SCS-C02 Infrastructure Security Practice Test 8 — 15 Questions

Question 1

A company has a requirement to block traffic from specific IP addresses known to be malicious. The company has an Application Load Balancer (ALB) that fronts a web application. The security engineer needs to implement a solution that can block these IP addresses at the edge before they reach the ALB. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. AWS WAF can be associated with an Application Load Balancer and allows you to block traffic based on IP addresses using IP set rules. This enables blocking at the edge before traffic reaches the ALB. Option A is incorrect because security groups are instance-level firewalls and cannot be attached to an ALB. Option B is incorrect as AWS Shield Advanced provides DDoS protection but does not support IP-based blocking by itself. Option C is incorrect because network ACLs operate at the subnet level, not at the ALB level, and cannot block traffic specifically destined for the ALB.

Answer

Configure security groups on the ALB to deny traffic from those IP addresses.

Answer

Enable AWS Shield Advanced and configure rate-based rules.

Answer

Add a network ACL rule to the ALB's subnet to deny the IP addresses.

Question 2

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can download objects. Which combination of actions should the company take? (Choose TWO.)

Accepted Answer

Create an S3 bucket policy that allows access only from the VPC using the aws:SourceVpc condition.. To restrict access to an S3 bucket so that only traffic from a specific VPC can download objects, the correct combination is to create an S3 bucket policy that uses the aws:SourceVpc condition (Option C) and create a VPC endpoint for Amazon S3 in the VPC (Option E). The bucket policy with aws:SourceVpc ensures that only requests originating from the specified VPC are allowed, while the VPC endpoint enables private connectivity between the VPC and S3 without traversing the internet. Option A (Internet gateway) would make the VPC publicly accessible and is not required for private access. Option B (NAT gateway) is used for outbound internet access from private subnets, not for restricting access to S3. Option D (security group) cannot be attached to an S3 bucket; security groups apply to EC2 instances or other resources, not to S3.

Answer

Attach an Internet gateway to the VPC and route traffic through it.

Answer

Attach a security group to the S3 bucket.

Answer

Create a NAT gateway in the VPC for outbound traffic.

Question 3

A security engineer is designing a multi-tier web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The engineer needs to ensure that the EC2 instances only accept traffic from the ALB and not from any other source. Which security group configuration should the engineer use?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group on the EC2 instances' security group.. It uses a security group reference to allow inbound HTTP traffic from the ALB's security group. This ensures that only traffic originating from the ALB (which has that security group attached) can reach the EC2 instances, regardless of the ALB's IP addresses or changes in the VPC CIDR. This is the recommended AWS best practice for securing traffic between an ALB and backend instances.

Answer

Allow inbound HTTP traffic from the ALB's public IP address on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from the VPC CIDR range on the EC2 instances' security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 instances' security group.

Question 4

A company wants to allow an EC2 instance to access an S3 bucket without exposing the instance to the internet. Which AWS service should be used to achieve this?

Accepted Answer

VPC Endpoint (Gateway type) for S3. A VPC Endpoint (Gateway type) for S3 allows EC2 instances within a VPC to access S3 buckets privately using AWS's internal network, without traversing the internet. This is achieved by adding an endpoint route in the VPC route table that directs S3 traffic to the endpoint, which uses AWS's private infrastructure. It eliminates the need for an internet gateway, NAT gateway, or VPN connection, ensuring the instance remains isolated from the public internet.

Answer

NAT Gateway

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway

Question 5

A security engineer is reviewing the security group rules for a web server. The security group currently has the following inbound rules: allow HTTP from 0.0.0.0/0, allow HTTPS from 0.0.0.0/0, and allow SSH from 0.0.0.0/0. Which change should the engineer make to improve security?

Accepted Answer

Change the SSH rule to allow from a specific IP range used by the company's administrators.. Restricting SSH access (TCP port 22) to a specific IP range used by the company's administrators follows the principle of least privilege. The current rule allows SSH from 0.0.0.0/0, which exposes the server to brute-force attacks and unauthorized access from the entire internet. By limiting the source to only trusted administrative IPs, the attack surface is significantly reduced while still allowing necessary remote management.

Answer

Remove the HTTP rule and keep only HTTPS.

Answer

Change the SSH rule to allow from the VPC CIDR only.

