Answer

The security group outbound rule allows all traffic, which is too permissive and causes the ALB to reject the instance as unhealthy.

Question 4

Refer to the exhibit. A security engineer is investigating a potential compromise. What is the most critical finding?

Accepted Answer

The root user does not have MFA enabled, as indicated by AccountMFAEnabled being 1 (true) but that means MFA is enabled? Actually, the summary shows AccountMFAEnabled: 1, which means MFA is enabled for the root account? Wait, the key is "AccountMFAEnabled" which indicates if the account (root) has MFA enabled. 1 means true. So MFA is enabled. But there are access keys present. The critical finding is that the root user has access keys.. The exhibit shows that the root user has two access keys (AccountAccessKeysPresent: 2) and has MFA enabled (AccountMFAEnabled: 1). While MFA is enabled, AWS best practice strictly prohibits creating access keys for the root account because they cannot be rotated or revoked via IAM policies. The presence of root access keys is a critical security risk as they provide unrestricted access to all AWS resources. Option A correctly identifies this as the most critical finding. Options B, C, and D are less critical because console login success alone does not indicate a weak password, and IP address anomalies can be addressed with proper monitoring.

Answer

The root user's console login succeeded, which indicates that the root account password is weak.

Answer

The root user logged in successfully from an unknown IP address.

Answer

The IP address 203.0.113.5 is not from the company's trusted IP range.

Question 5

Refer to the exhibit. A user assumes the role and tries to terminate an instance, but gets an error. The instance i-12345678 has a tag 'Environment' with value 'dev'. What is the most likely reason for the failure?

Accepted Answer

The role policy has an implicit deny because the 'ec2:TerminateInstances' action is not allowed on the specific resource ARN due to missing account ID or region mismatch, or the session credentials have expired.. The error most likely occurs because the assumed role credentials have expired, or because the policy's resource ARN for ec2:TerminateInstances does not include the correct account ID or region, resulting in an implicit deny. Option A correctly identifies these two possibilities. The instance tag is not the issue here, as the condition for the tag is likely satisfied.

Answer

The role policy has a condition that requires the instance to have the tag 'Environment' set to 'dev', but the condition is evaluated against the principal, not the resource.

Answer

The role policy includes 'ec2:Describe*' which grants permission to describe all resources, but that does not include terminate. The condition on TerminateInstances requires the tag, but the user may not have passed the tag condition correctly.

Answer

The policy uses 'ec2:TerminateInstances' with a resource ARN that includes the region and account, but the instance may be in a different region or account.

Question 6

Refer to the exhibit. A security engineer reviews this CloudFormation template. Which statement about the bucket's public accessibility is correct?

Accepted Answer

The bucket is private because PublicAccessBlockConfiguration blocks all public access.. The PublicAccessBlockConfiguration blocks all public access settings, including bucket policies that grant public access. Even though the bucket policy allows GetObject from a specific IP range, the RestrictPublicBuckets setting overrides the policy, effectively blocking all public access.

Answer

The bucket is public because the bucket policy allows GetObject.

Answer

The bucket is public only for IPs in the 203.0.113.0/24 range.

Answer

The bucket is private because no ACLs allow public access.

Question 7

A security team wants to enforce that all Amazon EBS volumes in an AWS account are encrypted at rest, including volumes created from unencrypted snapshots and volumes launched by Auto Scaling groups. They need a solution that prevents creation of unencrypted volumes and works across all AWS Regions without modifying application code. Which approach meets these requirements?

Accepted Answer

Use an AWS Organizations service control policy (SCP) that denies the ec2:CreateVolume action unless the request includes the Encrypted parameter set to true, and enable EBS encryption by default in all Regions.. A preventive control is needed to block unencrypted EBS volumes at creation time. An AWS Organizations SCP can deny the ec2:CreateVolume action unless the request explicitly sets the Encrypted parameter to true, effectively preventing unencrypted volumes across all accounts. Enabling EBS encryption by default in each Region ensures that volumes created without the parameter are still encrypted. Together, they provide a robust, cross-Region solution without application changes.

Answer

Configure AWS CloudTrail to log all CreateVolume API calls and use Amazon EventBridge to notify the security team when an unencrypted volume is created.

Answer

Enable EBS encryption by default for each Region and use an IAM policy to deny the ec2:CreateVolume action unless the volume is encrypted.

Answer

Create an AWS Config rule that checks for unencrypted volumes and triggers an AWS Lambda function to delete them.

