SCS-C02 Infrastructure Security Practice Test 9 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Answer

Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.

Answer

Add a network ACL to the private subnet that denies inbound HTTP traffic.

Question 2

A company wants to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The `aws:SecureTransport` condition key checks whether the request was sent using SSL/TLS (i.e., HTTPS). Setting it to `false` in a deny statement ensures that any HTTP request to the S3 bucket is rejected, thereby enforcing encryption in transit. This is the correct condition for the stated requirement.

Answer

aws:SourceVpce

Answer

s3:x-amz-server-side-encryption

Answer

aws:SourceIp

Question 3

A security engineer is designing a VPC with private and public subnets. Which TWO actions improve network security? (Choose two.)

Accepted Answer

Use security groups to restrict traffic to the database from only the application tier.. Security groups act as a stateful virtual firewall at the instance level, allowing you to restrict inbound traffic to the database instances to only the application tier's security group. This ensures that only traffic originating from the application instances can reach the database, effectively implementing a least-privilege security model.

Answer

Use a single subnet for all resources to simplify network rules.

Answer

Place database instances in a public subnet for easier management.

Answer

Place an internet gateway in a private subnet.

Question 4

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to allow only HTTP and HTTPS traffic from the internet to the ALB, and only HTTP traffic from the ALB to the EC2 instances. Which THREE security group configurations are required? (Choose three.)

Accepted Answer

ALB security group: inbound rule allowing HTTP from 0.0.0.0/0.. The ALB must accept HTTP traffic from the internet (0.0.0.0/0) to serve web requests. This inbound rule allows the ALB to listen on port 80 for unencrypted HTTP traffic, which is a standard requirement for a public-facing web application. Without this rule, HTTP requests from clients would be dropped by the ALB's security group.

Answer

EC2 security group: inbound rule allowing HTTP from 0.0.0.0/0.

Answer

EC2 security group: inbound rule allowing HTTPS from ALB security group.

Question 5

A company has the S3 bucket policy shown in the exhibit. The bucket contains sensitive data that should only be accessible from within the corporate network (10.0.0.0/16). However, users inside the corporate network report that they cannot access objects in the bucket. What is the most likely cause?

Accepted Answer

Users are accessing the bucket through a VPC endpoint, which changes the source IP.. The condition uses IpAddress, which evaluates the source IP of the request. If users are accessing via a VPC endpoint, the source IP is not the client IP but the endpoint's private IP, which may not be in the specified range. Option A is wrong because a condition exists. Option C is wrong because IAM roles are not relevant to the public policy. Option D is wrong because SSL is not required by the policy.

Answer

Users do not have the appropriate IAM role assigned.

Answer

The policy does not have a Deny statement.

Answer

The bucket policy requires SSL but the connection is not using HTTPS.

Question 6

A company has a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL database. The security team has implemented security groups and network ACLs. Recently, a vulnerability scan revealed that the RDS database is accessible from the internet. The security engineer investigates and finds that the database security group allows inbound traffic on port 3306 from 0.0.0.0/0. The engineer also checks the network ACLs and finds that inbound rules allow traffic on port 3306 from 0.0.0.0/0, and outbound rules allow all traffic. The database is in a private subnet. Which combination of steps should the engineer take to remediate the issue while maintaining application functionality?

Accepted Answer

Update the database security group to allow inbound traffic on port 3306 from the VPC CIDR range. No changes to network ACL are needed.. It restricts the database security group to allow inbound traffic on port 3306 only from the VPC CIDR range, which still permits the EC2 instances (within the VPC) to connect to the database. No changes to the network ACL are needed because it is stateless and the database is in a private subnet, so the security group is the primary control for inbound traffic. Option A is incorrect because network ACLs cannot reference security groups; they must use CIDR ranges. Option B is incorrect because it also attempts to reference a security group in the network ACL, which is not possible. Option D is incorrect because moving the database to a public subnet would expose it to the internet, increasing the attack surface.

Answer

Update the network ACL inbound rule to allow traffic only from the ALB security group. The security group is already correctly configured.

Answer

Update the database security group to allow inbound traffic on port 3306 only from the ALB security group. Update the network ACL inbound rule to allow traffic from the ALB security group.

Answer

Move the database to a public subnet and restrict the security group to the ALB security group.

Question 7

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all Amazon S3 buckets across the organization are configured to block public access. Which solution should be used to centrally enforce this requirement?

Accepted Answer

Use a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action at the organization root.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within the organization. By denying the s3:PutBucketPublicAccessBlock action at the organization root, you prevent any account from disabling or modifying the public access block settings on any S3 bucket, thereby enforcing the security team's requirement across all accounts. This approach works because SCPs are applied at the organization level and override any IAM or bucket-level permissions that would otherwise allow the action.

Answer

Enable AWS Trusted Advisor to automatically remediate public buckets.

Answer

Create an IAM role in each account that denies the s3:PutBucketPublicAccessBlock action.

Answer

Apply a bucket policy to each bucket that blocks public access.

Question 8

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The security team wants to allow only traffic from the ALB to reach the EC2 instances. Which security group configuration should be used?

