SCS-C02 Infrastructure Security Practice Test 8 — 15 Questions

Question 1

A company has a security team that uses AWS Security Hub to monitor findings across multiple AWS accounts. The security team wants to ensure that all findings from Amazon GuardDuty are automatically sent to a centralized Security Hub administrator account. The company uses AWS Organizations. Which configuration should the security engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the administrator account, enable Security Hub and designate it as the Security Hub administrator. Then, in each member account, accept the invitation to become a member.. To centralize GuardDuty findings in Security Hub, the security engineer should designate a Security Hub administrator account and add member accounts. This automatically aggregates findings from all member accounts into the administrator account, providing a unified view. Other methods do not provide the same level of integration and automation.

Answer

Use AWS Organizations to create a service control policy (SCP) that forces all accounts to send findings to the administrator account.

Answer

In each member account, enable GuardDuty and Security Hub, and configure Security Hub to send findings to the administrator account using a custom action.

Answer

Configure GuardDuty to publish findings to an Amazon SNS topic in each account, and subscribe the administrator account to each topic.

Question 2

A security engineer must ensure that all API calls made by an application running on Amazon EC2 to Amazon DynamoDB stay within the AWS network and never traverse the public internet, while keeping the application's ability to reach other AWS services unchanged. The engineer wants the simplest configuration that achieves this for DynamoDB specifically. Which action should the engineer take?

Accepted Answer

Create a gateway endpoint for DynamoDB and associate it with the route tables of the subnets that host the application instances.. DynamoDB is accessed privately through a gateway endpoint, which injects a prefix list route into the selected route tables so that traffic to DynamoDB stays on the AWS network. No network interfaces, DNS overrides, or security group changes are involved, making it the simplest option that meets the requirement.

Answer

Configure an AWS PrivateLink endpoint service in the VPC and create a VPC endpoint that points to DynamoDB's public hostname.

Answer

Create an interface endpoint for DynamoDB, enable private DNS, and attach a security group that allows HTTPS from the application instances.

Answer

Deploy a NAT gateway in a public subnet and route DynamoDB traffic through it so the traffic is inspected before leaving the VPC.

Question 3

A security engineer is designing a solution to protect an Amazon S3 bucket that contains sensitive data. The bucket is accessed by an application running on Amazon EC2 instances in a VPC. The engineer wants to ensure that all access to the bucket is encrypted in transit and that only requests from the VPC are allowed. The engineer also wants to log all access requests for auditing. Which combination of actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach a bucket policy that denies requests where aws:SecureTransport is false.. To encrypt data in transit, enforce HTTPS by denying requests where aws:SecureTransport is false. To restrict access to the VPC, use the aws:SourceVpc condition in the bucket policy. Together, these two actions ensure that only encrypted requests from the specified VPC can access the bucket. While logging and VPC endpoints are valuable, they do not directly fulfill the two specific requirements.

Answer

Create a VPC endpoint for S3 and modify the bucket policy to allow only the VPC endpoint.

Answer

Enable S3 server access logging on the bucket and deliver logs to a separate logging bucket.

Answer

Configure the S3 bucket to use SSE-S3 encryption for data at rest.

Question 4

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.. The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.

Answer

The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The security group does not allow inbound traffic from the on-premises server.

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all Amazon S3 buckets across the organization have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket if the bucket does not have encryption enabled.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny API actions across all accounts. By creating an SCP that denies `s3:CreateBucket` unless the request includes encryption parameters (SSE-S3 or SSE-KMS), you enforce encryption at the point of bucket creation, preventing non-compliant buckets from ever being created. This is the only approach that proactively enforces the policy across the entire organization, rather than relying on detection or per-account configurations.

Answer

Create an S3 bucket policy in each account to deny access to unencrypted buckets.

Answer

Use AWS Config rules to detect buckets without encryption and send alerts.

Answer

Create an IAM role in each account that requires encryption when creating buckets.

Question 6

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

Accepted Answer

Create a security group for the web servers that allows outbound traffic on port 3306 to the database security group.. Security groups are stateful, so allowing outbound traffic on port 3306 from the web servers to the database security group automatically permits the corresponding return traffic. This adheres to the principle of least privilege by specifying the destination as the database security group ID rather than a broad CIDR range, ensuring only the intended web servers can initiate the connection.

Answer

Create a security group for the database servers that allows inbound traffic on port 3306 from the web subnet CIDR.

Answer

Place the database servers in a public subnet for easier connectivity.

Answer

Configure the network ACL for the database subnet to allow inbound traffic on port 3306 from the web subnet CIDR.

Question 7

A security engineer is reviewing the SQS queue policy shown in the exhibit. The queue is subscribed to an SNS topic in the same account. The security team has a requirement that only the SNS topic should be allowed to send messages to the queue. What is the issue with this policy?

Accepted Answer

The second statement allows any principal in the 10.0.0.0/8 range to receive messages from the queue.. The second statement in the SQS queue policy allows any principal in the 10.0.0.0/8 IP range to receive messages from the queue, which violates the security requirement that only the SNS topic should be allowed to send messages. The policy should restrict the `sqs:SendMessage` action to the SNS topic using a condition like `aws:SourceArn` and should not include a broad `Effect: Allow` for `sqs:ReceiveMessage` without restricting the principal or source.

Answer

The policy does not specify a principal, so it will not work.

Answer

The aws:SourceArn condition uses ArnLike which is deprecated.

Answer

The aws:SourceIp condition cannot be used with SQS queue policies.