Question 8

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect this VPC to an on-premises network that uses the CIDR block 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN for the connection. The security team must ensure that traffic from the on-premises network can reach only specific subnets in the VPC, and that the VPC can initiate connections to the on-premises network. Which solution meets these requirements?

Accepted Answer

Change the VPC CIDR to a non-overlapping range, such as 192.168.0.0/16, and then create a Site-to-Site VPN connection. Use route tables to direct traffic for the on-premises CIDR to the virtual private gateway, and use security groups to restrict access.. Overlapping CIDR blocks between a VPC and on-premises network cause routing conflicts that cannot be resolved by route table configurations alone. The only viable solution is to change the VPC CIDR to a non-overlapping range, then establish a Site-to-Site VPN. After that, route tables can direct traffic to the virtual private gateway, and security groups can restrict access to specific subnets. This ensures both connectivity and security requirements are met.

Answer

Create a Site-to-Site VPN connection and configure the VPC route tables to route traffic for 10.0.0.0/8 to the virtual private gateway. Use security groups and network ACLs to restrict access to specific subnets.

Answer

Use AWS Transit Gateway to connect the VPC and on-premises network, and configure Transit Gateway route tables to propagate only the specific subnet CIDRs that should be reachable.

Answer

Create a Site-to-Site VPN connection and use AWS PrivateLink to provide access to specific services in the VPC from on-premises.

Question 9

A security engineer manages a VPC that hosts a fleet of EC2 instances behind a Network Load Balancer. The engineer needs to allow the instances to be reached on TCP port 8443 only by clients whose source IP addresses are in the 203.0.113.0/24 range, while blocking all other sources. The instances must remain reachable from the load balancer health check addresses, which are managed by AWS and cannot be enumerated. Which solution meets these requirements with the LEAST operational effort?

Accepted Answer

Attach a security group to the instances that allows TCP 8443 from 203.0.113.0/24 and from the load balancer's security group, and allow the load balancer's security group as a source in the instance security group rule.. Security groups can reference another security group as a source, which automatically permits traffic from the load balancer nodes including health checks without hard-coding AWS-managed addresses. Combining that reference with the approved client CIDR achieves the restriction with minimal ongoing maintenance, since security groups are stateful and require no ephemeral-port rules.

Answer

Configure the instances to use AWS PrivateLink endpoint policies that permit only 203.0.113.0/24, then associate the endpoint with the instance subnets.

Answer

Create a prefix list containing 203.0.113.0/24 and the load balancer's public IP addresses, then reference the prefix list in the instance security group inbound rule for TCP 8443.

Answer

Attach a network ACL to the instance subnets that permits TCP 8443 from 203.0.113.0/24 and from the VPC CIDR, and denies all other inbound traffic.

Question 10

A security engineer at a financial services company manages a fleet of Amazon EC2 instances that must communicate with an on-premises Oracle database over an AWS Site-to-Site VPN. The company's security policy requires that all traffic to the database be encrypted, and that the instances present a verifiable identity to the database server. The engineer has configured the VPN with static routing. Which solution should the engineer implement to meet these requirements?

Accepted Answer

Use AWS Private Certificate Authority (PCA) to issue private certificates to the EC2 instances, and configure the database server to trust the PCA.. The requirement is for encrypted traffic and verifiable identity between EC2 instances and an on-premises database. AWS Private CA can issue private certificates to EC2 instances, and the on-premises database can trust that CA. This enables mutual TLS, ensuring both encryption and authentication. Other options either do not provide instance identity or are not applicable to on-premises resources.

Answer

Configure the VPN connection to use AWS Certificate Manager (ACM) public certificates for all traffic.

Answer

Configure AWS Certificate Manager (ACM) to issue private certificates for the EC2 instances and install them on the database server.

Answer

Enable AWS Secrets Manager rotation for the database credentials and store them in an encrypted S3 bucket.

Question 11

A security engineer is designing a VPC to host a multi-tier web application. The public subnet must allow inbound HTTPS from the internet, and the private subnet must allow outbound traffic to an on-premises database over an AWS Site-to-Site VPN. The engineer must implement least-privilege network controls. Which combination of VPC components should the engineer use to meet these requirements?

Accepted Answer

An internet gateway attached to the VPC for the public subnet, and a virtual private gateway attached to the VPC for the VPN connection.. The public subnet needs an internet gateway for inbound HTTPS, and the private subnet needs a virtual private gateway to terminate the Site-to-Site VPN to on-premises. These are the correct VPC endpoints for internet and VPN connectivity respectively, and they support least-privilege segmentation because the private subnet remains without a route to the internet gateway.