Accepted Answer

Allow inbound traffic from the ALB's security group ID on the EC2 security group.. Security groups can reference other security groups by ID. By setting an inbound rule on the EC2 security group that references the ALB's security group ID, only traffic originating from the ALB is allowed. This is the recommended approach as ALB private IP addresses are dynamic and can change, making IP-based rules (Option A) unreliable.

Answer

Allow inbound traffic from the ALB's private IP addresses on the EC2 security group.

Answer

Allow inbound traffic from the VPC CIDR block on the EC2 security group.

Answer

Allow inbound HTTP traffic from 0.0.0.0/0 on the EC2 security group.

Question 9

A security engineer needs to ensure that an Amazon RDS database instance is not accessible from the internet. Which configuration step will achieve this?

Accepted Answer

Set the DB instance to be not publicly accessible and place it in a private subnet.. Setting a DB instance to be not publicly accessible ensures that it does not receive a public IP address, and placing it in a private subnet (one without a route to an internet gateway) prevents any direct inbound or outbound traffic from the internet. This combination guarantees that the RDS instance is isolated from the public internet, aligning with the security requirement.

Answer

Deploy the DB instance in a multi-AZ configuration.

Answer

Set the DB instance to be publicly accessible and restrict security group inbound rules.

Answer

Use the default VPC security group for the DB instance.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. A security requirement states that no security group should allow inbound SSH access from 0.0.0.0/0. What is the best way to enforce this policy?

Accepted Answer

Use AWS Config with a managed rule to detect and automatically remediate non-compliant security groups.. AWS Config with a managed rule (e.g., 'restricted-ssh') can continuously evaluate security group configurations against the policy and automatically remediate non-compliant rules using AWS Systems Manager Automation. This provides detective and corrective enforcement without blocking legitimate administrative actions, unlike IAM or SCP approaches that would prevent necessary changes or fail to detect existing non-compliant resources.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.

Answer

Add an AWS::IAM::Policy resource in the CloudFormation template to deny the rule.

Answer

Use a service control policy (SCP) that denies the CreateStack action if the template contains SSH from 0.0.0.0/0.

Question 11

A company has a VPC with public and private subnets. The private sub host Amazon RDS instances. To allow the RDS instances to access the internet for software updates without exposing them to inbound internet traffic, what should be configured?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway in the private subnet route table.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. Adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway enables this outbound-only internet access for the RDS instances.

Answer

Use a VPN connection to an on-premises network that has internet access.

Answer

Set up a VPC peering connection to a VPC with internet access.

Answer

Attach an internet gateway to the private subnet route table.

Question 12

A company wants to encrypt data at rest for an Amazon S3 bucket. Which action should be taken?

Accepted Answer

Enable default encryption on the S3 bucket.. Enabling default encryption on the S3 bucket ensures that all objects stored in the bucket are automatically encrypted at rest using server-side encryption (SSE-S3, SSE-KMS, or SSE-C). This meets the requirement for encrypting data at rest without requiring any client-side changes, as the encryption is applied by S3 upon write.

Answer

Use client-side encryption before uploading objects.

Answer

Enable SSL/TLS for the bucket.

Answer

Use AWS CloudHSM to encrypt the bucket.

Question 13

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, but the application and database tiers must not. Which VPC configuration should be used?

Accepted Answer

Place web tier in public subnets, app and database tiers in private subnets.. It places the web tier in public subnets with an internet gateway for direct internet access, while the application and database tiers reside in private subnets with no direct internet route. This ensures that only the web tier is exposed, and the app and database tiers can only be reached through the web tier via internal routing, aligning with the principle of least privilege for a three-tier architecture.

Answer

Place web and app tiers in public subnets, database in private subnet.

Answer

Place all tiers in private subnets and use a VPN for external access.

Answer

Place all tiers in public subnets with security groups restricting access.

Question 14

A company wants to protect its Amazon EC2 instances from distributed denial-of-service (DDoS) attacks at the network layer. Which AWS service should be used?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protections for Amazon EC2 instances against network-layer (Layer 3/4) DDoS attacks, such as SYN floods, UDP reflection attacks, and other volumetric attacks. It includes always-on traffic monitoring, automated mitigation, and access to the DDoS Response Team (DRT) for custom mitigations, making it the correct choice for network-layer DDoS protection.

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Answer

AWS WAF

Question 15

A security engineer is configuring a VPC for a new application. Which TWO actions will improve network security? (Choose two.)

Accepted Answer

Use network ACLs to allow or deny traffic at the subnet level.. Network ACLs (NACLs) operate at the subnet level as a stateless firewall, allowing you to explicitly allow or deny inbound and outbound traffic based on rules (e.g., source/destination IP, port, protocol). This provides a critical layer of defense at the subnet boundary, complementing security groups. Option E is correct because security groups act as a stateful virtual firewall at the instance (ENI) level, controlling traffic based on allow rules only, which is essential for granular per-instance security.

Answer

Configure VPC endpoints to connect to AWS services privately.

Answer

Deploy a NAT gateway to allow outbound internet access.

Answer

Enable VPC Flow Logs to analyze traffic patterns.