SCS-C02 Infrastructure Security Practice Test 9 — 15 Questions

Question 1

A company wants to deploy a web application that must be accessible over HTTPS only. The application runs behind an Application Load Balancer (ALB). The security team wants to enforce HTTP Strict Transport Security (HSTS) to prevent downgrade attacks. Which configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the ALB to redirect HTTP traffic to HTTPS and have the application set the Strict-Transport-Security header in the response. HSTS is enforced by the web application sending the `Strict-Transport-Security` header in HTTPS responses. By configuring the ALB to redirect HTTP to HTTPS, all traffic is forced over TLS, and the application can then set the HSTS header to instruct browsers to always use HTTPS for future requests. The ALB itself does not natively set HSTS headers; this must be done at the application layer.

Answer

Use AWS CloudFront with a custom header that enforces HSTS

Answer

Configure the ALB listener to use HTTPS only and set a custom header via a listener rule

Answer

Enable HSTS on the ALB via the AWS Management Console

Question 2

A company is using AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt the data. Which KMS policy element should be used?

Accepted Answer

Principal. (Principal) is correct because in a KMS key policy, the Principal element specifies which IAM users, roles, or AWS services are allowed to perform actions on the key. By setting the Principal to the specific IAM role's ARN, only that role can decrypt the data, enforcing the security team's requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 3

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The security team wants to restrict access to the ALB so that it only accepts traffic from CloudFront. Which configuration should be used?

Accepted Answer

Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.. CloudFront publishes a list of its origin-facing IP address ranges, and you can restrict the ALB's security group to allow inbound traffic only from those ranges. This ensures that only CloudFront can reach the ALB directly, preventing bypass attacks. AWS provides these IP ranges in the ip-ranges.json file, which can be used to automate security group updates.

Answer

Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.

Answer

Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.

Answer

Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.

Question 4

A company has an Amazon S3 bucket that stores sensitive data. The security team wants to ensure that all access to the bucket is made only via HTTPS. Which policy should be used?

Accepted Answer

Add a bucket policy that denies access when aws:SecureTransport is false.. The condition `aws:SecureTransport` evaluates to `false` when the request is made over HTTP instead of HTTPS. By adding a bucket policy that denies all S3 actions when `aws:SecureTransport` is `false`, the company enforces HTTPS-only access at the policy level, regardless of how the request originates.

Answer

Enable CloudFront with HTTPS-only viewer protocol policy.

Answer

Use a VPC endpoint for S3 with a bucket policy that restricts access to the VPC endpoint.

Answer

Enable 'Block public access' on the bucket.

Question 5

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which solution should be used?

Accepted Answer

Use AWS Firewall Manager to define security group policies and enforce them across accounts.. AWS Firewall Manager is the correct choice because it provides centralized management of security group rules across multiple accounts in an AWS Organization. It allows the security team to define a common security group policy and automatically enforce it across all member accounts, ensuring consistent security posture without manual intervention.

Answer

Use AWS Organizations Service Control Policies to restrict security group modifications.

Answer

Use AWS Config rules to automatically remediate non-compliant security groups.

Answer

Use AWS Network Firewall to inspect traffic and block unauthorized connections.

Question 6

A company is deploying a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances are in a private subnet. How should the security group for the EC2 instances be configured?

Accepted Answer

Allow inbound HTTP/HTTPS from the security group of the ALB.. The EC2 instances are in a private subnet and should only accept traffic from the ALB, not directly from the internet. By referencing the ALB's security group as the source, you ensure that only traffic that has passed through the ALB can reach the instances, maintaining a secure architecture. This follows the principle of least privilege and prevents bypassing the load balancer.

Answer

Allow inbound HTTP/HTTPS from the internet gateway.

Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0.

Answer

Allow inbound HTTP/HTTPS from the VPC CIDR.

Question 7

A company wants to securely store and manage SSL/TLS certificates for use with CloudFront. Which AWS service should be used?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services like CloudFront. ACM integrates directly with CloudFront to automatically renew certificates before expiration, eliminating manual renewal overhead. It also handles the complex certificate chain and private key management securely, ensuring HTTPS termination at CloudFront edge locations.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (AWS KMS)

Answer

AWS CloudHSM

Question 8

A company has a VPC with multiple subnets across multiple Availability Zones. The security team wants to inspect all traffic between subnets for malicious activity. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed stateful firewall service that can inspect all traffic between subnets within a VPC, including east-west traffic, for malicious activity. It provides deep packet inspection (DPI) at Layers 3–7, supporting Suricata-compatible rules to detect and block threats like malware or intrusion attempts. This makes it the correct choice for the security team's requirement to inspect inter-subnet traffic.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Security groups

Question 9

A security engineer is configuring a VPC for a three-tier application. The web tier must be accessible from the internet, the application tier must be accessible only from the web tier, and the database tier must be accessible only from the application tier. Which TWO security group configurations should be used? (Choose TWO.)

Accepted Answer

Allow inbound HTTP/HTTPS from 0.0.0.0/0 on the web tier security group.. Option B is correct because the web tier is the only tier that must be reachable from the internet, so its security group should permit inbound HTTP (TCP 80) and HTTPS (TCP 443) from 0.0.0.0/0. Option D is correct because the application tier must be accessible only from the web tier, and referencing the web tier's security group as the source in the application tier's inbound rule enforces that tier-to-tier restriction. Option A is wrong because allowing SSH from 0.0.0.0/0 exposes the web tier to unrestricted remote administration and is not required by the scenario. Option C is wrong because the database tier should accept traffic only from the application tier, not directly from the web tier. Option E is wrong because exposing the database tier to inbound HTTP/HTTPS from the internet violates the requirement that it be accessible only from the application tier.

