Courseiva

CCNA Infrastructure Security Questions

75 of 132 questions · Page 1/2 · Infrastructure Security · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all security groups restrict SSH access to only the company's VPN public IP address range (203.0.113.0/24). A developer creates a stack that includes a security group with SSH open to 0.0.0.0/0. The stack deploys successfully. Which action should the security team take to prevent this in the future?

A.Create an AWS CloudFormation stack policy to block security groups with SSH open to 0.0.0.0/0.
B.Use an AWS Config managed rule to detect security groups with unrestricted SSH access and trigger an automatic remediation.
C.Implement a service control policy (SCP) to deny the ec2:AuthorizeSecurityGroupIngress action for port 22 from 0.0.0.0/0.
D.Add an IAM policy to deny the ec2:AuthorizeSecurityGroupIngress action for port 22 from 0.0.0.0/0.
AnswerB

AWS Config can evaluate security group rules and trigger remediation via Systems Manager Automation.

Why this answer

Using AWS CloudFormation Stack Policies allows you to define which stack resources can be updated or deleted, but not to enforce security rules. AWS Config rules can evaluate resources against desired configurations and trigger remediation or notifications. Service control policies (SCPs) are for AWS Organizations and cannot block resource creation at the account level.

IAM permissions can prevent users from creating security groups with open SSH, but that requires careful management and does not cover all cases. Option B is the correct answer because an AWS Config managed rule can detect security groups with unrestricted SSH access and trigger an automatic remediation action via AWS Systems Manager Automation.

Practice this question →
2
MCQhard

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The security team wants to receive real-time notifications when a DDoS attack is detected. Which configuration should be used?

A.Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an Amazon SNS notification when a Shield Advanced event occurs.
B.Enable VPC Flow Logs and create a CloudWatch alarm for high traffic volume.
C.Subscribe an SNS topic to Shield Advanced notifications directly.
D.Enable AWS CloudTrail and create a metric filter for DDoS events.
AnswerA

Shield Advanced publishes events to CloudWatch Events.

Why this answer

AWS Shield Advanced automatically pushes DDoS events to Amazon CloudWatch Events. You can configure a CloudWatch Events rule to match Shield events and trigger an AWS Lambda function that sends notifications via Amazon SNS. Option B is incorrect because VPC Flow Logs record IP traffic metadata, not DDoS events, and a high traffic alarm is not a reliable indicator of a Shield-detected attack.

Option C is incorrect because Shield Advanced does not natively support direct SNS subscriptions for notifications; it integrates via CloudWatch Events. Option D is incorrect because AWS CloudTrail records API calls, not DDoS events, and metric filters on CloudTrail logs would not capture Shield-specific attack detections.

Practice this question →
3
MCQmedium

A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?

A.Configure the instances' security group to allow traffic from the ALB's security group.
B.Configure the instances' security group to allow traffic from the client's source IP addresses.
C.Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.
D.Assign an IAM role to the instances that allows traffic only from the ALB.
AnswerA

This ensures only traffic that passes through the ALB can reach the instances.

Why this answer

Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.

Exam trap

The trap here is that candidates often confuse network ACLs (stateless, IP-based) with security groups (stateful, group-based) and mistakenly choose option C, not realizing that security group referencing is the correct and more secure method for this scenario.

How to eliminate wrong answers

Option B is wrong because allowing traffic from client source IP addresses would permit direct access to the EC2 instances, bypassing the ALB and defeating the purpose of restricting traffic to only the ALB. Option C is wrong because network ACLs are stateless and operate at the subnet level; they cannot reference security groups and would require manual management of ALB private IP addresses, which can change over time. Option D is wrong because IAM roles control API-level permissions for AWS services, not network traffic; they cannot filter or allow inbound traffic to EC2 instances.

Practice this question →
4
MCQmedium

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all Amazon S3 buckets created by CloudFormation are encrypted by default. Which approach should be taken?

A.Configure an IAM policy that requires all S3 operations to use encryption.
B.Set a bucket policy in the CloudFormation template that denies all actions unless encryption is enabled.
C.Enable AWS Config rule s3-bucket-server-side-encryption-enabled to enforce encryption.
D.Use a bucket policy with a condition that denies s3:PutObject if the x-amz-server-side-encryption header is not present.
AnswerD

This policy enforces encryption on object uploads.

Why this answer

A bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to the bucket must include encryption headers. This enforces server-side encryption at the object level, which is the most direct way to guarantee encryption for all objects placed into S3 buckets created by CloudFormation.

Exam trap

The trap here is that candidates often confuse bucket-level default encryption (which can be overridden by individual requests) with object-level enforcement via bucket policy conditions, leading them to choose AWS Config rules or IAM policies that do not guarantee encryption on every object upload.

How to eliminate wrong answers

Option A is wrong because an IAM policy that requires all S3 operations to use encryption applies to the IAM user or role, not to the S3 bucket itself, and does not enforce encryption on objects uploaded by other principals or services. Option B is wrong because a bucket policy that denies all actions unless encryption is enabled would block legitimate operations that do not involve encryption headers, such as listing buckets or reading metadata, and is overly broad. Option C is wrong because an AWS Config rule like s3-bucket-server-side-encryption-enabled only checks whether the bucket has default encryption configured, but does not enforce encryption on individual object uploads, which can bypass default encryption if the request specifies otherwise.

Practice this question →
5
Multi-Selectmedium

A security engineer is tasked with securing an Amazon RDS for MySQL database. The database must be accessible only from a specific set of EC2 instances. Which THREE steps should the engineer take?

Select 3 answers
A.Disable encryption at rest to improve performance.
B.Enable encryption at rest for the RDS instance.
C.Launch the RDS instance in a private subnet.
D.Create a security group that allows inbound traffic on port 3306 from the EC2 instances' security group.
E.Associate the RDS instance with a public subnet for easier access.
AnswersB, C, D

Encryption at rest protects data on disk.

Why this answer

Enabling encryption at rest for the RDS instance ensures that data stored on the underlying storage is encrypted using AWS Key Management Service (KMS). This is a security best practice for protecting sensitive data at rest, and it does not conflict with the requirement to restrict network access. Encryption at rest is independent of network access controls and is essential for compliance with many security frameworks.

Exam trap

The trap here is that candidates may focus solely on network-level controls (security groups and subnets) and overlook encryption at rest as a required security step, or they may incorrectly believe that encryption at rest degrades performance significantly for MySQL workloads.

Practice this question →
6
MCQeasy

A company wants to block traffic from a specific IP address range from accessing an Application Load Balancer (ALB). Which AWS feature should be used?

A.Network ACL
B.Security Group for the ALB
C.Route53
D.AWS WAF
AnswerD

Web application firewall that can filter by IP.

Why this answer

AWS WAF can be associated with an Application Load Balancer to filter traffic based on IP addresses, allowing you to block traffic from a specific IP address range. Option A is incorrect because Network ACLs operate at the subnet level and cannot be directly associated with an ALB. Option B is incorrect because security groups for an ALB cannot block IP addresses; they support allow rules only and do not have a deny capability.

Option C is incorrect because Route53 is a DNS service and does not filter traffic.

Practice this question →
7
MCQmedium

A company is designing a VPC for a three-tier web application that must be accessible from the internet only via HTTPS. The web servers must be able to initiate outbound connections to the internet for software updates, but the database servers must have no direct internet access. Which architecture meets these requirements?

A.Web servers in private subnets, database servers in public subnets, both behind an Application Load Balancer
B.Web servers in public subnets, database servers in private subnets with a route to a NAT Gateway in a public subnet
C.Web servers in private subnets with a route to a NAT Gateway, database servers in private subnets with no route to the NAT Gateway, both behind an Application Load Balancer in public subnets
D.Web servers in public subnets with Elastic IPs, database servers in private subnets with a route to an internet gateway
AnswerC

Web servers can reach the internet via NAT, database servers have no internet access, and the ALB handles HTTPS traffic.

Why this answer

It places the web servers in private subnets with a route to a NAT Gateway for outbound internet access (e.g., software updates), while the database servers are in private subnets with no route to the NAT Gateway, ensuring no direct internet access. Both tiers are behind an Application Load Balancer in public subnets for HTTPS ingress. Option A is wrong because database servers in public subnets have direct internet access.

Option B is wrong because web servers in public subnets have direct internet access, reducing security. Option D is wrong because web servers in public subnets with Elastic IPs have direct internet access, and database servers with a route to an internet gateway also have internet access.

Practice this question →
8
MCQhard

A security engineer is reviewing AWS CloudTrail logs and notices repeated `UnauthorizedOperation` errors for `ec2:RunInstances` from a specific IAM user. The user has a policy that allows `ec2:RunInstances` with a condition `aws:RequestedRegion` set to `us-east-1`. The engineer confirms the user is launching instances in `us-east-1`. What is the most likely cause of the error?

A.The user does not have a service-linked role for EC2.
B.The IAM policy lacks a `Resource` element specifying which instances can be launched.
C.The user is trying to launch an instance type that is not supported in us-east-1.
D.The user is using an AWS CLI command that does not include the `--region` parameter, causing the request to go to a global endpoint.
AnswerD

The condition key checks the requested region; without specifying region, it may default to a global endpoint.

