Knowledge + Practice

CCNA Infrastructure Security Questions

74 questions · Infrastructure Security · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQmedium

A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?

A.Configure the instances' security group to allow traffic from the ALB's security group.

B.Configure the instances' security group to allow traffic from the client's source IP addresses.

C.Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.

D.Assign an IAM role to the instances that allows traffic only from the ALB.

AnswerA

This ensures only traffic that passes through the ALB can reach the instances.

Why this answer

Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.

Exam trap

The trap here is that candidates often confuse network ACLs (stateless, IP-based) with security groups (stateful, group-based) and mistakenly choose option C, not realizing that security group referencing is the correct and more secure method for this scenario.

How to eliminate wrong answers

Option B is wrong because allowing traffic from client source IP addresses would permit direct access to the EC2 instances, bypassing the ALB and defeating the purpose of restricting traffic to only the ALB. Option C is wrong because network ACLs are stateless and operate at the subnet level; they cannot reference security groups and would require manual management of ALB private IP addresses, which can change over time. Option D is wrong because IAM roles control API-level permissions for AWS services, not network traffic; they cannot filter or allow inbound traffic to EC2 instances.

Practice this question →

2

MCQmedium

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all Amazon S3 buckets created by CloudFormation are encrypted by default. Which approach should be taken?

A.Configure an IAM policy that requires all S3 operations to use encryption.

B.Set a bucket policy in the CloudFormation template that denies all actions unless encryption is enabled.

C.Enable AWS Config rule s3-bucket-server-side-encryption-enabled to enforce encryption.

D.Use a bucket policy with a condition that denies s3:PutObject if the x-amz-server-side-encryption header is not present.

AnswerD

This policy enforces encryption on object uploads.

Why this answer

A bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to the bucket must include encryption headers. This enforces server-side encryption at the object level, which is the most direct way to guarantee encryption for all objects placed into S3 buckets created by CloudFormation.

Exam trap

The trap here is that candidates often confuse bucket-level default encryption (which can be overridden by individual requests) with object-level enforcement via bucket policy conditions, leading them to choose AWS Config rules or IAM policies that do not guarantee encryption on every object upload.

How to eliminate wrong answers

Option A is wrong because an IAM policy that requires all S3 operations to use encryption applies to the IAM user or role, not to the S3 bucket itself, and does not enforce encryption on objects uploaded by other principals or services. Option B is wrong because a bucket policy that denies all actions unless encryption is enabled would block legitimate operations that do not involve encryption headers, such as listing buckets or reading metadata, and is overly broad. Option C is wrong because an AWS Config rule like s3-bucket-server-side-encryption-enabled only checks whether the bucket has default encryption configured, but does not enforce encryption on individual object uploads, which can bypass default encryption if the request specifies otherwise.

Practice this question →

3

Multi-Selecthard

A company has a VPC with a single public subnet and a single private subnet. The private subnet contains an RDS MySQL database that should not be accessible from the internet. The public subnet contains a bastion host that is used for SSH access to the database instance. The security team wants to ensure that the database can only be accessed from the bastion host. Which two security group rules should be configured? (Choose TWO.)

Select 2 answers

A.Database security group: Allow inbound MySQL from the public subnet CIDR.

B.Database security group: Allow inbound MySQL from the bastion security group.

C.Bastion security group: Allow inbound SSH from a limited corporate IP range.

D.Database security group: Allow inbound MySQL from 0.0.0.0/0.

E.Bastion security group: Allow inbound SSH from 0.0.0.0/0.

AnswersB, C

This restricts database access to the bastion.

Why this answer

Options B and C are correct. The database security group should allow inbound MySQL from the bastion security group (option B), ensuring only the bastion can access the database. The bastion security group should allow inbound SSH only from a limited corporate IP range (option C) to restrict administrative access.

Option A is incorrect because allowing inbound MySQL from the public subnet CIDR would permit any instance in that subnet, not just the bastion. Option D is incorrect as it allows MySQL from the entire internet. Option E is incorrect because it allows SSH from any IP, which is insecure.

Practice this question →

4

Multi-Selecteasy

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can download objects. Which combination of actions should the company take? (Choose TWO.)

Select 2 answers

A.Attach an Internet gateway to the VPC and route traffic through it.

