SCS-C02 Infrastructure Security Practice Question
A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: - All EC2 instances are launched in private subnets. - The IAM roles used by EC2 instances follow the principle of least privilege. - Security groups restrict inbound and outbound traffic. - AWS Systems Manager Patch Manager is used to patch instances. - AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. - Amazon GuardDuty is enabled.
Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?
⚠ Common exam trap
Watch out — candidates often choose VPC Flow Logs (Option A) thinking it provides active protection, but it is only a monitoring tool that does not reduce the blast radius; the key is to implement network-level and access-level restrictions that prevent data exfiltration even if an instance is compromised.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.
Using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VPC Flow Logs to monitor traffic to S3.
Why it's wrong here
VPC Flow Logs capture network traffic metadata at the elastic network interface level, including source and destination IPs, ports, and protocols, but they do not log S3 API actions such as GetObject, PutObject, or ListBucket. They also provide no enforcement mechanism; they are strictly a detective control that records traffic after it occurs. Even if you monitor Flow Logs for anomalies, an exfiltration event would already have happened before you can act, so this does not prevent data exfiltration from EC2 to S3.
- ✓
Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.
Why this is correct
Creating an S3 VPC endpoint and attaching a bucket policy that denies all access unless the request originates from that endpoint confines S3 traffic to the AWS internal network, removing exposure to the public internet. This, combined with replacing SSH with AWS Systems Manager Session Manager, eliminates inbound SSH ports and relies on IAM-based, auditable session access instead of static keys. Together, these controls shrink the attack surface and provide preventive, policy-enforced protection against both network-level exfiltration and credential compromise.
- ✗
Deploy AWS WAF in front of the S3 bucket.
Why it's wrong here
AWS WAF is a web application firewall designed to inspect and filter HTTP/S traffic destined for resources like CloudFront, Application Load Balancers, or API Gateways; it does not inspect or control S3 API calls made by EC2 instances. S3 access is governed by IAM policies, bucket policies, and access points, not by WAF rules, so deploying WAF in front of an S3 bucket cannot block direct S3 operations. Furthermore, WAF cannot authenticate or authorize principals, making it ineffective at preventing data exfiltration from an instance that already has legitimate access to the bucket.
- ✗
Create an AWS Config rule to detect S3 access from EC2 instances.
Why it's wrong here
An AWS Config rule can evaluate whether S3 buckets have certain configuration attributes, such as requiring encryption or checking for public access, but it is an after-the-fact audit tool that does not intercept or deny API requests. Config rules operate by recording resource configurations and assessing compliance against them, and they cannot enforce an allow-list of source VPC endpoints or block a GetObject call in real time. While detecting S3 access patterns from EC2 instances might be possible via CloudTrail, Config alone cannot provide the preventive control needed to stop data exfiltration before it occurs.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.