Why this answer

The error occurs because the user's IAM policy condition `aws:RequestedRegion` evaluates the region specified in the request, not the physical region where the instance is launched. If the user runs an AWS CLI command without the `--region` parameter, the request goes to the global endpoint (iam.amazonaws.com) or the default region configured in the CLI, which may not be `us-east-1`. This causes the condition to fail, resulting in an `UnauthorizedOperation` error.

Option A is incorrect because service-linked roles are not required for `ec2:RunInstances`. Option B is incorrect because the condition key `aws:RequestedRegion` does not require a `Resource` element; it works with the default resource `*`. Option C is incorrect because the error is `UnauthorizedOperation`, not an instance type error.

Practice this question →
9
Multi-Selecthard

Which THREE of the following are best practices for securing an Amazon RDS database instance? (Select THREE.)

Select 3 answers
A.Enable encryption at rest using AWS KMS
B.Place the RDS instance in a private subnet
C.Use strong passwords and rotate them regularly
D.Enable public accessibility for ease of management
E.Use the default database port
AnswersA, B, C

Encryption at rest protects data if storage is compromised.

Why this answer

Enabling encryption at rest using AWS KMS ensures that the underlying storage for the RDS instance, automated backups, read replicas, and snapshots are encrypted using AES-256. This protects data at rest from unauthorized physical access or storage media theft, and is a fundamental security best practice for compliance frameworks like PCI DSS and HIPAA.

Exam trap

The trap here is that candidates often confuse 'public accessibility' with necessary management access, but AWS explicitly recommends placing RDS in a private subnet and using a bastion host or AWS Systems Manager Session Manager for secure administrative access, not a public IP.

Practice this question →
10
Multi-Selecthard

A company has a VPC with a single public subnet and a single private subnet. The private subnet contains an RDS MySQL database that should not be accessible from the internet. The public subnet contains a bastion host that is used for SSH access to the database instance. The security team wants to ensure that the database can only be accessed from the bastion host. Which two security group rules should be configured? (Choose TWO.)

Select 2 answers
A.Database security group: Allow inbound MySQL from the public subnet CIDR.
B.Database security group: Allow inbound MySQL from the bastion security group.
C.Bastion security group: Allow inbound SSH from a limited corporate IP range.
D.Database security group: Allow inbound MySQL from 0.0.0.0/0.
E.Bastion security group: Allow inbound SSH from 0.0.0.0/0.
AnswersB, C

This restricts database access to the bastion.

Why this answer

Options B and C are correct. The database security group should allow inbound MySQL from the bastion security group (option B), ensuring only the bastion can access the database. The bastion security group should allow inbound SSH only from a limited corporate IP range (option C) to restrict administrative access.

Option A is incorrect because allowing inbound MySQL from the public subnet CIDR would permit any instance in that subnet, not just the bastion. Option D is incorrect as it allows MySQL from the entire internet. Option E is incorrect because it allows SSH from any IP, which is insecure.

Practice this question →
11
MCQhard

A company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Application Load Balancer (ALB) to distribute traffic. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0 and a security group for the EC2 instances that allows inbound HTTP from the ALB's security group. Recently, the company experienced a security incident where an attacker exploited a vulnerability in the application to gain access to an EC2 instance and then moved laterally to the database. The database is in a private subnet and uses a security group that allows inbound traffic from the EC2 instance security group on port 3306 (MySQL). The security team wants to prevent lateral movement in the future. Which of the following is the MOST effective course of action?

A.Use VPC peering to isolate the database subnet from the application subnet.
B.Deploy AWS WAF in front of the ALB to block known malicious IPs.
C.Create a network ACL for the private subnet that denies outbound traffic from the EC2 instances to the database subnet.
D.Implement a host-based firewall on each EC2 instance to restrict outbound connections to only the database endpoint.
AnswerD

This provides fine-grained control over outbound traffic from the application.

Why this answer

Implementing a host-based firewall on each EC2 instance provides granular control over outbound connections, allowing only necessary traffic such as to the database endpoint. This prevents an attacker who compromises an EC2 instance from moving laterally to the database by restricting outbound connections at the instance level. In contrast, option A (VPC peering) is for connecting different VPCs and does not prevent lateral movement within the same VPC.

Option B (AWS WAF) protects the ALB from web attacks but does not restrict outbound traffic from instances. Option C (network ACLs) operates at the subnet level and can block traffic between subnets, but it is stateless and less granular than a host-based firewall, and it cannot restrict traffic to a specific database endpoint if the database is in a different subnet. Therefore, a host-based firewall is the most effective solution.

Practice this question →
12
Multi-Selecteasy

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can download objects. Which combination of actions should the company take? (Choose TWO.)

Select 2 answers
A.Attach an Internet gateway to the VPC and route traffic through it.
B.Attach a security group to the S3 bucket.
C.Create an S3 bucket policy that allows access only from the VPC using the aws:SourceVpc condition.
D.Create a NAT gateway in the VPC for outbound traffic.
E.Create a VPC endpoint for Amazon S3 in the VPC.
AnswersC, E

This restricts access to the specified VPC.

Why this answer

To restrict access to an S3 bucket so that only traffic from a specific VPC can download objects, the correct combination is to create an S3 bucket policy that uses the aws:SourceVpc condition (Option C) and create a VPC endpoint for Amazon S3 in the VPC (Option E). The bucket policy with aws:SourceVpc ensures that only requests originating from the specified VPC are allowed, while the VPC endpoint enables private connectivity between the VPC and S3 without traversing the internet. Option A (Internet gateway) would make the VPC publicly accessible and is not required for private access.

Option B (NAT gateway) is used for outbound internet access from private subnets, not for restricting access to S3. Option D (security group) cannot be attached to an S3 bucket; security groups apply to EC2 instances or other resources, not to S3.

Practice this question →
13
MCQhard

A company runs a containerized application on Amazon ECS with Fargate. The security team wants to ensure that the containers can only communicate with specific external APIs and not with other containers in the same task. Which security control should be applied?

A.Configure network ACLs on the subnets where the tasks run.
B.Apply an IAM policy to the task execution role to restrict API calls.
C.Attach a security group to the ECS task with outbound rules allowing only the specific API endpoints.
D.Use VPC endpoints to restrict traffic to specific APIs.
AnswerC

When using awsvpc network mode, tasks get their own security groups that can filter traffic.

Why this answer

Security groups attached to ECS tasks in awsvpc mode can control inbound and outbound traffic at the task level, allowing restriction of communication to specific external API endpoints. Option A is incorrect because network ACLs operate at the subnet level and are stateless, not suitable for per-task granularity. Option B is incorrect because IAM policies control API authorization, not network traffic.

Option D is incorrect because VPC endpoints are used for private connectivity to AWS services, not for restricting container outbound traffic to external APIs.

Practice this question →
14
MCQhard

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

A.The network ACL allows inbound SSH from 0.0.0.0/0
B.The security group rule is being overridden by a more restrictive security group attached to the same instance
C.The security group rule is being evaluated but the instance's operating system firewall is blocking SSH
D.The network ACL denies inbound SSH from all IPs except the specific IP
AnswerD

Network ACLs are stateless and can explicitly deny traffic. If the NACL denies SSH from all IPs except the specific one, it would override the permissive security group rule, explaining why only that IP can connect.

Why this answer

A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction.

Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Practice this question →
15
MCQmedium

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?

A.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}
B.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}
C.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}
D.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}
AnswerA

This condition restricts access to traffic coming through the specified VPC endpoint.

Why this answer

It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.

Exam trap

The trap here is that candidates often confuse `aws:SourceVpc` with `aws:SourceVpce` or mistakenly use IP-based conditions like `aws:SourceIp` or `aws:VpcSourceIp`, not realizing that for S3 bucket policies, the correct condition key to restrict to a specific VPC endpoint is `aws:SourceVpce`, and that `aws:SourceVpc` is not supported for S3 gateway endpoints.

How to eliminate wrong answers

Option B is wrong because `aws:VpcSourceIp` is not a valid condition key; the correct key for VPC endpoint traffic is `aws:SourceVpce` or `aws:SourceVpc`, not an IP-based condition. Option C is wrong because `aws:SourceVpc` condition key checks the VPC ID of the requester, but this only works for VPC endpoints that support the `aws:SourceVpc` key (e.g., some AWS services), and for S3 gateway endpoints, the `aws:SourceVpc` key is not available; instead, `aws:SourceVpce` must be used to restrict to a specific endpoint. Option D is wrong because `aws:SourceIp` condition key cannot be used to restrict traffic from a VPC endpoint, as the source IP of requests through a VPC endpoint is the private IP of the endpoint's network interface, which is not reliably the same as the VPC's CIDR range, and the condition key `aws:SourceIp` is intended for public IP addresses, not private IPs from VPC endpoints.

Practice this question →
16
MCQhard

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with server-side encryption (SSE-S3) and that no public access is allowed. The team has created an SCP that denies the s3:PutBucketPublicAccessBlock action and also denies s3:PutBucketPolicy if the policy would grant public access. However, the team discovers that some buckets in the production account still have public access enabled. The SCP is applied to the root OU, which includes the production account. What is the most likely reason that the SCP is not being enforced?

A.The SCP does not have an explicit allow for the actions it denies; SCPs require an explicit allow to take effect.
B.The SCP only applies to IAM users and roles, not to the root user.
C.The production account is the management account of the organization, and SCPs do not affect the management account.
D.The SCP is not attached to the production account's OU; it is attached to the root OU.
AnswerC

Management account is not affected by SCPs.