B.Attach a security group to the S3 bucket.

C.Create an S3 bucket policy that allows access only from the VPC using the aws:SourceVpc condition.

D.Create a NAT gateway in the VPC for outbound traffic.

E.Create a VPC endpoint for Amazon S3 in the VPC.

AnswersC, E

This restricts access to the specified VPC.

Why this answer

To restrict access to an S3 bucket so that only traffic from a specific VPC can download objects, the correct combination is to create an S3 bucket policy that uses the aws:SourceVpc condition (Option C) and create a VPC endpoint for Amazon S3 in the VPC (Option E). The bucket policy with aws:SourceVpc ensures that only requests originating from the specified VPC are allowed, while the VPC endpoint enables private connectivity between the VPC and S3 without traversing the internet. Option A (Internet gateway) would make the VPC publicly accessible and is not required for private access.

Option B (NAT gateway) is used for outbound internet access from private subnets, not for restricting access to S3. Option D (security group) cannot be attached to an S3 bucket; security groups apply to EC2 instances or other resources, not to S3.

Practice this question →

5

MCQhard

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

A.The network ACL allows inbound SSH from 0.0.0.0/0

B.The security group rule is being overridden by a more restrictive security group attached to the same instance

C.The security group rule is being evaluated but the instance's operating system firewall is blocking SSH

D.The network ACL denies inbound SSH from all IPs except the specific IP

AnswerD

Network ACLs are stateless and can explicitly deny traffic. If the NACL denies SSH from all IPs except the specific one, it would override the permissive security group rule, explaining why only that IP can connect.

Why this answer

A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction.

Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Practice this question →

6

MCQmedium

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?

A.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}

B.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}

C.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}

D.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}

AnswerA

This condition restricts access to traffic coming through the specified VPC endpoint.

Why this answer

It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.

Exam trap

The trap here is that candidates often confuse `aws:SourceVpc` with `aws:SourceVpce` or mistakenly use IP-based conditions like `aws:SourceIp` or `aws:VpcSourceIp`, not realizing that for S3 bucket policies, the correct condition key to restrict to a specific VPC endpoint is `aws:SourceVpce`, and that `aws:SourceVpc` is not supported for S3 gateway endpoints.

How to eliminate wrong answers

Option B is wrong because `aws:VpcSourceIp` is not a valid condition key; the correct key for VPC endpoint traffic is `aws:SourceVpce` or `aws:SourceVpc`, not an IP-based condition. Option C is wrong because `aws:SourceVpc` condition key checks the VPC ID of the requester, but this only works for VPC endpoints that support the `aws:SourceVpc` key (e.g., some AWS services), and for S3 gateway endpoints, the `aws:SourceVpc` key is not available; instead, `aws:SourceVpce` must be used to restrict to a specific endpoint. Option D is wrong because `aws:SourceIp` condition key cannot be used to restrict traffic from a VPC endpoint, as the source IP of requests through a VPC endpoint is the private IP of the endpoint's network interface, which is not reliably the same as the VPC's CIDR range, and the condition key `aws:SourceIp` is intended for public IP addresses, not private IPs from VPC endpoints.

Practice this question →

7

MCQmedium

Refer to the exhibit. A security engineer is investigating a potential unauthorized VPC creation. What does the evidence suggest?

A.The user admin created two VPCs, but one was deleted shortly after creation.

B.The CloudTrail log is incomplete; both VPCs exist.

C.Both VPCs were created successfully and still exist.

D.The user admin only created one VPC; the second event is a duplicate.

AnswerA

Correct. The non-existent VPC suggests deletion.

Why this answer

The CloudTrail log shows two CreateVpc events by user admin. One VPC exists (vpc-12345678), but the other (vpc-87654321) does not exist, indicating that it was deleted after creation. This could indicate malicious activity where a VPC was created and then deleted to cover tracks.

Practice this question →

8

MCQmedium

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

A.The EC2 instances in this security group cannot initiate outbound connections

B.The EC2 instances cannot receive inbound HTTP traffic

C.The security group allows all outbound traffic by default

D.Outbound traffic is allowed because security groups are stateful

AnswerA

Without outbound rules, all outbound traffic is denied.

Why this answer

A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing.

Option D is wrong because the security group does allow inbound HTTP.

Practice this question →

9

Multi-Selectmedium

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Select 2 answers

A.Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.

B.Disable automated backups to reduce storage costs.

C.Enable Multi-AZ deployment for fault tolerance.

D.Assign a public IP address to the RDS instance for easier access from the internet.

E.Enable encryption at rest using AWS KMS.

AnswersA, E

Network isolation improves security.

Why this answer

Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.

Exam trap

The trap here is that candidates often confuse high availability (Multi-AZ) or cost-saving measures (disabling backups) with security controls, when in fact they do not address confidentiality, integrity, or access control.

Practice this question →

10

MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

A.Use an HTTPS listener on the ALB and configure the target group with HTTPS.

B.Use a TCP listener on the ALB and a TCP target group.

C.Configure security group inbound rules to allow only HTTPS traffic.

D.Use an HTTP listener on the ALB and HTTP on the target group.

AnswerA

HTTPS ensures encryption from ALB to instances.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates assume an HTTPS listener alone encrypts all traffic end-to-end, forgetting that the ALB-to-instance leg must also use HTTPS; otherwise, traffic between the ALB and EC2 instances is in plaintext.

How to eliminate wrong answers

Option B is wrong because a TCP listener and TCP target group operate at Layer 4 and do not provide encryption; they forward raw TCP traffic without TLS/SSL termination or re-encryption. Option C is wrong because security group inbound rules only control access at the network level (allowing or denying traffic based on port/protocol) and do not encrypt traffic; encryption is a function of the protocol (HTTPS/TLS), not security group rules. Option D is wrong because using HTTP on both the listener and target group means traffic is transmitted in plaintext at every hop, with no encryption between the ALB and EC2 instances.

Practice this question →

11

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

A.The network ACL for the private subnet is blocking outbound traffic

B.The NAT Gateway's security group is blocking outbound traffic to the internet

C.The private subnet route table does not have a route to the NAT Gateway

D.The security group attached to the EC2 instance is blocking inbound traffic

AnswerB

NAT Gateway's security group must allow outbound HTTPS to 0.0.0.0/0.

Why this answer

The NAT Gateway's security group must allow outbound traffic to the internet for the patches to be retrieved. Even though the NAT Gateway allows inbound HTTPS from the private subnet, it also needs an outbound rule permitting HTTPS traffic to 0.0.0.0/0 so that response packets from the internet can flow back through the NAT Gateway to the instance. Without this outbound rule, the NAT Gateway drops the return traffic, preventing the download.

Exam trap

The trap here is that candidates assume the NAT Gateway only needs inbound rules from the private subnet, forgetting that outbound rules are required for return traffic, or they mistakenly think NAT Gateways cannot have security groups at all.

How to eliminate wrong answers

Option A is wrong because the network ACL for the private subnet is not mentioned as blocking traffic; by default, network ACLs allow all inbound and outbound traffic, and the question does not indicate any custom ACL rules that would block outbound HTTPS. Option C is wrong because the private subnet route table already has a default route (0.0.0.0/0) pointing to the NAT Gateway, so routing to the NAT Gateway is correctly configured. Option D is wrong because the security group attached to the EC2 instance allows outbound HTTPS to 0.0.0.0/0, which is sufficient for the instance to initiate the connection; inbound traffic is not relevant for outbound patch downloads.

Practice this question →

12

Multi-Selectmedium

A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)

Select 2 answers

A.Configure a NAT gateway in the private subnet for the application servers.

B.Place the web servers in a public subnet with a route to an internet gateway.

C.Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.

D.Place the application servers in a public subnet with a route to an internet gateway.

E.Configure the application servers' security group to allow traffic only from the web servers' security group.

AnswersB, E

This allows internet traffic to reach the web servers.

Why this answer

Placing web servers in a public subnet with a route to an internet gateway allows them to receive inbound traffic from the internet. This is the standard AWS design for internet-facing resources, where the subnet's route table directs 0.0.0.0/0 traffic to an internet gateway, enabling direct communication from the internet.

Exam trap

The trap here is that candidates often confuse network ACLs with security groups, incorrectly assuming that a stateless network ACL with IP-based rules is the correct way to restrict traffic between tiers, when in fact security group references provide a more secure and manageable solution.

Practice this question →

13

MCQhard

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

A.Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.

B.Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.

C.Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.

D.Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.

AnswerD

This encrypts both frontend and backend traffic.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates often assume HTTPS on the listener alone is sufficient, overlooking that the target group protocol must also be HTTPS to encrypt traffic between the ALB and instances, not just between clients and the ALB.

How to eliminate wrong answers

Option A is wrong because using HTTP on both the listener and target group means traffic is in plaintext, violating the encryption requirement. Option B is wrong because while the listener uses HTTPS, the target group uses HTTP, so traffic between the ALB and EC2 instances is unencrypted, which does not meet the requirement. Option C is wrong because TCP protocol at the listener and target group does not provide application-layer encryption; SSL certificates on EC2 instances alone do not encrypt traffic without HTTPS configuration on the target group.

Practice this question →

14

Multi-Selecthard

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Select 2 answers

A.Deploy an HTTP forward proxy in the public subnet.

B.Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.

C.Set up a transit gateway and attach the VPC to it.

D.Create a gateway endpoint for Amazon S3.

E.Place the NAT device in a public subnet with a route to an internet gateway.

AnswersB, E

This routes outbound traffic from private subnets to the NAT device.

Why this answer

To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose.

Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.

Practice this question →

15

Multi-Selectmedium

Which TWO actions can be taken to protect an S3 bucket from accidental public access? (Choose 2.)

Select 2 answers

A.Enable S3 Block Public Access at the account level

B.Use a bucket policy that denies s3:PutBucketPolicy unless the request comes from a specific VPC

C.Enable default encryption for the bucket

D.Enable MFA Delete on the bucket

E.Use an IAM policy that requires MFA for all S3 actions

AnswersA, B

Blocks all public access to S3 buckets.

Why this answer

Options A and B are correct. Enabling S3 Block Public Access at the account level (option A) prevents any public access to all buckets. Using a bucket policy with a condition that denies s3:PutBucketPolicy unless the request comes from a specific VPC (option B) ensures that only authorized VPCs can modify the bucket policy, preventing accidental public exposure.

Option C is wrong because default encryption does not affect public access. Option D is wrong because MFA Delete protects against accidental deletion, not public access. Option E is wrong because requiring MFA for S3 actions does not prevent public access.

Practice this question →

16

MCQhard

Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?

A.The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.

B.The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.

C.The security group allows outbound all traffic, which violates the principle of least privilege.

D.The instance type t2.micro is not available in the specified subnet's Availability Zone.

AnswerA

Incorrect. SCPs cannot deny actions based on the content of security group rules (e.g., permissiveness). They can only deny based on resource identifiers like security group IDs.

Why this answer

The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive.

The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.

Exam trap

Candidates often assume 'UnauthorizedOperation' always indicates missing IAM permissions, but SCPs can cause this error even when the user has explicit Allow, due to an explicit deny on specific resources or conditions.

How to eliminate wrong answers

Option B is wrong because allowing inbound HTTPS from RFC 1918 address space (private IPs) is not inherently problematic and would not trigger an 'UnauthorizedOperation' error; the error is about authorization, not subnet placement. Option C is wrong because outbound all traffic is a default security group setting and does not violate the principle of least privilege in a way that would cause an 'UnauthorizedOperation' error; SCPs typically focus on inbound rules for overly permissive access. Option D is wrong because t2.micro is a standard instance type available in most Availability Zones; if it were unavailable, the error would be 'InsufficientInstanceCapacity' or 'InvalidParameterValue', not 'UnauthorizedOperation'.

Practice this question →

17

Multi-Selectmedium

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Select 2 answers

A.Create a bastion host in the public subnet and configure the web server to use it as a proxy.

B.Create a VPC endpoint for Amazon S3.

C.Create a NAT Gateway in the public subnet.

D.Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

E.Add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway.

AnswersC, E

NAT Gateway enables outbound internet access for instances in private subnets.

Why this answer

A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with a bastion host or assume that a VPC endpoint for S3 can provide general internet access, but the key distinction is that a NAT Gateway enables outbound internet connectivity for private subnets without exposing them to inbound traffic.

Practice this question →

18

MCQmedium

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?

A.AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.

B.AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.

C.The regex pattern for the token is too complex for AWS WAF to process.

D.There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.

AnswerD

Rules are evaluated in priority order; a higher priority allow rule would override the block rule.

Why this answer

AWS WAF evaluates rules in order, and if a rule with a higher priority allows the request, it will not be blocked by a lower priority rule. The team may have an allow rule with higher priority that allows all requests. Option A is incorrect because WAF can inspect headers.

Option B is incorrect because WAF can be used with ALB. Option C is incorrect because WAF can handle regex.

Practice this question →

19

Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Select 3 answers

A.AWS WAF attached to the NAT gateway.

B.An internet gateway attached to the VPC.

C.Route tables in the private subnets with a default route (0.0.0.0/0) pointing to the NAT gateway.

D.A VPC gateway endpoint for S3.

E.A NAT gateway in a public subnet.

AnswersB, C, E

The internet gateway provides internet access for the public subnet where the NAT gateway resides.

Why this answer

An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.

Exam trap

The trap here is that candidates often think a NAT gateway alone provides internet access, forgetting that the NAT gateway must be placed in a public subnet with a route to an internet gateway, and that the private subnet’s default route must point to the NAT gateway, not the IGW.

Practice this question →

20

MCQhard

A company uses AWS Organizations to manage multiple accounts. The security team must enforce that all Amazon S3 buckets across all accounts are encrypted with AWS KMS. The team has enabled S3 default encryption for new buckets, but existing buckets may not be encrypted. They need to automatically remediate any non-compliant buckets. The team has AWS Config and AWS Lambda available. What is the MOST operationally efficient solution?

A.Manually review all buckets using the S3 console and enable encryption for those that are not encrypted.

B.Write a script that runs daily on an EC2 instance to list all buckets and enable encryption on any that are not encrypted.

C.Use AWS Config with the s3-bucket-server-side-encryption-enabled rule and configure an AWS Systems Manager Automation document to remediate non-compliant buckets.

D.Use AWS Trusted Advisor to check for unencrypted buckets and send an SNS notification to the security team to manually remediate.

AnswerC

Correct: Config detects non-compliance and SSM Automation remediates automatically.

Why this answer

Use AWS Config with the s3-bucket-server-side-encryption-enabled rule to detect non-compliant S3 buckets. Then configure an automatic remediation action using an AWS Systems Manager Automation document to enable encryption on those buckets. This approach is serverless, automated, and operationally efficient as it does not require manual intervention or separate compute resources.

Practice this question →

21

MCQmedium

A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?

A.Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.

B.Use a single security group for all instances and use IAM policies to restrict access.

C.Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.

D.Place all instances in public subnets and restrict access using security groups.

AnswerA

Security group references provide granular control.

Why this answer

Security groups can reference other security groups as sources in inbound rules, allowing granular traffic control between tiers without CIDR blocks. This approach allows the web tier security group to allow inbound from the internet, the app tier security group to allow inbound only from the web tier security group, and the database tier security group to allow inbound only from the app tier security group. Option B is incorrect because IAM policies control user permissions, not network traffic.

Option C is incorrect because network ACLs with CIDR blocks are less specific and do not scale well, and placing tiers in separate subnets is not necessary. Option D is incorrect because placing all instances in public subnets unnecessarily exposes them to the internet, increasing security risk.

Practice this question →

22

Multi-Selectmedium

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Select 3 answers

A.VPN connection

B.Internet gateway

C.Security groups

D.Network ACLs

E.VPC Flow Logs

AnswersC, D, E

Instance-level firewall.

Why this answer

Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Exam trap

The trap here is that candidates often confuse connectivity components (VPN, Internet gateway) with security controls, or they overlook that VPC Flow Logs are a detective control (not preventive) but still a valid part of defense in depth, leading them to select A or B instead of the correct trio of security groups, network ACLs, and VPC Flow Logs.

Practice this question →

23

MCQmedium

A company has an AWS Direct Connect connection to its on-premises data center. The security team wants to ensure that traffic between the VPC and the data center is encrypted. Which solution should they use?

A.Set up an IPsec VPN connection over the Direct Connect virtual interface.

B.Enable encryption on the Direct Connect virtual interface.

C.Use AWS Site-to-Site VPN over the internet.

D.Use VPC Peering to connect the VPC to the data center.

AnswerA

This encrypts traffic between on-premises and AWS.

Why this answer

AWS Direct Connect does not encrypt traffic by default. To encrypt, you can use an IPsec VPN over the Direct Connect virtual interface (option A). Option B is incorrect because Direct Connect does not support native encryption on the virtual interface; encryption must be added via IPsec or application-level encryption.

Option C is not optimal because the requirement specifies using the existing Direct Connect connection, not internet-based VPN. Option D is incorrect because VPC Peering connects VPCs within AWS, not an on-premises data center, and does not provide encryption.

Practice this question →

24

MCQhard

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

A.Success, because the Allow statement is evaluated first.

B.Failure, because the user's IP is not in the allowed range.

C.Success, because the user's IP is within the allowed range.

D.Failure, because the Deny statement blocks HTTP requests.

AnswerD

Correct. The Deny for non-SecureTransport blocks the request.

Why this answer

The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Practice this question →

25

Multi-Selecthard

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Select 2 answers

A.Use AWS KMS to encrypt the traffic.

B.Use AWS Certificate Manager to issue certificates for the connection.

C.Enable MACsec on the Direct Connect connection.

D.Use SSL/TLS to encrypt the traffic between on-premises and AWS.

E.Establish an IPsec VPN tunnel over the Direct Connect connection.

AnswersC, E

MACsec provides encryption at the data link layer.

Why this answer

MACsec (IEEE 802.1AE) provides encryption at Layer 2 (data link layer) and can be enabled directly on a Direct Connect connection. This encrypts all traffic between the on-premises router and the AWS Direct Connect endpoint without requiring any changes to higher-layer protocols, making it transparent to applications.

Exam trap

The trap here is that candidates often assume encryption must happen at higher layers (like SSL/TLS) or through a separate service (like KMS), but the exam tests knowledge of Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec over Direct Connect) as the two valid methods to encrypt traffic over a Direct Connect connection.

Practice this question →

26

Multi-Selecthard

A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)

Select 3 answers

A.Take a snapshot of the unencrypted instance, copy it with encryption, and restore.

B.Modify the DB instance to enable encryption after creation.

C.Create a read replica with encryption enabled, even if the source is unencrypted.

D.Enable encryption on an existing read replica of an encrypted source.

E.Enable encryption when creating the DB instance.

AnswersA, D, E

This is a valid method to encrypt an existing database.

Why this answer

You can take a snapshot of an unencrypted Amazon RDS for MySQL DB instance, create an encrypted copy of that snapshot, and then restore a new DB instance from the encrypted snapshot. This process effectively encrypts the data at rest, as the restored instance will inherit the encryption setting from the snapshot. AWS RDS does not allow enabling encryption on an existing unencrypted DB instance directly, so this snapshot-based approach is the standard workaround.

Exam trap

The trap here is that candidates assume you can enable encryption on an existing RDS instance via a simple modification (Option B), but AWS explicitly prohibits this, requiring a snapshot-based migration instead.

Practice this question →

27

Multi-Selecthard

A security engineer is configuring an AWS WAF web ACL for an Application Load Balancer. The engineer wants to block requests that contain cross-site scripting (XSS) and also limit the rate of requests from a single IP. Which THREE rule groups should be added?

Select 3 answers

A.AWS Managed Rules - IP reputation rule group

B.Rate-based rule

C.AWS Managed Rules - SQL injection rule group

D.AWS Managed Rules - Cross-site scripting (XSS) rule group

E.Geographic match rule

AnswersB, C, D

Rate-based rules limit the number of requests from an IP over a time period.

Why this answer

Options B, C, and D are correct. A Rate-based rule (B) limits the rate of requests from a single IP, meeting the rate-limiting requirement. The AWS Managed Rules for SQL injection (C) and Cross-site scripting (D) directly address the XSS and SQL injection threats.

Option A (IP reputation) blocks based on known malicious IPs, not rate or XSS. Option E (Geographic match) restricts by location, not behavior.

Practice this question →

28

Multi-Selectmedium

A company is designing a VPC with multiple subnets. The security team wants to ensure that traffic between the application tier and database tier is encrypted in transit. Which TWO actions should be taken?

Select 2 answers

A.Attach an internet gateway to the database subnet

B.Enable encryption on the database connections using TLS/SSL

C.Use security group rules to restrict traffic to the database port

D.Configure the application to use an encrypted protocol when connecting to the database

E.Use VPC Peering to connect the subnets

AnswersB, D

TLS/SSL encrypts data between application and database.

Why this answer

The correct answers are B and D. Option B, enabling TLS/SSL for database connections, encrypts data in transit. Option D, configuring the application to use an encrypted protocol, ensures end-to-end encryption.

Options A, C, and E are incorrect: attaching an internet gateway does not encrypt traffic; security group rules restrict access but do not encrypt; and VPC peering does not provide encryption by default.

Practice this question →

29

MCQmedium

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } ] } Which step should be taken to secure the bucket while maintaining access for authorized users?

A.Use AWS Config to automatically block all public access.

B.Create an IAM role with S3 access and assign it to the bucket.

C.Add a Deny statement for any IP address outside the corporate network.

D.Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.

AnswerD

Restricts access to the VPC endpoint.

Why this answer

Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible.

Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Practice this question →

30

Multi-Selectmedium

A company wants to automate security assessments of its AWS environment. Which TWO AWS services can be used to perform vulnerability scanning and compliance checks?

Select 2 answers

A.AWS Shield

B.Amazon Inspector

C.AWS Security Hub

D.AWS WAF

E.AWS Config

AnswersB, C

Amazon Inspector scans for vulnerabilities and deviations from best practices.

Why this answer

(Amazon Inspector) is correct for vulnerability scanning. Option C (AWS Security Hub) is correct for compliance checks. Option A (AWS Shield) is for DDoS protection.

Option D (AWS WAF) is for web application firewall. Option E (AWS Config) tracks resource changes but does not perform vulnerability scanning or compliance checks.

Practice this question →

31

MCQhard

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

A.Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.

B.Inbound rule: Allow HTTP/HTTPS from the ALB's security group.

C.Outbound rule: Allow all traffic to the ALB's security group only.

D.Outbound rule: Deny all traffic to 0.0.0.0/0.

E.Outbound rule: Allow all traffic to 0.0.0.0/0.

AnswerB, D

This ensures only ALB traffic reaches the instances.

Why this answer

Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.

Exam trap

The trap here is that candidates often confuse stateful security group behavior with stateless network ACLs, mistakenly thinking that a deny-all outbound rule will block return traffic for inbound connections, or they incorrectly assume that allowing outbound traffic to the ALB's security group is sufficient to prevent internet access.

How to eliminate wrong answers

Option A is wrong because allowing HTTP/HTTPS from 0.0.0.0/0 would permit direct internet traffic to the EC2 instances, bypassing the ALB and violating the security requirement. Option C is wrong because outbound rules in security groups are stateful; allowing traffic to the ALB's security group is unnecessary and does not prevent outbound internet connections—stateful return traffic is automatically allowed, but outbound-initiated traffic to the internet would still be permitted unless explicitly denied. Option E is wrong because allowing all outbound traffic to 0.0.0.0/0 would permit instances to initiate outbound connections to the internet, directly contradicting the requirement.

Practice this question →

32

Multi-Selecthard

Which THREE are benefits of using AWS Systems Manager Session Manager to connect to EC2 instances? (Choose THREE.)

Select 3 answers

A.It allows closing inbound SSH and RDP ports on the instance.

B.It automatically rotates SSH keys on the instance.

C.It eliminates the need for a bastion host or jump box.

D.It requires an internet gateway or NAT gateway for the instance to communicate with the Session Manager service.

E.It provides session logging to AWS CloudTrail for auditing.

AnswersA, C, E

No open ports are needed for Session Manager.

Why this answer

Session Manager eliminates the need for a bastion host or jump box (C), allows closing inbound SSH and RDP ports (A), and provides session logging to AWS CloudTrail for auditing (E). Option B is incorrect because Session Manager does not automatically rotate SSH keys; it uses IAM for access control. Option D is incorrect because Session Manager does not require an internet gateway or NAT gateway; it uses the SSM agent and AWS Systems Manager endpoints.

