SCS-C02 Infrastructure Security Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. A security engineer runs the describe-instances command for an EC2 instance. The instance has a public IP address. The security group "allow-ssh-http" has inbound rules that allow SSH from 0.0.0.0/0 and HTTP from 0.0.0.0/0. The engineer wants to block SSH access from the internet while keeping HTTP access. Which change should be made?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the inbound rule that allows SSH from 0.0.0.0/0 from the security group.. Security groups are stateful and support only allow rules; removing the inbound SSH rule from the security group effectively blocks SSH access from the internet (0.0.0.0/0) while the HTTP rule remains, allowing HTTP traffic. Since the instance already has a public IP address, removing the SSH rule is the simplest and most direct way to achieve the goal without affecting other traffic.

Answer

Add a network ACL rule to deny SSH inbound from 0.0.0.0/0.

Answer

Disassociate the public IP address from the instance.

Answer

Modify the security group to add a deny rule for SSH from 0.0.0.0/0.

Question 2

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all Amazon S3 buckets across all accounts are encrypted with AWS KMS customer managed keys (CMKs). They have implemented a service control policy (SCP) that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms. Additionally, they have an SCP that denies s3:CreateBucket unless the bucket is configured with default encryption using KMS. Despite these policies, a developer in the production account reports that they were able to upload a sensitive object to an existing bucket without encryption. The developer used the AWS CLI with the command: aws s3 cp sensitive.txt s3://my-bucket/. The bucket does not have default encryption enabled. The SCPs are attached to the root organizational unit (OU) and are in effect. What is the MOST likely reason the upload succeeded?

Accepted Answer

The SCP does not apply to the management account of the organization.. The SCP denies PutObject without the encryption header, but the command did not specify the header. However, SCPs do not affect the root user? No, root user is not used here. The developer used an IAM role. SCPs apply to all IAM principals. The issue might be that the SCP uses a condition key that is not evaluated properly? Another common issue: SCPs cannot deny actions that are performed by the AWS service itself? No. The most likely reason is that the SCP was not applied to the production account because it was attached to the root OU, but the production account might be in a different OU that does not inherit the SCP? Or the SCP might have been disabled? Or the developer might be using an IAM role that has a service-linked role? Actually, a known limitation: SCPs do not affect the management account. If the production account is the management account, SCPs do not apply. That is a classic gotcha. The question says "multi-account AWS environment using AWS Organizations" but does not specify that the production account is the management account. But it's plausible. Another possibility: The SCP denies s3:PutObject without the header, but the CLI command might automatically add the header if the bucket has default encryption? No, bucket does not have default encryption. The SCP should deny. So the most likely cause is that the production account is the management account of the organization, and SCPs do not apply to the management account.

Answer

The SCP uses the wrong condition key; it should use s3:x-amz-server-side-encryption instead.

Answer

The SCP was not attached to the production account's OU.

Answer

The developer used an IAM role that bypasses SCPs.

Question 3

Refer to the exhibit. A security engineer runs the describe-instances command for an EC2 instance. The instance has a public IP address. The security group "allow-ssh-http" has inbound rules that allow SSH from 0.0.0.0/0 and HTTP from 0.0.0.0/0. The engineer wants to block SSH access from the internet while keeping HTTP access. Which change should be made?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not include an explicit Allow for ec2:TerminateInstances.. IAM policies operate on an explicit allow model. Even though there is no explicit deny for ec2:TerminateInstances, the user is unable to terminate instances because the policy does not include an explicit Allow action for ec2:TerminateInstances. Without an explicit Allow, the default behavior is to deny the action, regardless of whether a deny statement is present.

Answer

The second statement's Resource is set to '*' but the Action list does not include termination.

Answer

The first statement's Resource element is too restrictive and does not include the termination API call.

Answer

The policy has a syntax error that prevents termination from being evaluated.

Question 4

A company wants to ensure that all data in transit between its EC2 instances and an RDS database is encrypted. The instances and the database are in the same VPC. Which configuration step is necessary to achieve this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL.. To encrypt data in transit between EC2 instances and an RDS database within the same VPC, you must enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL. This ensures that the network traffic is encrypted at the transport layer, protecting against eavesdropping or man-in-the-middle attacks. AWS RDS supports SSL/TLS for most database engines, and the client must explicitly request an encrypted connection.

Answer

Enable encryption at rest for the RDS instance using AWS KMS.

Answer

Set up a VPN connection between the EC2 instances and the RDS database.

Answer

Configure the security group for the RDS instance to enforce encryption.

Question 5

A security engineer needs to restrict outbound traffic from a VPC to only allow HTTPS traffic to specific domains (e.g., api.example.com). The VPC has a NAT gateway in a public subnet. What is the most secure way to implement this restriction?