Question 8

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: 
- All EC2 instances are launched in private subnets. 
- The IAM roles used by EC2 instances follow the principle of least privilege. 
- Security groups restrict inbound and outbound traffic. 
- AWS Systems Manager Patch Manager is used to patch instances. 
- AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. 
- Amazon GuardDuty is enabled.

Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

Accepted Answer

Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.. Using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.

Answer

Enable VPC Flow Logs to monitor traffic to S3.

Answer

Deploy AWS WAF in front of the S3 bucket.

Answer

Create an AWS Config rule to detect S3 access from EC2 instances.

Question 9

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Accepted Answer

Add a route in the private subnet's route table pointing to the NAT gateway.. Option B is correct because the private subnet's route table must contain a route (typically 0.0.0.0/0) targeting the NAT gateway so that outbound internet-bound traffic from private instances is forwarded through the NAT. Option E is correct because the NAT gateway itself must reside in a public subnet with a route to an internet gateway, allowing it to translate private instances' traffic to the internet while preventing inbound connections to those instances. Together, B and E provide outbound-only internet access for the private application servers. Option A is wrong because allowing inbound 0.0.0.0/0 on the private subnet's security group would make the servers reachable from the internet, violating the requirement. Option C is wrong because attaching an internet gateway to a private subnet's route table would make the subnet public and expose the instances directly. Option D is wrong because a VPC gateway endpoint for Amazon S3 only provides private access to S3, not general internet access for software updates.

Answer

Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.

Answer

Attach an internet gateway to the private subnet's route table.

Answer

Create a VPC gateway endpoint for Amazon S3.

Question 10

A company runs a web application on EC2 instances in an Auto Scaling group across two Availability Zones. The instances are behind an Application Load Balancer. The security team wants to ensure that only the ALB can send traffic to the instances. The instances are in a security group named 'app-sg'. Currently, 'app-sg' has an inbound rule allowing HTTP traffic from 0.0.0.0/0. The team wants to restrict access to only the ALB's security group. The ALB is in a security group named 'alb-sg'. Which course of action should the security engineer take to meet the requirement with minimal disruption?

Accepted Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from security group 'alb-sg'.. Security groups can reference each other by ID, allowing traffic from any instance associated with the source security group (alb-sg) without needing to know the ALB's IP addresses. This ensures that only the ALB can send HTTP traffic to the EC2 instances, as the rule dynamically applies to all ALB nodes across Availability Zones. It also minimizes disruption because no IP changes are required, and the rule automatically scales with the ALB.

Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from the private IP addresses of the ALB nodes.

Answer

Modify the inbound rule of 'app-sg' to allow HTTPS traffic from 0.0.0.0/0 and remove the HTTP rule.

Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from the ALB's elastic network interface (ENI).

Question 11

Drag and drop the steps to set up AWS Certificate Manager (ACM) for a custom domain in the correct order.

Accepted Answer

Request certificate, Validate domain ownership via DNS, Issue certificate, Associate certificate with AWS resource. ACM certificate requires request, DNS validation, issuance, association, and automatic renewal.

Answer

Validate domain ownership via DNS, Request certificate, Issue certificate, Associate certificate with AWS resource

Answer

Request certificate, Issue certificate, Validate domain ownership via DNS, Associate certificate with AWS resource

Answer

Request certificate, Validate domain ownership via DNS, Associate certificate with AWS resource, Issue certificate

Question 12

A company is using AWS WAF to protect its Application Load Balancer (ALB). The security team wants to block requests that do not contain a valid API key in the HTTP header 'X-API-Key'. Which WAF rule type should be used?

Accepted Answer

Regex pattern set. A regex pattern set rule is the correct choice because it allows you to define a regular expression pattern that matches the expected format of valid API keys in the 'X-API-Key' header. AWS WAF regex pattern sets can be used in a rule to inspect the header value and block requests that do not match the pattern, providing flexible and precise validation beyond simple string matching.

Answer

String match condition

Answer

Rate-based rule

Answer

IP set

Question 13

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The connection is set up with a private VIF to a VPC using a virtual private gateway. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be implemented?

Accepted Answer

Set up an IPsec VPN over the Direct Connect private VIF. Direct Connect private VIFs do not natively encrypt traffic; they provide a private, dedicated network connection but the data traverses it in cleartext. By establishing an IPsec VPN tunnel over the private VIF, you encrypt all traffic between the on-premises network and the VPC, meeting the security team's requirement for encryption while still leveraging the low latency and reliability of Direct Connect.

Answer

Configure TLS on the applications

Answer

Use a site-to-site VPN over the internet instead of Direct Connect

Answer

Enable encryption on the Direct Connect private VIF

Question 14

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which S3 bucket policy condition key should be used?

Accepted Answer

aws:SourceVpce. To restrict access to an S3 bucket so that only requests originating from a specific VPC endpoint are allowed, you must use the `aws:SourceVpce` condition key in the S3 bucket policy. This key evaluates the VPC endpoint ID (e.g., `vpce-1a2b3c4d`) of the request, ensuring that only traffic routed through that specific endpoint is granted access. The `aws:SourceVpc` key is used to restrict access based on the VPC ID, not the endpoint ID, and `aws:SourceIp` and `aws:VpcSourceIp` are not valid condition keys for VPC endpoint-based restrictions.

Answer

aws:VpcSourceIp

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 15

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

Accepted Answer

AWS WAF. AWS WAF is the correct choice because it integrates directly with AWS Shield Advanced to provide application-layer (Layer 7) DDoS mitigation. Shield Advanced handles network and transport layer attacks, while AWS WAF uses web access control lists (ACLs) to inspect HTTP/HTTPS traffic and block malicious requests such as SQL injection or cross-site scripting, which are common application-layer attack vectors.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager