SCS-C02 Timed Practice Test 1 — 10 Questions

Question 1

Drag and drop the steps to configure AWS WAF with rate-based rules in the correct order.

Question 2

Drag and drop the steps to set up AWS Shield Advanced with automatic application layer DDoS mitigation in the correct order.

Question 3

Drag and drop the steps to implement AWS KMS key rotation in the correct order.

Question 4

Drag and drop the steps to configure a VPC with private subnets and NAT gateway for outbound internet access in the correct order.

Question 5

Drag and drop the steps to configure AWS CloudTrail for logging across all regions and accounts in the correct order.

Question 6

Drag and drop the steps to set up a secure S3 bucket with encryption and access control in the correct order.

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all Amazon S3 buckets across the organization have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket if the bucket does not have encryption enabled.. Option D is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny API actions across all accounts. By creating an SCP that denies `s3:CreateBucket` unless the request includes encryption parameters (SSE-S3 or SSE-KMS), you enforce encryption at the point of bucket creation, preventing non-compliant buckets from ever being created. This is the only approach that proactively enforces the policy across the entire organization, rather than relying on detection or per-account configurations.

Answer

Create an S3 bucket policy in each account to deny access to unencrypted buckets.

Answer

Use AWS Config rules to detect buckets without encryption and send alerts.

Answer

Create an IAM role in each account that requires encryption when creating buckets.

Question 8

A company is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application and database tiers must be isolated. The security team requires that all traffic between tiers be encrypted and that the application tier can only be accessed by the web tier. Which architecture should be used?

Accepted Answer

Place the web tier in a public subnet with an internet gateway, and the app and database tiers in private subnets. Use separate security groups for each tier, allowing only necessary traffic.. Option B is correct because it places the web tier in a public subnet with an Internet Gateway (IGW) for internet-facing access, while the application and database tiers reside in private subnets with no direct internet path. Separate security groups enforce least-privilege: the web tier security group allows inbound HTTP/HTTPS (ports 80/443) from 0.0.0.0/0, the app tier security group allows inbound traffic only from the web tier security group (using a security group reference), and the database tier security group allows inbound traffic only from the app tier security group. This ensures encryption (e.g., TLS for web-to-app, and database-native encryption like TLS or AWS RDS encryption in transit) and complete isolation of the internal tiers.

Answer

Place all tiers in public subnets and use security groups to restrict traffic.

Answer

Place the web and app tiers in public subnets and the database in a private subnet.

Answer

Place all tiers in private subnets and use a single security group to allow traffic between them.

Question 9

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

Accepted Answer

Create a security group for the web servers that allows outbound traffic on port 3306 to the database security group.. Option A is correct because security groups are stateful, so allowing outbound traffic on port 3306 from the web servers to the database security group automatically permits the corresponding return traffic. This adheres to the principle of least privilege by specifying the destination as the database security group ID rather than a broad CIDR range, ensuring only the intended web servers can initiate the connection.

Answer

Create a security group for the database servers that allows inbound traffic on port 3306 from the web subnet CIDR.

Answer

Place the database servers in a public subnet for easier connectivity.

Answer

Configure the network ACL for the database subnet to allow inbound traffic on port 3306 from the web subnet CIDR.

Question 10

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.. The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.

Answer

The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The security group does not allow inbound traffic from the on-premises server.