Accepted Answer

Deploy an AWS Network Firewall in the VPC and configure domain filtering rules.. AWS Network Firewall provides stateful, application-layer inspection that can filter outbound HTTPS traffic based on domain names (SNI/TLS hostnames), not just IP addresses. This allows you to restrict traffic to specific domains like api.example.com even if their IP addresses change, which is more secure and manageable than IP-based rules. Security groups and network ACLs cannot filter by domain name, and VPC endpoints are for specific AWS services, not general HTTPS domains.

Answer

Configure security group egress rules to allow HTTPS to 0.0.0.0/0.

Answer

Configure network ACL outbound rules to allow HTTPS to the IP addresses of the allowed domains.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it.

Question 6

Refer to the exhibit. A security engineer is reviewing this CloudFormation template. What security risk is present in this configuration?

Accepted Answer

SSH access is allowed from a large internal CIDR block (10.0.0.0/8) which could expose the instance to unnecessary internal threats.. Allowing SSH (TCP port 22) from the entire 10.0.0.0/8 CIDR block is overly permissive. This range encompasses all RFC 1918 private addresses in the 10.x.x.x space, which could include many internal subnets, VPNs, or peered VPCs that do not require administrative access. Unnecessarily broad internal access increases the attack surface and violates the principle of least privilege.

Answer

The template does not associate the security group with the instance, so the instance has no security group.

Answer

HTTP access is allowed from all IP addresses (0.0.0.0/0) which is a security risk.

Answer

The template uses SecurityGroups property instead of SecurityGroupIds, which is deprecated.

Question 7

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all access to the bucket is encrypted in transit. Which policy should be attached to the bucket to enforce this?

Accepted Answer

Attach a bucket policy that denies requests when aws:SecureTransport is false.. The `aws:SecureTransport` condition key in an S3 bucket policy evaluates whether the request was sent over HTTPS (TLS). By attaching a bucket policy that denies access when `aws:SecureTransport` is false, the security team enforces that all access to the bucket must be encrypted in transit, blocking any HTTP requests.

Answer

Configure a bucket policy that denies requests that do not include the x-amz-server-side-encryption header.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Use Amazon CloudFront to serve the content and require HTTPS.

Question 8

A company's security engineer is configuring a web application firewall (WAF) to protect a public-facing Application Load Balancer (ALB). The application is vulnerable to SQL injection attacks. Which AWS WAF rule should be used to mitigate this threat?

Accepted Answer

Add a rule from the AWS Managed Rules for SQL injection.. AWS WAF includes managed rule groups specifically designed to detect and block SQL injection attacks by inspecting request parameters, URIs, and headers for malicious SQL patterns. This directly addresses the vulnerability described in the scenario, as SQL injection targets the application's database layer through crafted input.

Answer

Add a rule to block cross-site scripting (XSS) attacks.

Answer

Add a rate-based rule to limit requests per IP.

Answer

Add a geographic match rule to block traffic from specific countries.

Question 9

Refer to the exhibit. A security engineer runs the command above and sees that the flow log status is ACTIVE. However, the engineer notices that no logs are appearing in the CloudWatch log group. What is the most likely cause?

Accepted Answer

The IAM role specified in DeliverLogsPermissionArn does not have permissions to PutLogEvents.. The most likely cause is that the IAM role specified in the DeliverLogsPermissionArn does not have the necessary permissions to call PutLogEvents on the CloudWatch Logs log group. Even if the flow log status is ACTIVE, the delivery of log records will silently fail if the role lacks the required logs:PutLogEvents, logs:CreateLogStream, and logs:DescribeLogStreams actions. The ACTIVE status only indicates that the flow log configuration is valid and the service is attempting to deliver logs, not that delivery is succeeding.

Answer

The TrafficType is set to ALL, which captures too much data and causes throttling.

Answer

The flow log is attached to an ENI instead of a subnet.

Answer

The flow log destination is set to CloudWatch Logs but the log group is encrypted with KMS.

Question 10

A company wants to allow a user to assume a role in another AWS account to access resources. Which AWS service should be used to create and manage the trust relationship between the accounts?

Accepted Answer

IAM roles with a trust policy that allows the external account.. IAM roles with a trust policy that explicitly allows the external AWS account to assume the role is the correct mechanism for establishing a cross-account trust relationship. The trust policy defines which principal (the external account) is allowed to assume the role, and the permissions policy attached to the role controls what actions the assumed role can perform. This is the foundational AWS service for delegating access across accounts.

Answer

AWS Security Token Service (STS) to generate tokens.

Answer

IAM users in the source account with cross-account permissions.

Answer

AWS Organizations service control policies.

