SCS-C02 Infrastructure Security Practice Question
A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)
⚠ Common exam trap
Candidates often confuse stateful security group behavior with stateless network ACLs, mistakenly thinking that a deny-all outbound rule will block return traffic for inbound connections, or they incorrectly assume that allowing outbound traffic to the ALB's security group is sufficient to prevent internet access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inbound rule: Allow HTTP/HTTPS from the ALB's security group.
Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.
Why it's wrong here
This would allow direct access to instances from the internet.
- ✓
Inbound rule: Allow HTTP/HTTPS from the ALB's security group.
Why this is correct
This ensures only ALB traffic reaches the instances.
- ✗
Outbound rule: Allow all traffic to the ALB's security group only.
Why it's wrong here
This does not prevent instances from reaching the internet via other routes (e.g., NAT gateway).
- ✓
Outbound rule: Deny all traffic to 0.0.0.0/0.
Why this is correct
This prevents instances from initiating outbound internet connections.
- ✗
Outbound rule: Allow all traffic to 0.0.0.0/0.
Why it's wrong here
This would allow instances to initiate outbound connections to the internet.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.