Answer

Allow inbound SSH from 0.0.0.0/0 on the web tier security group.

Answer

Allow inbound HTTP/HTTPS from the web tier security group on the database tier security group.

Answer

Allow inbound HTTP/HTTPS from the internet on the database tier security group.

Question 10

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Accepted Answer

Enable MACsec on the Direct Connect connection.. Option C is correct because AWS Direct Connect supports MACsec (IEEE 802.1AE) on dedicated connections at 10 Gbps and 100 Gbps, providing point-to-point Layer 2 encryption between the on-premises router and the AWS Direct Connect location. Option E is correct because you can run an IPsec VPN over the private VIF (or a transit VIF) on top of Direct Connect, which encrypts traffic end-to-end at Layer 3 between the on-premises VPN device and the AWS VPN endpoint. Option A is incorrect because AWS KMS is a key management service for encrypting data at rest, not for encrypting network traffic in transit over Direct Connect. Option B is incorrect because ACM issues and manages TLS certificates for AWS-integrated services, not for encrypting a Direct Connect link. Option D is incorrect because generic SSL/TLS is not a supported mechanism for encrypting the Direct Connect private VIF transport itself; encryption must come from MACsec or an IPsec VPN.

Answer

Use AWS KMS to encrypt the traffic.

Answer

Use AWS Certificate Manager to issue certificates for the connection.

Answer

Use SSL/TLS to encrypt the traffic between on-premises and AWS.

Question 11

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. A user from IP address 203.0.113.10 tries to download an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because HTTP is used.. The bucket policy includes a condition that denies access when the request uses HTTP (aws:SecureTransport equals false). Even though the IP address 203.0.113.10 matches the allowed IP range in the policy, the explicit deny for HTTP requests overrides the allow. Since the user is using HTTP, the request is denied.

Answer

The request is allowed because the IP address matches the allow statement.

Answer

The request is denied because the IP is not in the allowed range.

Answer

The request is allowed because the user is using a valid IP.

Question 12

Refer to the exhibit. A security engineer runs the CLI command and receives the output shown. The engineer expects to see flow logs for a specific subnet, but the output shows the resource ID as a VPC. What is the most likely reason?

Accepted Answer

The flow log was created at the VPC level, not at the subnet level.. The output shows the resource ID as a VPC (vpc-xxxx), but the security engineer expected to see flow logs for a specific subnet. This indicates that the flow log was created at the VPC level, not at the subnet level. In AWS, VPC Flow Logs can be created at the VPC, subnet, or network interface level, and the resource ID in the flow log output reflects the level at which the log was configured. Since the engineer expected subnet-level logs, the most likely reason is that the flow log was created for the entire VPC instead of the specific subnet.

Answer

The flow log is not active; it shows ACTIVE, so that's not the issue.

Answer

The flow log is configured to deliver to CloudWatch, but the log group name is incorrect.

Answer

The IAM role does not have permissions to deliver logs for subnets.

Question 13

A company wants to restrict access to an Amazon S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. To enforce that all objects uploaded to an S3 bucket use SSE-KMS, you should use the bucket policy condition key `s3:x-amz-server-side-encryption` and set its value to `aws:kms`. This ensures the encryption header is `aws:kms` without requiring a specific KMS key. The key `s3:x-amz-server-side-encryption-aws-kms-key-id` is used only when you need to require a particular KMS key ARN.

Answer

s3:x-amz-server-side-encryption-customer-key

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

kms:EncryptionContext

Question 14

A company has an AWS Lambda function that needs to access an Amazon RDS database. The database is in a private subnet. Which configuration will allow the Lambda function to securely access the database without traversing the internet?

Accepted Answer

Configure the Lambda function to run in the same VPC as the RDS database, in the same private subnet.. Placing the Lambda function in the same VPC and the same private subnet as the RDS database allows the Lambda function to communicate with the database directly over the AWS network using private IP addresses. This configuration ensures traffic does not traverse the internet, and it leverages VPC routing and security groups for access control. Lambda functions must be configured with VPC settings to access resources in private subnets, and when both are in the same subnet, no additional gateways or peering are required.

Answer

Create a VPC peering connection between the Lambda VPC and the RDS VPC.

Answer

Place the Lambda function in a public subnet and use a NAT gateway to access the RDS database.

Answer

Use a VPC endpoint for Lambda to connect to the RDS database.

Question 15

A security engineer notices that an Amazon EC2 instance has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. The instance is a bastion host. What is a more secure alternative to this configuration?

Accepted Answer

Remove the inbound SSH rule and use AWS Systems Manager Session Manager to access the instance.. AWS Systems Manager Session Manager provides secure, auditable, and keyless shell access to EC2 instances without opening any inbound ports. It uses the AWS Systems Manager agent to initiate an outbound connection to the AWS SSM endpoint over HTTPS (port 443), eliminating the need for a bastion host or any inbound SSH rule. This approach also integrates with AWS Identity and Access Management (IAM) for fine-grained access control and AWS CloudTrail for full session logging.

Answer

Change the SSH port to a non-standard port to avoid automated attacks.

Answer

Restrict the inbound SSH rule to a single IP address from the corporate network.

Answer

Replace the security group rule with a network ACL that allows SSH from 0.0.0.0/0.