Question 11

Which TWO actions should a security engineer take to protect an Amazon EC2 instance from unauthorized access? (Choose two.)

Accepted Answer

Configure security groups to allow only necessary inbound traffic.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. By configuring security groups to allow only necessary inbound traffic (Option C), you follow the principle of least privilege, reducing the attack surface. This is a fundamental security best practice for protecting EC2 instances from unauthorized access.

Answer

Place the instance in a public subnet and rely solely on security groups.

Answer

Disable termination protection so the instance can be easily terminated if compromised.

Answer

Enable detailed billing to monitor instance usage.

Question 12

Which THREE measures can be taken to secure a VPC's network boundary? (Choose three.)

Accepted Answer

Use security groups to control inbound and outbound traffic at the instance level.. Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level (stateful). They are a fundamental measure for securing the VPC network boundary by allowing only specified traffic to reach the instances, based on rules that evaluate source/destination IP, protocol, and port. This provides a critical layer of defense directly at the compute resource.

Answer

Attach an S3 bucket policy to restrict access to the bucket.

Answer

Attach an internet gateway to the VPC.

Question 13

Which TWO AWS services can be used to encrypt data at rest in an Amazon S3 bucket? (Choose two.)

Accepted Answer

SSE-KMS. SSE-KMS (Server-Side Encryption with AWS KMS) is correct because it allows you to encrypt data at rest in S3 using AWS Key Management Service, providing separate permissions for the use of a customer master key (CMK) and audit trails via AWS CloudTrail. SSE-S3 (Server-Side Encryption with S3-Managed Keys) is correct because it uses S3's native, fully managed encryption with AES-256 to encrypt data at rest without requiring you to manage keys. Both options directly encrypt objects stored in S3 buckets.

Answer

SSL/TLS

Answer

Client-side encryption

Answer

AWS Shield

Question 14

A company runs a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) in a public subnet, EC2 instances in private subnets for the web tier, and an RDS MySQL database in a private subnet. The security team has noticed that the EC2 instances are receiving traffic from unexpected IP addresses on port 22 (SSH). The instances were launched with a default security group that allowed SSH from 0.0.0.0/0. The security engineer has corrected the security group to allow SSH only from the company's bastion host security group. However, the engineer also wants to implement defense-in-depth by adding a network ACL to the private subnet to block SSH from all sources except the bastion host's private IP (10.0.1.10). The private subnet's current network ACL allows all inbound and outbound traffic. The engineer creates a new network ACL with the following rules: Inbound: Rule 100: Allow SSH from 10.0.1.10/32; Rule 200: Deny SSH from 0.0.0.0/0; Rule *: Deny all. Outbound: Rule 100: Allow all. After associating this new NACL with the private subnet, the engineer finds that SSH connections from the bastion host are still being blocked. What is the most likely cause?

Accepted Answer

The outbound rule of the network ACL does not allow ephemeral ports for return traffic.. The most likely cause is that the outbound rule of the network ACL does not allow ephemeral ports for return traffic. Network ACLs are stateless, so the same rule evaluation must apply to both directions. Although the outbound rule allows all traffic, it could be misconfigured or not correctly allowing the ephemeral ports used for SSH responses. However, the more direct issue is that the inbound rule only allows SSH from the bastion IP, but the outbound rule must also allow the return traffic. Since the question states SSH connections are blocked, the outbound rule might be missing specific ephemeral port ranges, or the 'Allow all' rule may not be properly implemented. Option A is the best explanation.

Answer

The new network ACL was not associated with the private subnet.

Answer

The security group on the EC2 instances still allows SSH from 0.0.0.0/0.

Answer

The network ACL rules are out of order; the deny rule should be before the allow rule.

Question 15

A company is using AWS CloudTrail to monitor API activity in their account. They have enabled CloudTrail in all regions and are logging to an S3 bucket. The security team wants to ensure that log files are not tampered with after delivery. They enable CloudTrail log file integrity validation. Which additional step must be taken to verify the integrity of the log files?

Accepted Answer

Use the AWS CLI to run the validate-logs command against the log files.. CloudTrail log file integrity validation uses digital signatures (SHA-256 hashing and signing with a private key). To verify integrity, you must use the AWS CLI command 'aws cloudtrail validate-logs' or download the public key and verify manually. Option A (enable S3 versioning) helps protect against accidental deletion or overwriting but does not verify integrity. Option B (use KMS to encrypt logs) protects confidentiality only. Option C (use S3 Object Lock) prevents deletion or modification but does not provide tamper detection or integrity verification.

Answer

Enable S3 versioning on the log bucket.

Answer

Configure the S3 bucket to use server-side encryption with AWS KMS.

Answer

Enable S3 Object Lock on the log bucket.