Why this answer

SCPs do not affect the management account; they only apply to member accounts. If the production account is the management account, SCPs will not apply. Option A is incorrect because SCPs don't require explicit allow; they deny by default if not allowed.

Option B is incorrect because SCPs affect all IAM principals in the account. Option D is incorrect because SCPs can be applied to OUs.

Practice this question →
17
Multi-Selectmedium

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation have encryption enabled by default. Which TWO approaches can achieve this?

Select 2 answers
A.Create an AWS Config rule that checks for S3 bucket encryption and auto-remediates
B.Enable S3 Block Public Access at the account level
C.Attach a service control policy (SCP) to the root OU that denies S3 bucket creation without encryption
D.Attach an IAM role to the CloudFormation service that grants permissions to encrypt buckets
E.Use a CloudFormation stack policy to deny creation of S3 buckets without encryption
AnswersA, C

AWS Config rule with auto-remediation can detect buckets without encryption and automatically apply encryption, ensuring compliance.

Why this answer

An AWS Config rule can check that S3 buckets have encryption enabled and automatically remediate any non-compliant buckets. Option C is correct because a service control policy (SCP) can be attached to the root OU to deny the creation of S3 buckets without encryption, using a condition on the s3:x-amz-server-side-encryption header. Option B is incorrect because S3 Block Public Access does not enforce encryption.

Option D is incorrect because attaching an IAM role to CloudFormation only grants permissions but does not enforce encryption. Option E is incorrect because CloudFormation stack policies only protect existing resources from updates and cannot enforce conditions on bucket creation.

Practice this question →
18
MCQmedium

Refer to the exhibit. A security engineer is investigating a potential unauthorized VPC creation. What does the evidence suggest?

A.The user admin created two VPCs, but one was deleted shortly after creation.
B.The CloudTrail log is incomplete; both VPCs exist.
C.Both VPCs were created successfully and still exist.
D.The user admin only created one VPC; the second event is a duplicate.
AnswerA

Correct. The non-existent VPC suggests deletion.

Why this answer

The CloudTrail log shows two CreateVpc events by user admin. One VPC exists (vpc-12345678), but the other (vpc-87654321) does not exist, indicating that it was deleted after creation. This could indicate malicious activity where a VPC was created and then deleted to cover tracks.

Practice this question →
19
MCQmedium

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

A.The EC2 instances in this security group cannot initiate outbound connections
B.The EC2 instances cannot receive inbound HTTP traffic
C.The security group allows all outbound traffic by default
D.Outbound traffic is allowed because security groups are stateful
AnswerA

Without outbound rules, all outbound traffic is denied.

Why this answer

A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing.

Option D is wrong because the security group does allow inbound HTTP.

Practice this question →
20
Multi-Selectmedium

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Select 2 answers
A.Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.
B.Disable automated backups to reduce storage costs.
C.Enable Multi-AZ deployment for fault tolerance.
D.Assign a public IP address to the RDS instance for easier access from the internet.
E.Enable encryption at rest using AWS KMS.
AnswersA, E

Network isolation improves security.

Why this answer

Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.

Exam trap

The trap here is that candidates often confuse high availability (Multi-AZ) or cost-saving measures (disabling backups) with security controls, when in fact they do not address confidentiality, integrity, or access control.

Practice this question →
21
MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

A.Use an HTTPS listener on the ALB and configure the target group with HTTPS.
B.Use a TCP listener on the ALB and a TCP target group.
C.Configure security group inbound rules to allow only HTTPS traffic.
D.Use an HTTP listener on the ALB and HTTP on the target group.
AnswerA

HTTPS ensures encryption from ALB to instances.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates assume an HTTPS listener alone encrypts all traffic end-to-end, forgetting that the ALB-to-instance leg must also use HTTPS; otherwise, traffic between the ALB and EC2 instances is in plaintext.

How to eliminate wrong answers

Option B is wrong because a TCP listener and TCP target group operate at Layer 4 and do not provide encryption; they forward raw TCP traffic without TLS/SSL termination or re-encryption. Option C is wrong because security group inbound rules only control access at the network level (allowing or denying traffic based on port/protocol) and do not encrypt traffic; encryption is a function of the protocol (HTTPS/TLS), not security group rules. Option D is wrong because using HTTP on both the listener and target group means traffic is transmitted in plaintext at every hop, with no encryption between the ALB and EC2 instances.

Practice this question →
22
MCQhard

Refer to the exhibit. A security engineer is unable to SSH into an EC2 instance in subnet-12345678. The instance's security group allows inbound SSH from 10.0.0.0/8, and the instance has a public IP. What is the most likely reason for the failure?

A.The security group egress rule is blocking return traffic.
B.The security group inbound rule restricts SSH to the 10.0.0.0/8 range, blocking the engineer's IP.
C.The network ACL's default deny rule (32767) is blocking all inbound traffic.
D.The network ACL inbound rule for SSH is misconfigured, denying all traffic.
AnswerB

Correct. The security group only allows SSH from the internal 10.0.0.0/8 range.

Why this answer

The network ACL allows inbound SSH from 0.0.0.0/0, but the security group only allows SSH from 10.0.0.0/8. Since the engineer is connecting from an IP outside that range, the security group blocks the connection.

Practice this question →
23
MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

A.The network ACL for the private subnet is blocking outbound traffic
B.The NAT Gateway's security group is blocking outbound traffic to the internet
C.The private subnet route table does not have a route to the NAT Gateway
D.The security group attached to the EC2 instance is blocking inbound traffic
AnswerB

NAT Gateway's security group must allow outbound HTTPS to 0.0.0.0/0.

Why this answer

The NAT Gateway's security group must allow outbound traffic to the internet for the patches to be retrieved. Even though the NAT Gateway allows inbound HTTPS from the private subnet, it also needs an outbound rule permitting HTTPS traffic to 0.0.0.0/0 so that response packets from the internet can flow back through the NAT Gateway to the instance. Without this outbound rule, the NAT Gateway drops the return traffic, preventing the download.

Exam trap

The trap here is that candidates assume the NAT Gateway only needs inbound rules from the private subnet, forgetting that outbound rules are required for return traffic, or they mistakenly think NAT Gateways cannot have security groups at all.

How to eliminate wrong answers

Option A is wrong because the network ACL for the private subnet is not mentioned as blocking traffic; by default, network ACLs allow all inbound and outbound traffic, and the question does not indicate any custom ACL rules that would block outbound HTTPS. Option C is wrong because the private subnet route table already has a default route (0.0.0.0/0) pointing to the NAT Gateway, so routing to the NAT Gateway is correctly configured. Option D is wrong because the security group attached to the EC2 instance allows outbound HTTPS to 0.0.0.0/0, which is sufficient for the instance to initiate the connection; inbound traffic is not relevant for outbound patch downloads.

Practice this question →
24
MCQmedium

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage VPC security group rules across all accounts. Which AWS service should they use?

A.AWS Network Firewall
B.AWS Firewall Manager
C.AWS Config
D.Amazon Route 53 Resolver DNS Firewall
AnswerB

AWS Firewall Manager is the correct service for centrally managing VPC security group rules across all accounts in an AWS Organization.

Why this answer

AWS Firewall Manager is the correct service because it allows you to centrally configure and manage VPC security group rules across multiple accounts within AWS Organizations. Option A (AWS Network Firewall) is used for managing network firewall rules (e.g., stateful inspection), not security groups. Option C (AWS Config) is for evaluating configuration compliance, not for centrally managing security group rules.

Option D (Amazon Route 53 Resolver DNS Firewall) is for DNS-level filtering and does not manage security groups.

Practice this question →
25
MCQmedium

A security engineer needs to ensure that all Amazon S3 buckets in an AWS account have server-side encryption (SSE) enabled. The engineer wants to automatically remediate any bucket that is created without SSE. Which solution should the engineer implement?

A.Use S3 bucket policies to deny access to objects without encryption.
B.Apply an IAM policy that requires SSE for all S3 actions.
C.Use AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action.
D.Create a service control policy (SCP) that denies creation of buckets without encryption.
AnswerC

AWS Config can detect and automatically remediate non-compliant resources.

Why this answer

The correct solution is to use AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` and an automatic remediation action. AWS Config continuously evaluates S3 buckets against this rule and can trigger a remediation action (e.g., enabling default encryption) when a non-compliant bucket is created. Option A is incorrect because a bucket policy can deny access to objects without encryption but does not prevent creation of buckets without SSE.

Option B is incorrect because an IAM policy can require SSE for actions performed by users, but it cannot enforce encryption on the bucket itself at creation time. Option D is incorrect because a service control policy (SCP) applies to all accounts in an organization but requires careful configuration and does not directly enable SSE on the bucket; it can only deny actions that do not include encryption parameters, which is more complex and less straightforward than the AWS Config remediation approach.

Practice this question →
26
Multi-Selectmedium

A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)

Select 2 answers
A.Configure a NAT gateway in the private subnet for the application servers.
B.Place the web servers in a public subnet with a route to an internet gateway.
C.Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.
D.Place the application servers in a public subnet with a route to an internet gateway.
E.Configure the application servers' security group to allow traffic only from the web servers' security group.
AnswersB, E

This allows internet traffic to reach the web servers.

Why this answer

Placing web servers in a public subnet with a route to an internet gateway allows them to receive inbound traffic from the internet. This is the standard AWS design for internet-facing resources, where the subnet's route table directs 0.0.0.0/0 traffic to an internet gateway, enabling direct communication from the internet.