Answer

Add a rule to allow ICMP from 0.0.0.0/0.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They have two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). They have an Application Load Balancer in the public subnets and EC2 instances in the private subnets. The EC2 instances need to access the internet for updates. The security engineer has set up a NAT gateway in each public subnet. The route table for the private subnets has a default route pointing to the NAT gateway in the same Availability Zone. However, the EC2 instances are unable to reach the internet. What is the most likely cause?

Accepted Answer

The route tables for the public subnets do not have a default route (0.0.0.0/0) to the Internet Gateway.. The most likely cause is that the public subnets' route tables lack a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). For a NAT gateway to function, it must be placed in a public subnet with a route to the IGW so it can translate private IPs and forward traffic to the internet. Without this route, the NAT gateway cannot send traffic to the IGW, breaking outbound connectivity for EC2 instances in private subnets that rely on it.

Answer

The security groups for the EC2 instances do not allow outbound traffic.

Answer

The NAT gateways do not have route propagation enabled.

Answer

The NAT gateways are in the same Availability Zone.

Question 7

A company is using AWS Systems Manager Session Manager to provide secure shell access to EC2 instances without opening inbound ports. Which of the following is a requirement for this setup?

Accepted Answer

The EC2 instance must have an IAM role that allows SSM actions.. AWS Systems Manager Session Manager establishes a secure shell connection to EC2 instances without requiring inbound ports. The EC2 instance must have an IAM role attached that includes the AWS managed policy AmazonSSMManagedInstanceCore, which grants permissions for the SSM agent to communicate with the Systems Manager service. This IAM role is essential because the SSM agent uses AWS credentials from the instance metadata to authenticate and establish a bidirectional control channel via HTTPS (port 443) to the Systems Manager endpoint, not through traditional SSH.

Answer

The EC2 instance must be in a public subnet.

Answer

The EC2 instance must have a public IP address.

Answer

The security group must allow inbound SSH from 0.0.0.0/0.

Question 8

A security engineer is configuring a VPC for a web application. The VPC has public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The engineer wants to ensure that the database servers are not accessible from the internet. Which two actions should the engineer take?

Accepted Answer

Ensure the route table for the database subnets does not have a default route to an Internet Gateway.. Removing the default route (0.0.0.0/0) to an Internet Gateway (IGW) from the route table associated with the database subnets ensures that traffic from those subnets cannot reach the internet, and the internet cannot initiate connections to instances in those subnets. This is the fundamental network-level isolation required for private subnets in a VPC.

Answer

Place the database instances in a public subnet with a NAT gateway.

Answer

Assign public IP addresses to the database instances.

Answer

Configure a network ACL on the database subnets to deny all inbound traffic.

Question 9

A security engineer is reviewing the security of an Amazon EKS cluster. The cluster is used to run containerized applications. Which three actions should the engineer take to improve the security of the cluster?

Accepted Answer

Restrict access to the cluster using AWS IAM authentication for kubectl.. Restricting access to the cluster using AWS IAM authentication for kubectl is correct because it integrates with AWS IAM to manage user and role permissions, ensuring that only authorized principals can interact with the EKS cluster. This replaces the default, less secure static token or certificate-based authentication with a robust, auditable identity federation. By mapping IAM roles to Kubernetes RBAC, you enforce least-privilege access and prevent unauthorized API calls.

Answer

Use the default VPC for the cluster.

Answer

Grant the cluster-admin role to all developers.

Question 10

A security engineer needs to protect an S3 bucket that contains sensitive data. Which two methods should the engineer use?

Accepted Answer

Apply an S3 bucket policy that restricts access to specific IAM users or roles.. An S3 bucket policy is a resource-based policy that can explicitly restrict access to specific IAM users or roles, providing a direct mechanism to control who can access the bucket and its objects. This is essential for protecting sensitive data by ensuring only authorized principals can perform actions like s3:GetObject or s3:PutObject, regardless of other permissions.

Answer

Use Amazon CloudFront to serve the content.

Answer

Enable VPC Flow Logs on the bucket.

Answer

Enable S3 object ACLs.

Question 11

A company is considering using AWS Shield Advanced to protect against DDoS attacks. Which three features are included with AWS Shield Advanced? (Choose THREE.)

Accepted Answer

Cost protection against DDoS-related scaling charges. AWS Shield Advanced provides cost protection against DDoS-related scaling charges, meaning if your EC2 or ELB instances scale up due to a DDoS attack, AWS will provide credits for the additional resources incurred. This is a key financial safeguard included in the Shield Advanced subscription.