Answer

A virtual private gateway attached to the VPC for both the public subnet's internet access and the VPN connection.

Answer

A NAT gateway in the public subnet for the private subnet's VPN traffic, and an internet gateway for the public subnet.

Answer

An internet gateway attached to the VPC for the public subnet, and a NAT gateway in the private subnet for the VPN connection.

Question 12

A company uses AWS Organizations with all features enabled. The security team wants to enforce that all Amazon S3 buckets in the organization have server-side encryption with AWS KMS keys (SSE-KMS) enabled. They create an SCP that denies the s3:PutBucketEncryption action unless the encryption algorithm is aws:kms. However, they find that some buckets are still created without encryption. What is the MOST likely reason?

Accepted Answer

The SCP does not apply to the management account.. SCPs are not applied to the management account of an AWS Organization. If buckets are being created in the management account, they will not be subject to the SCP, allowing unencrypted buckets. The security team must ensure that buckets are created only in member accounts or use other mechanisms like AWS Config rules to enforce encryption in the management account.

Answer

The SCP does not deny the s3:CreateBucket action, so buckets can be created without encryption.

Answer

The SCP must be attached to each OU individually, not to the root.

Answer

The SCP condition uses the wrong key; it should use s3:x-amz-server-side-encryption.

Question 13

A company uses AWS Network Firewall to inspect traffic between two VPCs connected through a transit gateway. The security team wants to inspect only outbound HTTP and HTTPS traffic from a specific subnet while allowing all other traffic. Which configuration should the security engineer implement?

Accepted Answer

Deploy AWS Network Firewall in a dedicated inspection VPC, create a stateful rule group that allows HTTP/HTTPS, and route the specific subnet's traffic through the firewall endpoint via the transit gateway.. AWS Network Firewall inspects traffic routed through its endpoints in a VPC. To inspect only specific subnet traffic between VPCs, the firewall must be deployed in a dedicated inspection VPC, and routing must direct that subnet's traffic through the firewall. A stateful rule group then allows HTTP/HTTPS, and the transit gateway connects the VPCs to the inspection VPC.

Answer

Create a stateless rule group with a pass action for all traffic and a stateful rule group with alert action for HTTP/HTTPS, then associate the firewall policy with the transit gateway.

Answer

Attach a security group to the transit gateway that allows only HTTP/HTTPS, and enable VPC Flow Logs on the transit gateway for inspection.

Answer

Use AWS PrivateLink to create an endpoint for the destination VPC and apply an endpoint policy that allows only HTTP/HTTPS.

Question 14

A security engineer is configuring AWS Shield Advanced for an Application Load Balancer (ALB) that serves a public web application. The engineer wants to ensure that only legitimate traffic reaches the ALB and that the application is protected from volumetric DDoS attacks. The engineer has already enabled Shield Advanced and associated the ALB. Which additional step should the engineer take to automatically mitigate application-layer attacks?

Accepted Answer

Enable AWS WAF on the ALB and associate an AWS WAF web ACL with rate-based rules.. AWS Shield Advanced provides protection against volumetric DDoS attacks, but for application-layer attacks, AWS WAF is required. By enabling AWS WAF on the ALB and using rate-based rules, the engineer can automatically block IPs that exceed request thresholds, effectively mitigating HTTP floods and other layer 7 attacks. This is a best practice for comprehensive DDoS protection.

Answer

Create a custom CloudWatch alarm that triggers an AWS Lambda function to modify the ALB's security group when traffic spikes.

Answer

Enable AWS Shield Advanced automatic application-layer DDoS mitigation in the Shield console.

Answer

Configure the ALB to use only HTTPS listeners and enable mutual TLS authentication.

Question 15

A company wants to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to perform any action. The security engineer needs to implement this with the least administrative effort. What should the engineer do?

Accepted Answer

Apply a service control policy (SCP) at the organization level that denies all actions unless aws:MultiFactorAuthPresent is true.. A service control policy (SCP) at the organization level enforces MFA for all IAM users and roles across all accounts with a single policy. It uses the aws:MultiFactorAuthPresent condition key to deny actions when MFA is not present, providing centralized, least-effort enforcement.

Answer

Attach an IAM policy to each user that denies all actions unless the aws:MultiFactorAuthPresent condition key is true.

Answer

Enable MFA in the account settings and require it for all IAM users through the AWS Management Console.

Answer

Create an IAM policy that denies all actions when aws:MultiFactorAuthPresent is false, and attach it to all users via a group or as a permissions boundary.