Exam trap

The trap here is that candidates often confuse network ACLs with security groups, incorrectly assuming that a stateless network ACL with IP-based rules is the correct way to restrict traffic between tiers, when in fact security group references provide a more secure and manageable solution.

Practice this question →
27
MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. Security engineers need to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which architecture should be used?

A.Use security groups in each VPC to allow only traffic from the firewall appliance's IP.
B.Establish VPC Peering connections between each VPC and the inspection VPC.
C.Configure Network ACLs in each VPC to deny traffic that does not originate from the inspection VPC.
D.Create a central inspection VPC with the firewall appliance. Configure Transit Gateway route tables to route traffic between VPCs through the inspection VPC.
AnswerD

Transit Gateway supports centralized routing for inspection.

Why this answer

Transit Gateway route tables can force traffic between VPCs through the inspection VPC by attaching the firewall appliance and using specific routing entries. Option A is incorrect because security groups only control traffic at the instance level and cannot redirect traffic to an inspection appliance. Option B is incorrect because VPC Peering does not support transitive routing, so traffic between two VPCs cannot go through a third VPC.

Option C is incorrect because Network ACLs are stateless and can only filter traffic based on IP/port, not route traffic through an inspection appliance.

Practice this question →
28
MCQmedium

Refer to the exhibit. A security engineer reviews the AWS WAF web ACL configuration. What is the effect of this configuration?

A.It blocks IPs that send more than 2000 requests and allows requests containing '<script>' in the body.
B.It allows all traffic because the rules are misconfigured.
C.It blocks both SQL injection and XSS attacks.
D.It blocks SQL injection attacks and allows XSS attacks.
AnswerA

Correct. The rate-based rule blocks high request rates, and the XSS rule allows the pattern.

Why this answer

The first rule (SQLiRule) is actually a rate-based rule that blocks IPs exceeding 2000 requests, not SQL injection. The second rule (XSSRule) has an Allow action, which would allow requests containing '<script>' in the body, defeating the purpose of blocking XSS.

Practice this question →
29
MCQhard

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

A.Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.
B.Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.
C.Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.
D.Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.
AnswerD

This encrypts both frontend and backend traffic.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates often assume HTTPS on the listener alone is sufficient, overlooking that the target group protocol must also be HTTPS to encrypt traffic between the ALB and instances, not just between clients and the ALB.

How to eliminate wrong answers

Option A is wrong because using HTTP on both the listener and target group means traffic is in plaintext, violating the encryption requirement. Option B is wrong because while the listener uses HTTPS, the target group uses HTTP, so traffic between the ALB and EC2 instances is unencrypted, which does not meet the requirement. Option C is wrong because TCP protocol at the listener and target group does not provide application-layer encryption; SSL certificates on EC2 instances alone do not encrypt traffic without HTTPS configuration on the target group.

Practice this question →
30
MCQeasy

A company wants to allow its developers to SSH into EC2 instances only from the corporate network IP range (203.0.113.0/24). Which configuration should be used to enforce this restriction?

A.Configure a network ACL on the subnet to allow inbound SSH from the corporate range and deny all other inbound traffic.
B.Use AWS Systems Manager Session Manager to connect to instances instead of SSH.
C.Add an IAM policy that allows `ec2:RunInstances` only if the request includes the corporate IP.
D.Add a security group rule that allows inbound SSH (port 22) from the corporate IP range.
AnswerD

Security groups are stateful and can restrict inbound traffic to a specific source.

Why this answer

A security group rule can restrict inbound SSH to the specific IP range. Security groups act as a virtual firewall for EC2 instances, and by adding a rule that allows inbound SSH only from the corporate IP range (203.0.113.0/24), all other inbound traffic on port 22 is implicitly denied. Option A is incorrect because network ACLs are stateless and apply at the subnet level, not the instance level, and the question asks for a configuration to enforce SSH restriction on EC2 instances.

Option B is incorrect because AWS Systems Manager Session Manager does not use SSH; it provides browser-based shell access without inbound ports. Option C is incorrect because IAM policies control permissions for API actions, not network traffic.

Practice this question →
31
MCQeasy

A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances in private subnets. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which security group configuration should be applied to the EC2 instances?

A.Allow inbound HTTP/HTTPS from the security group attached to the ALB.
B.Configure the network ACL to allow traffic from the ALB's private IP addresses.
C.Allow inbound HTTP/HTTPS from 0.0.0.0/0.
D.Allow inbound HTTP/HTTPS from the VPC CIDR block.
AnswerA

This ensures only traffic originating from the ALB is allowed.

Why this answer

Referencing the security group of the Application Load Balancer as the source in the inbound rule ensures that only traffic coming from the ALB can reach the EC2 instances. Option B is incorrect because network ACLs are stateless and cannot reference security groups; they also operate at the subnet level, not at the instance level. Option C is incorrect because allowing traffic from 0.0.0.0/0 would expose the instances to the internet.

Option D is incorrect because allowing traffic from the VPC CIDR would permit any instance in the VPC to access the EC2 instances, not just the ALB.

Practice this question →
32
Multi-Selecthard

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Select 2 answers
A.Deploy an HTTP forward proxy in the public subnet.
B.Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.
C.Set up a transit gateway and attach the VPC to it.
D.Create a gateway endpoint for Amazon S3.
E.Place the NAT device in a public subnet with a route to an internet gateway.
AnswersB, E

This routes outbound traffic from private subnets to the NAT device.

Why this answer

To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose.

Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.

Practice this question →
33
MCQeasy

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. Which AWS service should be used to allow this without assigning a public IP address to the instance?

A.Internet Gateway
B.VPC Endpoint
C.NAT Gateway
D.VPN Connection
AnswerC

A NAT Gateway allows instances in a private subnet to connect to the internet for outbound traffic while preventing inbound traffic from the internet.

Why this answer

A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while preventing inbound traffic from the internet. Option A is incorrect because an Internet Gateway alone does not provide outbound-only connectivity; instances in a private subnet would still need a public IP. Option B is incorrect because a VPC Endpoint provides private connectivity to AWS services, not general internet access.

Option D is incorrect because a VPN Connection is used for hybrid connectivity between a VPC and an on-premises network, not for internet access.

Practice this question →
34
MCQeasy

A company has a requirement to block traffic from specific IP addresses known to be malicious. The company has an Application Load Balancer (ALB) that fronts a web application. The security engineer needs to implement a solution that can block these IP addresses at the edge before they reach the ALB. Which AWS service should be used?

A.Configure security groups on the ALB to deny traffic from those IP addresses.
B.Enable AWS Shield Advanced and configure rate-based rules.
C.Add a network ACL rule to the ALB's subnet to deny the IP addresses.
D.Use AWS WAF with an IP set rule to block the malicious IP addresses.
AnswerD

WAF can block IPs at the edge before reaching the ALB.

Why this answer

AWS WAF can be associated with an Application Load Balancer and allows you to block traffic based on IP addresses using IP set rules. This enables blocking at the edge before traffic reaches the ALB. Option A is incorrect because security groups are instance-level firewalls and cannot be attached to an ALB.

Option B is incorrect as AWS Shield Advanced provides DDoS protection but does not support IP-based blocking by itself. Option C is incorrect because network ACLs operate at the subnet level, not at the ALB level, and cannot block traffic specifically destined for the ALB.

Practice this question →
35
Multi-Selectmedium

Which TWO actions can be taken to protect an S3 bucket from accidental public access? (Choose 2.)

Select 2 answers
A.Enable S3 Block Public Access at the account level
B.Use a bucket policy that denies s3:PutBucketPolicy unless the request comes from a specific VPC
C.Enable default encryption for the bucket
D.Enable MFA Delete on the bucket
E.Use an IAM policy that requires MFA for all S3 actions
AnswersA, B

Blocks all public access to S3 buckets.

Why this answer

Options A and B are correct. Enabling S3 Block Public Access at the account level (option A) prevents any public access to all buckets. Using a bucket policy with a condition that denies s3:PutBucketPolicy unless the request comes from a specific VPC (option B) ensures that only authorized VPCs can modify the bucket policy, preventing accidental public exposure.

Option C is wrong because default encryption does not affect public access. Option D is wrong because MFA Delete protects against accidental deletion, not public access. Option E is wrong because requiring MFA for S3 actions does not prevent public access.

Practice this question →
36
MCQhard

Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?

A.The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.
B.The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.
C.The security group allows outbound all traffic, which violates the principle of least privilege.
D.The instance type t2.micro is not available in the specified subnet's Availability Zone.
AnswerA

Incorrect. SCPs cannot deny actions based on the content of security group rules (e.g., permissiveness). They can only deny based on resource identifiers like security group IDs.

Why this answer

The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive.

The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.

Exam trap

Candidates often assume 'UnauthorizedOperation' always indicates missing IAM permissions, but SCPs can cause this error even when the user has explicit Allow, due to an explicit deny on specific resources or conditions.

How to eliminate wrong answers

Option B is wrong because allowing inbound HTTPS from RFC 1918 address space (private IPs) is not inherently problematic and would not trigger an 'UnauthorizedOperation' error; the error is about authorization, not subnet placement. Option C is wrong because outbound all traffic is a default security group setting and does not violate the principle of least privilege in a way that would cause an 'UnauthorizedOperation' error; SCPs typically focus on inbound rules for overly permissive access. Option D is wrong because t2.micro is a standard instance type available in most Availability Zones; if it were unavailable, the error would be 'InsufficientInstanceCapacity' or 'InvalidParameterValue', not 'UnauthorizedOperation'.