Answer

Dedicated IP addresses for EC2 instances

Answer

AWS Site-to-Site VPN

Question 12

A company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Application Load Balancer (ALB) to distribute traffic. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0 and a security group for the EC2 instances that allows inbound HTTP from the ALB's security group. Recently, the company experienced a security incident where an attacker exploited a vulnerability in the application to gain access to an EC2 instance and then moved laterally to the database. The database is in a private subnet and uses a security group that allows inbound traffic from the EC2 instance security group on port 3306 (MySQL). The security team wants to prevent lateral movement in the future. Which of the following is the MOST effective course of action?

Accepted Answer

Implement a host-based firewall on each EC2 instance to restrict outbound connections to only the database endpoint.. Implementing a host-based firewall on each EC2 instance provides granular control over outbound connections, allowing only necessary traffic such as to the database endpoint. This prevents an attacker who compromises an EC2 instance from moving laterally to the database by restricting outbound connections at the instance level. In contrast, option A (VPC peering) is for connecting different VPCs and does not prevent lateral movement within the same VPC. Option B (AWS WAF) protects the ALB from web attacks but does not restrict outbound traffic from instances. Option C (network ACLs) operates at the subnet level and can block traffic between subnets, but it is stateless and less granular than a host-based firewall, and it cannot restrict traffic to a specific database endpoint if the database is in a different subnet. Therefore, a host-based firewall is the most effective solution.

Answer

Use VPC peering to isolate the database subnet from the application subnet.

Answer

Deploy AWS WAF in front of the ALB to block known malicious IPs.

Answer

Create a network ACL for the private subnet that denies outbound traffic from the EC2 instances to the database subnet.

Question 13

A company is migrating its on-premises data center to AWS. The company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect its on-premises network (192.168.0.0/16) to the VPC using an AWS Site-to-Site VPN. The security engineer has configured the virtual private gateway (VGW) and the customer gateway (CGW) with the correct settings. The VPN tunnel status is UP, but the on-premises servers cannot ping the EC2 instances in the VPC. The EC2 instances have security groups that allow ICMP traffic from the on-premises network. The VPC route table has a route for the on-premises network pointing to the VGW. What is the most likely cause of the issue?

Accepted Answer

The VPC route table does not have a route for the on-premises CIDR (192.168.0.0/16) pointing to the virtual private gateway.. While the scenario states that the VPC route table has a route for the on-premises CIDR pointing to the VGW, this refers to the main route table. The EC2 instances are likely in a subnet that uses a custom route table, which may not have this route. Without the route in the subnet's route table, the VPC cannot forward reply traffic from the EC2 instances back to the on-premises network via the VPN tunnel, causing ping failures. The tunnel status (UP) and security group configuration are correct, so the issue is the missing route in the subnet's route table.

Answer

The customer gateway is not configured with the correct public IP address of the VGW.

Answer

The VPN tunnel is not configured with the correct pre-shared key.

Answer

The security group for the EC2 instances does not allow inbound ICMP from the on-premises network.

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with server-side encryption (SSE-S3) and that no public access is allowed. The team has created an SCP that denies the s3:PutBucketPublicAccessBlock action and also denies s3:PutBucketPolicy if the policy would grant public access. However, the team discovers that some buckets in the production account still have public access enabled. The SCP is applied to the root OU, which includes the production account. What is the most likely reason that the SCP is not being enforced?

Accepted Answer

The production account is the management account of the organization, and SCPs do not affect the management account.. SCPs do not affect the management account; they only apply to member accounts. If the production account is the management account, SCPs will not apply. Option A is incorrect because SCPs don't require explicit allow; they deny by default if not allowed. Option B is incorrect because SCPs affect all IAM principals in the account. Option D is incorrect because SCPs can be applied to OUs.

Answer

The SCP does not have an explicit allow for the actions it denies; SCPs require an explicit allow to take effect.

Answer

The SCP only applies to IAM users and roles, not to the root user.

Answer

The SCP is not attached to the production account's OU; it is attached to the root OU.

Question 15

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?

Accepted Answer

There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.. AWS WAF evaluates rules in order, and if a rule with a higher priority allows the request, it will not be blocked by a lower priority rule. The team may have an allow rule with higher priority that allows all requests. Option A is incorrect because WAF can inspect headers. Option B is incorrect because WAF can be used with ALB. Option C is incorrect because WAF can handle regex.

Answer

AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.

Answer

AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.

Answer

The regex pattern for the token is too complex for AWS WAF to process.