SCS-C02 Infrastructure Security Practice Question

Exhibit

Refer to the exhibit.

[ec2-user@ip-10-0-1-5 ~]$ aws ec2 describe-security-groups --group-ids sg-12345678
{
    "SecurityGroups": [
        {
            "GroupId": "sg-12345678",
            "GroupName": "web-sg",
            "VpcId": "vpc-12345678",
            "IpPermissions": [
                {
                    "IpProtocol": "tcp",
                    "FromPort": 80,
                    "ToPort": 80,
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            ],
            "IpPermissionsEgress": []
        }
    ]
}

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The EC2 instances in this security group cannot initiate outbound connections

A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing. Option D is wrong because the security group does allow inbound HTTP.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The EC2 instances in this security group cannot initiate outbound connections
Why this is correct
Without outbound rules, all outbound traffic is denied.
✗
The EC2 instances cannot receive inbound HTTP traffic
Why it's wrong here
Inbound HTTP is allowed from all IPs.
✗
The security group allows all outbound traffic by default
Why it's wrong here
Security groups do not allow outbound traffic by default; they have a default deny egress rule.
✗
Outbound traffic is allowed because security groups are stateful
Why it's wrong here
Stateful only allows return traffic for allowed inbound connections; new outbound connections are blocked.

Go deeper

Practice tests

Work through a scored set and see where your weak spots actually are.

SCS-C02 Practice Test 4 — 25 Questions→SCS-C02 Practice Test 5 — 25 Questions→SCS-C02 Practice Exam 4 — 20 Questions→

Domain-focused practice

Each of these maps to a scored section of the exam blueprint.

Infrastructure Security Security Logging and Monitoring Identity and Access Management Management and Security Governance

Filter by question format

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Practice by topic

Target a specific weak area. Each page focuses on one exam topic with questions, explanations and a concept guide.

Infrastructure Security practice questions SCS-C02 fundamentals practice questions Identity and Access Management practice questions

Continue studying

SCS-C02 practice test AWS Certified Security Specialty SCS-C02 exam guide Study guide

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.

SCS-C02 Infrastructure Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question