Practice this question →
37
Multi-Selectmedium

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Select 2 answers
A.Create a bastion host in the public subnet and configure the web server to use it as a proxy.
B.Create a VPC endpoint for Amazon S3.
C.Create a NAT Gateway in the public subnet.
D.Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.
E.Add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway.
AnswersC, E

NAT Gateway enables outbound internet access for instances in private subnets.

Why this answer

A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with a bastion host or assume that a VPC endpoint for S3 can provide general internet access, but the key distinction is that a NAT Gateway enables outbound internet connectivity for private subnets without exposing them to inbound traffic.

Practice this question →
38
MCQmedium

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?

A.AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.
B.AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.
C.The regex pattern for the token is too complex for AWS WAF to process.
D.There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.
AnswerD

Rules are evaluated in priority order; a higher priority allow rule would override the block rule.

Why this answer

AWS WAF evaluates rules in order, and if a rule with a higher priority allows the request, it will not be blocked by a lower priority rule. The team may have an allow rule with higher priority that allows all requests. Option A is incorrect because WAF can inspect headers.

Option B is incorrect because WAF can be used with ALB. Option C is incorrect because WAF can handle regex.

Practice this question →
39
Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Select 3 answers
A.AWS WAF attached to the NAT gateway.
B.An internet gateway attached to the VPC.
C.Route tables in the private subnets with a default route (0.0.0.0/0) pointing to the NAT gateway.
D.A VPC gateway endpoint for S3.
E.A NAT gateway in a public subnet.
AnswersB, C, E

The internet gateway provides internet access for the public subnet where the NAT gateway resides.

Why this answer

An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.

Exam trap

The trap here is that candidates often think a NAT gateway alone provides internet access, forgetting that the NAT gateway must be placed in a public subnet with a route to an internet gateway, and that the private subnet’s default route must point to the NAT gateway, not the IGW.

Practice this question →
40
MCQhard

A company uses AWS Organizations to manage multiple accounts. The security team must enforce that all Amazon S3 buckets across all accounts are encrypted with AWS KMS. The team has enabled S3 default encryption for new buckets, but existing buckets may not be encrypted. They need to automatically remediate any non-compliant buckets. The team has AWS Config and AWS Lambda available. What is the MOST operationally efficient solution?

A.Manually review all buckets using the S3 console and enable encryption for those that are not encrypted.
B.Write a script that runs daily on an EC2 instance to list all buckets and enable encryption on any that are not encrypted.
C.Use AWS Config with the s3-bucket-server-side-encryption-enabled rule and configure an AWS Systems Manager Automation document to remediate non-compliant buckets.
D.Use AWS Trusted Advisor to check for unencrypted buckets and send an SNS notification to the security team to manually remediate.
AnswerC

Correct: Config detects non-compliance and SSM Automation remediates automatically.

Why this answer

Use AWS Config with the s3-bucket-server-side-encryption-enabled rule to detect non-compliant S3 buckets. Then configure an automatic remediation action using an AWS Systems Manager Automation document to enable encryption on those buckets. This approach is serverless, automated, and operationally efficient as it does not require manual intervention or separate compute resources.

Practice this question →
41
MCQmedium

A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?

A.Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.
B.Use a single security group for all instances and use IAM policies to restrict access.
C.Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.
D.Place all instances in public subnets and restrict access using security groups.
AnswerA

Security group references provide granular control.

Why this answer

Security groups can reference other security groups as sources in inbound rules, allowing granular traffic control between tiers without CIDR blocks. This approach allows the web tier security group to allow inbound from the internet, the app tier security group to allow inbound only from the web tier security group, and the database tier security group to allow inbound only from the app tier security group. Option B is incorrect because IAM policies control user permissions, not network traffic.

Option C is incorrect because network ACLs with CIDR blocks are less specific and do not scale well, and placing tiers in separate subnets is not necessary. Option D is incorrect because placing all instances in public subnets unnecessarily exposes them to the internet, increasing security risk.

Practice this question →
42
Multi-Selectmedium

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Select 3 answers
A.VPN connection
B.Internet gateway
C.Security groups
D.Network ACLs
E.VPC Flow Logs
AnswersC, D, E

Instance-level firewall.

Why this answer

Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Exam trap

The trap here is that candidates often confuse connectivity components (VPN, Internet gateway) with security controls, or they overlook that VPC Flow Logs are a detective control (not preventive) but still a valid part of defense in depth, leading them to select A or B instead of the correct trio of security groups, network ACLs, and VPC Flow Logs.

Practice this question →
43
MCQmedium

A company has an AWS Direct Connect connection to its on-premises data center. The security team wants to ensure that traffic between the VPC and the data center is encrypted. Which solution should they use?

A.Set up an IPsec VPN connection over the Direct Connect virtual interface.
B.Enable encryption on the Direct Connect virtual interface.
C.Use AWS Site-to-Site VPN over the internet.
D.Use VPC Peering to connect the VPC to the data center.
AnswerA

This encrypts traffic between on-premises and AWS.

Why this answer

AWS Direct Connect does not encrypt traffic by default. To encrypt, you can use an IPsec VPN over the Direct Connect virtual interface (option A). Option B is incorrect because Direct Connect does not support native encryption on the virtual interface; encryption must be added via IPsec or application-level encryption.

Option C is not optimal because the requirement specifies using the existing Direct Connect connection, not internet-based VPN. Option D is incorrect because VPC Peering connects VPCs within AWS, not an on-premises data center, and does not provide encryption.

Practice this question →
44
MCQhard

A company wants to allow cross-account access to an S3 bucket. The bucket owner (Account A) wants to grant read-only access to users in Account B. Which combination of policies is required?

A.A bucket ACL in Account A granting READ access to Account B
B.A bucket policy in Account A granting s3:GetObject to Account B and an IAM policy in Account B allowing s3:GetObject
C.An IAM policy in Account A that allows s3:GetObject
D.An IAM role in Account B that grants s3:GetObject to Account A
AnswerB

Both policies are needed: the bucket policy allows cross-account access, and the IAM policy allows the user to perform the action.

Why this answer

Cross-account access to S3 requires a resource-based policy (bucket policy) in the account that owns the bucket (Account A) granting the desired permissions to the principal in Account B, and an identity-based policy (IAM policy) in the accessing account (Account B) that allows the user or role to perform the action (s3:GetObject). Option A is incorrect because bucket ACLs are legacy and do not provide the same level of control; they cannot grant access to accounts in a way that works with IAM policies alone. Option C is incorrect because an IAM policy in Account A would only grant permissions to entities within Account A, not to users in Account B.

Option D is incorrect because an IAM role in Account B would allow Account A to access Account B's resources, not the reverse; the role would need to be in Account A to be assumed by Account B users.

Practice this question →
45
MCQhard

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

A.Success, because the Allow statement is evaluated first.
B.Failure, because the user's IP is not in the allowed range.
C.Success, because the user's IP is within the allowed range.
D.Failure, because the Deny statement blocks HTTP requests.
AnswerD

Correct. The Deny for non-SecureTransport blocks the request.

Why this answer

The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Practice this question →
46
Multi-Selecthard

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Select 2 answers
A.Use AWS KMS to encrypt the traffic.
B.Use AWS Certificate Manager to issue certificates for the connection.
C.Enable MACsec on the Direct Connect connection.
D.Use SSL/TLS to encrypt the traffic between on-premises and AWS.
E.Establish an IPsec VPN tunnel over the Direct Connect connection.
AnswersC, E

MACsec provides encryption at the data link layer.

Why this answer

MACsec (IEEE 802.1AE) provides encryption at Layer 2 (data link layer) and can be enabled directly on a Direct Connect connection. This encrypts all traffic between the on-premises router and the AWS Direct Connect endpoint without requiring any changes to higher-layer protocols, making it transparent to applications.

Exam trap

The trap here is that candidates often assume encryption must happen at higher layers (like SSL/TLS) or through a separate service (like KMS), but the exam tests knowledge of Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec over Direct Connect) as the two valid methods to encrypt traffic over a Direct Connect connection.

Practice this question →
47
MCQeasy

A security engineer is configuring a VPC with public and private subnets. The engineer needs to allow instances in the private subnet to download software updates from the internet. Which component should be added to the VPC?

A.VPN connection to on-premises.
B.VPC endpoint for Amazon S3.
C.Bastion host in a public subnet.
D.NAT gateway in a public subnet.
AnswerD

NAT gateway provides outbound internet connectivity for private subnets.

Why this answer

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet for downloading updates. Option A is incorrect because a VPN connection is used for secure connectivity to on-premises networks, not for general internet access. Option B is incorrect because a VPC endpoint provides private connectivity to AWS services like S3, not to the internet.

Option C is incorrect because a bastion host is used for administrative access (SSH/RDP) to instances, not for providing internet access.

Practice this question →
48
MCQhard

A healthcare company runs a HIPAA-compliant application on AWS. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances behind an Auto Scaling group. The EC2 instances store sensitive patient data in an S3 bucket encrypted with SSE-KMS. The security team recently enabled AWS CloudTrail and Amazon GuardDuty. During a routine audit, they notice that an EC2 instance is making repeated API calls to the S3 bucket from an IP address outside the corporate network. The security team suspects the instance is compromised. What is the MOST effective immediate step to contain the potential breach while maintaining availability of the application?

A.Revoke the IAM role attached to the instance by removing the S3 permissions from the role.
B.Remove the security group that allows outbound traffic from the instance.
C.Stop the EC2 instance and detach it from the Auto Scaling group.
D.Terminate the EC2 instance immediately.
AnswerA

This instantly stops the instance's ability to access S3 while keeping the instance running for forensic analysis.

Why this answer

Revoking the IAM role's S3 permissions (Option A) immediately stops the compromised EC2 instance from accessing the S3 bucket, containing the data breach without terminating the instance or affecting application availability. Terminating or stopping the instance (Options C and D) would disrupt the application, while removing the security group (Option B) does not prevent API calls to S3 because API calls are made over the internet and not controlled by security groups.

Practice this question →
49
MCQhard

A company has a VPC with multiple subnets and uses VPC Flow Logs to capture network traffic. The security team notices that some expected traffic is not appearing in the logs. What is a likely cause?

A.Flow Logs are published to an S3 bucket instead of CloudWatch Logs.
B.The traffic uses UDP protocol.
C.The traffic is blocked by a security group rule.
D.The traffic is to or from the Amazon DNS server (169.254.169.253).
AnswerD

By default, traffic to/from the Amazon DNS server is not logged; this is the likely cause of missing expected traffic.

Why this answer

VPC Flow Logs do not capture traffic to or from the Amazon DNS server (169.254.169.253) by default. This is because the DNS server is a well-known AWS internal service and capturing that traffic is unnecessary. Therefore, if expected traffic involves the DNS server, it will not appear in the logs.

Option A is incorrect because Flow Logs can be published to either CloudWatch Logs or S3, but the destination does not cause missing logs. Option B is incorrect because Flow Logs capture UDP traffic as well as TCP. Option C is incorrect because Flow Logs capture all accepted traffic regardless of security group rules; they log both accepted and rejected traffic (though rejected traffic is logged only if the log format includes the 'action' field and the rule allows logging).

Practice this question →
50
Multi-Selectmedium

A company uses AWS Organizations and wants to restrict the use of specific instance types across all accounts. Which TWO actions should be taken to enforce this restriction?

Select 2 answers
A.Restrict instance types at the VPC level using network ACLs.
B.Use AWS CloudTrail to monitor instance launches and send alerts.
C.Apply a Service Control Policy (SCP) that denies ec2:RunInstances with noncompliant instance types.
D.Create an IAM role that denies launch of noncompliant instances.
E.Use AWS Config rules to detect and automatically stop noncompliant instances.
AnswersC, E

SCPs centrally deny actions across accounts.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By applying an SCP that denies ec2:RunInstances when the instance type does not match an allowed list, you can effectively prevent any user or role in any account from launching noncompliant instance types, even if they have full IAM permissions to do so.

Exam trap

The trap here is that candidates often confuse detective controls (like CloudTrail or AWS Config) with preventive controls (like SCPs), or they mistakenly think IAM roles can enforce organization-wide restrictions when they are only scoped to the trust policy of that specific role.

Practice this question →
51
Multi-Selecthard

A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)

Select 3 answers
A.Take a snapshot of the unencrypted instance, copy it with encryption, and restore.
B.Modify the DB instance to enable encryption after creation.
C.Create a read replica with encryption enabled, even if the source is unencrypted.
D.Enable encryption on an existing read replica of an encrypted source.
E.Enable encryption when creating the DB instance.
AnswersA, D, E

This is a valid method to encrypt an existing database.

Why this answer

You can take a snapshot of an unencrypted Amazon RDS for MySQL DB instance, create an encrypted copy of that snapshot, and then restore a new DB instance from the encrypted snapshot. This process effectively encrypts the data at rest, as the restored instance will inherit the encryption setting from the snapshot. AWS RDS does not allow enabling encryption on an existing unencrypted DB instance directly, so this snapshot-based approach is the standard workaround.

Exam trap

The trap here is that candidates assume you can enable encryption on an existing RDS instance via a simple modification (Option B), but AWS explicitly prohibits this, requiring a snapshot-based migration instead.

Practice this question →
52
Multi-Selecthard

A security engineer is configuring an AWS WAF web ACL for an Application Load Balancer. The engineer wants to block requests that contain cross-site scripting (XSS) and also limit the rate of requests from a single IP. Which THREE rule groups should be added?

Select 3 answers
A.AWS Managed Rules - IP reputation rule group
B.Rate-based rule
C.AWS Managed Rules - SQL injection rule group
D.AWS Managed Rules - Cross-site scripting (XSS) rule group
E.Geographic match rule
AnswersB, C, D

Rate-based rules limit the number of requests from an IP over a time period.

Why this answer

Options B, C, and D are correct. A Rate-based rule (B) limits the rate of requests from a single IP, meeting the rate-limiting requirement. The AWS Managed Rules for SQL injection (C) and Cross-site scripting (D) directly address the XSS and SQL injection threats.

Option A (IP reputation) blocks based on known malicious IPs, not rate or XSS. Option E (Geographic match) restricts by location, not behavior.

Practice this question →
53
MCQmedium

A company is designing a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates but cannot be directly accessed from the internet. Which AWS service or feature should be used to meet this requirement?

A.NAT Gateway
B.VPC Peering
C.AWS VPN
D.Internet Gateway
AnswerA

Correct. NAT Gateway provides outbound-only internet access for private subnets.

Why this answer

A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound traffic from the internet. An Internet Gateway (option D) would allow inbound traffic, which is not allowed. VPC Peering (option B) and AWS VPN (option C) do not provide internet access.

Practice this question →
54
Multi-Selectmedium

A company is considering using AWS Shield Advanced to protect against DDoS attacks. Which three features are included with AWS Shield Advanced? (Choose THREE.)

Select 3 answers
A.Cost protection against DDoS-related scaling charges
B.Dedicated IP addresses for EC2 instances
C.AWS Site-to-Site VPN
D.Integration with AWS WAF for web ACLs
E.24/7 access to the AWS DDoS Response Team (DRT)
AnswersA, D, E

Shield Advanced includes cost protection.

Why this answer

AWS Shield Advanced provides cost protection against DDoS-related scaling charges, meaning if your EC2 or ELB instances scale up due to a DDoS attack, AWS will provide credits for the additional resources incurred. This is a key financial safeguard included in the Shield Advanced subscription.

Exam trap

The trap here is that candidates may confuse AWS Shield Advanced with AWS Shield Standard, or assume features like dedicated IPs or VPN are part of the DDoS protection package, when in fact they are separate services with different purposes.

Practice this question →
55
Multi-Selectmedium

A company is designing a VPC with multiple subnets. The security team wants to ensure that traffic between the application tier and database tier is encrypted in transit. Which TWO actions should be taken?

Select 2 answers
A.Attach an internet gateway to the database subnet
B.Enable encryption on the database connections using TLS/SSL
C.Use security group rules to restrict traffic to the database port
D.Configure the application to use an encrypted protocol when connecting to the database
E.Use VPC Peering to connect the subnets
AnswersB, D

TLS/SSL encrypts data between application and database.

Why this answer

The correct answers are B and D. Option B, enabling TLS/SSL for database connections, encrypts data in transit. Option D, configuring the application to use an encrypted protocol, ensures end-to-end encryption.

Options A, C, and E are incorrect: attaching an internet gateway does not encrypt traffic; security group rules restrict access but do not encrypt; and VPC peering does not provide encryption by default.

Practice this question →
56
MCQmedium

Refer to the exhibit. A security engineer is investigating a potential compromise. What is the most critical finding?

A.The root user does not have MFA enabled, as indicated by AccountMFAEnabled being 1 (true) but that means MFA is enabled? Actually, the summary shows AccountMFAEnabled: 1, which means MFA is enabled for the root account? Wait, the key is "AccountMFAEnabled" which indicates if the account (root) has MFA enabled. 1 means true. So MFA is enabled. But there are access keys present. The critical finding is that the root user has access keys.
B.The root user's console login succeeded, which indicates that the root account password is weak.
C.The root user logged in successfully from an unknown IP address.
D.The IP address 203.0.113.5 is not from the company's trusted IP range.
AnswerA

The get-account-summary shows AccountAccessKeysPresent: 2, meaning the root account has two access keys. Root access keys are a security risk and should be removed.

Why this answer

The exhibit shows that the root user has two access keys (AccountAccessKeysPresent: 2) and has MFA enabled (AccountMFAEnabled: 1). While MFA is enabled, AWS best practice strictly prohibits creating access keys for the root account because they cannot be rotated or revoked via IAM policies. The presence of root access keys is a critical security risk as they provide unrestricted access to all AWS resources.

Option A correctly identifies this as the most critical finding. Options B, C, and D are less critical because console login success alone does not indicate a weak password, and IP address anomalies can be addressed with proper monitoring.

Practice this question →
57
MCQhard

An organization has a VPC with public and private subnets. A NAT Gateway is deployed in a public subnet to allow instances in private subnets to access the internet. The security team notices that instances in a private subnet can reach the internet, but cannot initiate connections to an on-premises network connected via AWS Direct Connect. The on-premises network advertises a specific route. What is the most likely cause?

A.The security group assigned to the instances does not allow outbound traffic to the on-premises network.
B.The network ACL on the private subnet is blocking inbound traffic from the on-premises network.
C.The private subnet route table has a route for the on-premises CIDR pointing to the NAT Gateway.
D.The internet gateway is not attached to the VPC.
AnswerC

The NAT Gateway route may override the Direct Connect route.

Why this answer

The most likely cause is that the private subnet's route table has a route for the on-premises CIDR pointing to the NAT Gateway. Since the NAT Gateway is intended for internet-bound traffic, traffic destined to the on-premises network is incorrectly routed to the NAT Gateway, which cannot forward it to the on-premises network via Direct Connect. For Direct Connect, the route should point to the virtual private gateway.

Option A is incorrect because Security Groups are stateful and allow return traffic; outbound rules are not the issue. Option B is incorrect because NACLs are stateless and would affect both directions, but the problem is outbound connectivity. Option D is incorrect because the IGW is not relevant for Direct Connect traffic.

Practice this question →
58
MCQmedium

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } ] } Which step should be taken to secure the bucket while maintaining access for authorized users?

A.Use AWS Config to automatically block all public access.
B.Create an IAM role with S3 access and assign it to the bucket.
C.Add a Deny statement for any IP address outside the corporate network.
D.Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.
AnswerD

Restricts access to the VPC endpoint.

Why this answer

Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible.

Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Practice this question →
59
MCQeasy

A company wants to ensure that all Amazon EC2 instances in a VPC can only be accessed via SSH from a specific IP address range (203.0.113.0/24). Which VPC component should be used to enforce this restriction?

A.Security group
B.Route table
C.Network ACL
D.Internet gateway
AnswerC

Network ACLs are stateless and can deny traffic from IP ranges not in the allowed range.

Why this answer

A network ACL is a stateless firewall that controls inbound and outbound traffic at the subnet level. It can be configured with rules to allow SSH traffic only from the specified IP range (203.0.113.0/24) and deny all other inbound traffic, effectively enforcing the restriction. Security groups (Option A) are stateful and attached to instances, but they cannot explicitly deny traffic; they only allow.

Route tables (Option B) control traffic routing, not filtering. Internet gateways (Option D) allow internet access but do not provide traffic filtering.

Practice this question →
60
MCQeasy

A company uses Amazon CloudFront to distribute content from an S3 bucket. The security team wants to ensure that only CloudFront can access the S3 bucket. Which configuration should be used?

A.Set the bucket policy to allow all principals and rely on CloudFront to restrict access.
B.Configure the bucket policy to allow access only from CloudFront's IP addresses.
C.Create an Origin Access Identity (OAI) and grant it read access to the S3 bucket.
D.Use CloudFront trusted signers to restrict access to the S3 bucket.
AnswerC

OAI is the standard way to restrict access to CloudFront only.

Why this answer

An Origin Access Identity (OAI) is a special CloudFront user that you can associate with a distribution, and then the S3 bucket policy can grant read access to that OAI, ensuring that only CloudFront can access the bucket. Option A is incorrect because allowing all principals is too permissive. Option B is incorrect because CloudFront IP addresses can change, so this is not a reliable method.

Option D is incorrect because trusted signers are used for signed URLs/cookies to control who can access content, not to restrict origin access.

Practice this question →
61
MCQmedium

Refer to the exhibit. A security engineer applies the IAM policy to a user, and then successfully runs the CLI command. Later, the user attempts to upload an object without specifying the ACL. What will happen?

A.The upload fails because the Deny statement explicitly denies any PutObject that does not have the ACL set to bucket-owner-full-control.
B.The upload succeeds because the bucket policy allows it.
C.The upload succeeds because the Allow statement allows PutObject without condition.
D.The upload fails because the bucket policy requires ACL to be bucket-owner-full-control.
AnswerA

The Deny statement covers all PutObject actions where the ACL is not bucket-owner-full-control. If no ACL is specified, the condition matches (StringNotEquals), and the Deny takes effect.

Why this answer

The IAM policy explicitly denies PutObject when the ACL is not set to bucket-owner-full-control. Since the user does not specify an ACL, the condition 'StringNotEquals' evaluates to true, triggering the Deny.

Practice this question →
62
Multi-Selectmedium

A company wants to automate security assessments of its AWS environment. Which TWO AWS services can be used to perform vulnerability scanning and compliance checks?

Select 2 answers
A.AWS Shield
B.Amazon Inspector
C.AWS Security Hub
D.AWS WAF
E.AWS Config
AnswersB, C

Amazon Inspector scans for vulnerabilities and deviations from best practices.

Why this answer

(Amazon Inspector) is correct for vulnerability scanning. Option C (AWS Security Hub) is correct for compliance checks. Option A (AWS Shield) is for DDoS protection.

Option D (AWS WAF) is for web application firewall. Option E (AWS Config) tracks resource changes but does not perform vulnerability scanning or compliance checks.

Practice this question →
63
MCQhard

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

A.Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.
B.Inbound rule: Allow HTTP/HTTPS from the ALB's security group.
C.Outbound rule: Allow all traffic to the ALB's security group only.
D.Outbound rule: Deny all traffic to 0.0.0.0/0.
E.Outbound rule: Allow all traffic to 0.0.0.0/0.
AnswerB, D

This ensures only ALB traffic reaches the instances.

Why this answer

Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.

Exam trap

The trap here is that candidates often confuse stateful security group behavior with stateless network ACLs, mistakenly thinking that a deny-all outbound rule will block return traffic for inbound connections, or they incorrectly assume that allowing outbound traffic to the ALB's security group is sufficient to prevent internet access.

How to eliminate wrong answers

Option A is wrong because allowing HTTP/HTTPS from 0.0.0.0/0 would permit direct internet traffic to the EC2 instances, bypassing the ALB and violating the security requirement. Option C is wrong because outbound rules in security groups are stateful; allowing traffic to the ALB's security group is unnecessary and does not prevent outbound internet connections—stateful return traffic is automatically allowed, but outbound-initiated traffic to the internet would still be permitted unless explicitly denied. Option E is wrong because allowing all outbound traffic to 0.0.0.0/0 would permit instances to initiate outbound connections to the internet, directly contradicting the requirement.

Practice this question →
64
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all Amazon S3 buckets across all accounts are encrypted with AWS KMS customer managed keys (CMKs). They have implemented a service control policy (SCP) that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms. Additionally, they have an SCP that denies s3:CreateBucket unless the bucket is configured with default encryption using KMS. Despite these policies, a developer in the production account reports that they were able to upload a sensitive object to an existing bucket without encryption. The developer used the AWS CLI with the command: aws s3 cp sensitive.txt s3://my-bucket/. The bucket does not have default encryption enabled. The SCPs are attached to the root organizational unit (OU) and are in effect. What is the MOST likely reason the upload succeeded?

A.The SCP does not apply to the management account of the organization.
B.The SCP uses the wrong condition key; it should use s3:x-amz-server-side-encryption instead.
C.The SCP was not attached to the production account's OU.
D.The developer used an IAM role that bypasses SCPs.
AnswerA

SCPs are not effective for the management account, so actions from that account are not restricted.

Why this answer

The SCP denies PutObject without the encryption header, but the command did not specify the header. However, SCPs do not affect the root user? No, root user is not used here. The developer used an IAM role.

SCPs apply to all IAM principals. The issue might be that the SCP uses a condition key that is not evaluated properly? Another common issue: SCPs cannot deny actions that are performed by the AWS service itself? No. The most likely reason is that the SCP was not applied to the production account because it was attached to the root OU, but the production account might be in a different OU that does not inherit the SCP? Or the SCP might have been disabled? Or the developer might be using an IAM role that has a service-linked role? Actually, a known limitation: SCPs do not affect the management account.

If the production account is the management account, SCPs do not apply. That is a classic gotcha. The question says "multi-account AWS environment using AWS Organizations" but does not specify that the production account is the management account.

But it's plausible. Another possibility: The SCP denies s3:PutObject without the header, but the CLI command might automatically add the header if the bucket has default encryption? No, bucket does not have default encryption. The SCP should deny.

So the most likely cause is that the production account is the management account of the organization, and SCPs do not apply to the management account.

Practice this question →
65
MCQeasy

A company is designing a multi-tier web application. The web servers must be accessible from the internet, but the application servers must only be accessible from the web servers. Which AWS feature should be used to meet these requirements?

A.Use security groups with rules that allow inbound traffic to the web servers from the internet, and allow inbound traffic to the application servers only from the web server security group.
B.Use a VPC peering connection between the web tier and application tier subnets.
C.Use network ACLs to allow inbound traffic to the web tier from the internet and to the application tier only from the web tier.
D.Use a VPN connection to isolate the application tier from the web tier.
AnswerA

Security groups support referencing another security group as a source, making this straightforward.

Why this answer

Security groups are stateful and can reference other security groups as a source. By allowing inbound traffic to the web servers from the internet (0.0.0.0/0) and allowing inbound traffic to the application servers only from the web server security group, you ensure that only traffic originating from the web servers can reach the application servers. Option B is incorrect because VPC peering is for connecting separate VPCs, not for controlling traffic between tiers within the same VPC.

Option C is incorrect because network ACLs are stateless and applied at the subnet level; while they could be used, security groups provide simpler instance-level control with stateful behavior. Option D is incorrect because a VPN connection is used for hybrid connectivity, not for isolating tiers within a VPC.

Practice this question →
66
Multi-Selecthard

Which THREE components are required to set up a client VPN for remote access to a VPC? (Choose 3.)

Select 3 answers
A.Client VPN endpoint
B.Virtual Private Gateway
C.Customer Gateway
D.Authorization rule
E.Target network association
AnswersA, D, E

The VPN server component.

Why this answer

A Client VPN endpoint is required as the entry point for remote clients to connect to the VPC. It manages authentication, encryption (using TLS 1.2), and routing for client connections. Without this component, there is no VPN server to accept and authenticate client traffic.

Exam trap

The trap here is confusing the components required for a site-to-site VPN (Virtual Private Gateway and Customer Gateway) with those needed for a client-based VPN, leading candidates to incorrectly select B or C instead of the correct client VPN-specific components.

Practice this question →
67
Multi-Selecthard

Which THREE are benefits of using AWS Systems Manager Session Manager to connect to EC2 instances? (Choose THREE.)

Select 3 answers
A.It allows closing inbound SSH and RDP ports on the instance.
B.It automatically rotates SSH keys on the instance.
C.It eliminates the need for a bastion host or jump box.
D.It requires an internet gateway or NAT gateway for the instance to communicate with the Session Manager service.
E.It provides session logging to AWS CloudTrail for auditing.
AnswersA, C, E

No open ports are needed for Session Manager.

Why this answer

Session Manager eliminates the need for a bastion host or jump box (C), allows closing inbound SSH and RDP ports (A), and provides session logging to AWS CloudTrail for auditing (E). Option B is incorrect because Session Manager does not automatically rotate SSH keys; it uses IAM for access control. Option D is incorrect because Session Manager does not require an internet gateway or NAT gateway; it uses the SSM agent and AWS Systems Manager endpoints.

Practice this question →
68
MCQeasy

A company has a security group rule that allows inbound traffic from 0.0.0.0/0 on port 22. The security engineer wants to restrict SSH access to only the company's public IP range (203.0.113.0/24). What is the correct way to update the security group rule?

A.Remove the existing inbound rule and do not add any new rule; SSH access will be denied by default.
B.Modify the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.
C.Add a new inbound rule with source 203.0.113.0/24 and the security group will automatically deny all other traffic.
D.Change the outbound rules to restrict traffic.
AnswerB

You can edit the CIDR of an existing rule.

Why this answer

Security group rules can be modified in place. Changing the source CIDR from 0.0.0.0/0 to 203.0.113.0/24 restricts inbound SSH traffic to only that range. Option A is incorrect because removing the rule without adding a new one would deny all SSH access, but the goal is to restrict, not deny all.

Option C is incorrect because adding a new rule does not automatically deny other traffic; security groups evaluate all rules and allow matching traffic; you must remove the permissive rule. Option D is incorrect because outbound rules do not affect inbound SSH access.

Practice this question →
69
MCQhard

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

A.Create an Interface VPC Endpoint for S3.
B.Create a Gateway VPC Endpoint for S3 and update the route table.
C.Route the traffic through a NAT Gateway to the internet.
D.Assign a public IP address to the EC2 instance and allow it to access S3 via internet.
AnswerB

Private and secure access to S3.

Why this answer

A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.

Exam trap

The trap here is that candidates often confuse Interface VPC Endpoints (which are required for most AWS services) with Gateway VPC Endpoints (which are only for S3 and DynamoDB), leading them to choose the more expensive and complex Interface Endpoint for S3.

How to eliminate wrong answers

Option A is wrong because an Interface VPC Endpoint for S3 is not the most secure and efficient choice; it incurs hourly costs and requires additional security group management, while a Gateway Endpoint is free and simpler for S3 access. Option C is wrong because routing traffic through a NAT Gateway to the internet is less secure (traffic leaves AWS network) and less efficient (adds cost and latency) compared to a VPC Endpoint. Option D is wrong because assigning a public IP address to the EC2 instance exposes it to the internet, violating security best practices for private subnets, and requires internet gateway routing, which is neither secure nor efficient for S3 access.

Practice this question →
70
MCQeasy

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

A.Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.
B.Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.
C.Use a Network Load Balancer with TLS listeners and target groups.
D.Configure security groups to allow only HTTPS traffic.
AnswerB

This ensures traffic between ALB and instances is encrypted.

Why this answer

It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.

Exam trap

The trap here is that candidates often confuse 'encryption in transit' with 'network access control' (security groups) or assume that any load balancer with TLS listeners guarantees encryption between the load balancer and targets, but only an ALB with HTTPS target groups re-encrypts traffic to the instances, while an NLB with TLS passthrough does not re-encrypt.

How to eliminate wrong answers

Option A is wrong because TCP passthrough does not terminate TLS at the ALB; instead, it forwards raw TCP traffic to the instances, which would require the instances to handle SSL termination themselves, and the ALB cannot inspect or re-encrypt the traffic, so the data between the ALB and instances may not be encrypted if the instances are not configured correctly. Option C is wrong because a Network Load Balancer with TLS listeners and target groups encrypts traffic between clients and the NLB, but the NLB does not re-encrypt traffic to targets; it passes the original TLS session through, so the data between the NLB and EC2 instances is still encrypted, but the question specifically asks for an ALB, not an NLB, and using an NLB would not meet the requirement to use an Application Load Balancer. Option D is wrong because security groups only control network access (allow/deny traffic) and do not enforce encryption; they can allow HTTPS traffic, but they do not ensure that the data is actually encrypted in transit.

Practice this question →
71
MCQmedium

A company is using AWS CloudTrail to monitor API activity in their account. They have enabled CloudTrail in all regions and are logging to an S3 bucket. The security team wants to ensure that log files are not tampered with after delivery. They enable CloudTrail log file integrity validation. Which additional step must be taken to verify the integrity of the log files?

A.Enable S3 versioning on the log bucket.
B.Configure the S3 bucket to use server-side encryption with AWS KMS.
C.Enable S3 Object Lock on the log bucket.
D.Use the AWS CLI to run the validate-logs command against the log files.
AnswerD

This command checks the digest files to verify integrity.

Why this answer

CloudTrail log file integrity validation uses digital signatures (SHA-256 hashing and signing with a private key). To verify integrity, you must use the AWS CLI command 'aws cloudtrail validate-logs' or download the public key and verify manually. Option A (enable S3 versioning) helps protect against accidental deletion or overwriting but does not verify integrity.

Option B (use KMS to encrypt logs) protects confidentiality only. Option C (use S3 Object Lock) prevents deletion or modification but does not provide tamper detection or integrity verification.

Practice this question →
72
MCQmedium

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

A.AWS WAF
B.Network ACLs
C.Security Groups
D.AWS Shield Advanced
AnswerA

AWS WAF filters and monitors HTTP requests to protect against web exploits.

Why this answer

AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering.

AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.

Practice this question →
73
MCQeasy

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

A.Internet gateway
B.VPN connection
C.VPC peering connection
D.NAT gateway
AnswerD

A NAT gateway enables outbound internet access for private subnets.

Why this answer

(NAT gateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access.

Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.

Practice this question →
74
MCQhard

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

A.Delete the IAM role that is allowed access to the bucket.
B.Use AWS WAF to block the IP addresses of the compromised role.
C.Modify the bucket policy to deny all principals.
D.Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.
AnswerD

A deny condition with an impossible IP address blocks all access effectively.

Why this answer

Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.

Exam trap

The trap here is that candidates may think modifying the bucket policy to deny all principals (Option C) is acceptable, but the question explicitly forbids deleting the policy, and modifying it to deny all principals is a form of policy deletion; the correct approach uses a conditional deny with an impossible condition to avoid altering the original policy structure.

How to eliminate wrong answers

Option A is wrong because deleting the IAM role would permanently remove the role and its permissions, which is not reversible and may break other dependencies; the question requires blocking access without deleting the bucket or policy. Option B is wrong because AWS WAF is a web application firewall that operates at the application layer (HTTP/HTTPS) and cannot directly block S3 API requests, which use AWS Signature Version 4 and are not HTTP requests that WAF can inspect. Option C is wrong because modifying the bucket policy to deny all principals would require editing the existing policy, which the question explicitly prohibits; it also does not meet the requirement to avoid deleting the policy.

Practice this question →
75
MCQmedium

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The company has a VPC with public and private subnets. The security team wants to ensure that all traffic between on-premises and the VPC goes through a set of security appliances (firewalls) deployed in the VPC. The appliances are in separate subnets. Currently, traffic is routed directly via the virtual private gateway. What is the MOST secure and scalable way to force traffic through the security appliances?

A.Place the security appliances in a public subnet and route traffic through a NAT gateway.
B.Create a transit gateway and attach the Direct Connect virtual interface to it. Then route traffic through the appliance subnets.
C.Deploy a Gateway Load Balancer and create Gateway Load Balancer endpoints in each subnet. Update the route tables to point to the endpoints.
D.Set up a VPN connection from on-premises to the VPC and route traffic through the appliance subnets.
AnswerC

Gateway Load Balancer transparently forwards traffic to the firewall appliances and scales automatically.

Why this answer

Using a Gateway Load Balancer with Gateway Load Balancer endpoints in each subnet allows transparent traffic inspection and scaling. Option A is wrong because a NAT gateway only handles outbound traffic, not bidirectional inspection. Option B is wrong because a transit gateway does not force traffic through appliances; additional routing and appliance VPCs are needed.

Option D is wrong because a VPN connection does not inherently route through VPC appliances; it would require custom routing.

Practice this question →
Page 1 of 2 · 132 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Infrastructure Security questions.

Start 20-question session