Practice this question →

33

MCQhard

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

A.Create an Interface VPC Endpoint for S3.

B.Create a Gateway VPC Endpoint for S3 and update the route table.

C.Route the traffic through a NAT Gateway to the internet.

D.Assign a public IP address to the EC2 instance and allow it to access S3 via internet.

AnswerB

Private and secure access to S3.

Why this answer

A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.

Exam trap

The trap here is that candidates often confuse Interface VPC Endpoints (which are required for most AWS services) with Gateway VPC Endpoints (which are only for S3 and DynamoDB), leading them to choose the more expensive and complex Interface Endpoint for S3.

How to eliminate wrong answers

Option A is wrong because an Interface VPC Endpoint for S3 is not the most secure and efficient choice; it incurs hourly costs and requires additional security group management, while a Gateway Endpoint is free and simpler for S3 access. Option C is wrong because routing traffic through a NAT Gateway to the internet is less secure (traffic leaves AWS network) and less efficient (adds cost and latency) compared to a VPC Endpoint. Option D is wrong because assigning a public IP address to the EC2 instance exposes it to the internet, violating security best practices for private subnets, and requires internet gateway routing, which is neither secure nor efficient for S3 access.

Practice this question →

34

MCQeasy

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

A.Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

B.Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.

C.Use a Network Load Balancer with TLS listeners and target groups.

D.Configure security groups to allow only HTTPS traffic.

AnswerB

This ensures traffic between ALB and instances is encrypted.

Why this answer

It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.

Exam trap

The trap here is that candidates often confuse 'encryption in transit' with 'network access control' (security groups) or assume that any load balancer with TLS listeners guarantees encryption between the load balancer and targets, but only an ALB with HTTPS target groups re-encrypts traffic to the instances, while an NLB with TLS passthrough does not re-encrypt.

How to eliminate wrong answers

Option A is wrong because TCP passthrough does not terminate TLS at the ALB; instead, it forwards raw TCP traffic to the instances, which would require the instances to handle SSL termination themselves, and the ALB cannot inspect or re-encrypt the traffic, so the data between the ALB and instances may not be encrypted if the instances are not configured correctly. Option C is wrong because a Network Load Balancer with TLS listeners and target groups encrypts traffic between clients and the NLB, but the NLB does not re-encrypt traffic to targets; it passes the original TLS session through, so the data between the NLB and EC2 instances is still encrypted, but the question specifically asks for an ALB, not an NLB, and using an NLB would not meet the requirement to use an Application Load Balancer. Option D is wrong because security groups only control network access (allow/deny traffic) and do not enforce encryption; they can allow HTTPS traffic, but they do not ensure that the data is actually encrypted in transit.

Practice this question →

35

MCQmedium

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

A.AWS WAF

B.Network ACLs

C.Security Groups

D.AWS Shield Advanced

AnswerA

AWS WAF filters and monitors HTTP requests to protect against web exploits.

Why this answer

AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering.

AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.

Practice this question →

36

MCQeasy

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

A.Internet gateway

B.VPN connection

C.VPC peering connection

D.NAT gateway

AnswerD

A NAT gateway enables outbound internet access for private subnets.

Why this answer

(NAT gateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access.

Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.

Practice this question →

37

MCQhard

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

A.Delete the IAM role that is allowed access to the bucket.

B.Use AWS WAF to block the IP addresses of the compromised role.

C.Modify the bucket policy to deny all principals.

D.Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.

AnswerD

A deny condition with an impossible IP address blocks all access effectively.

Why this answer

Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.

Exam trap

The trap here is that candidates may think modifying the bucket policy to deny all principals (Option C) is acceptable, but the question explicitly forbids deleting the policy, and modifying it to deny all principals is a form of policy deletion; the correct approach uses a conditional deny with an impossible condition to avoid altering the original policy structure.

How to eliminate wrong answers

Option A is wrong because deleting the IAM role would permanently remove the role and its permissions, which is not reversible and may break other dependencies; the question requires blocking access without deleting the bucket or policy. Option B is wrong because AWS WAF is a web application firewall that operates at the application layer (HTTP/HTTPS) and cannot directly block S3 API requests, which use AWS Signature Version 4 and are not HTTP requests that WAF can inspect. Option C is wrong because modifying the bucket policy to deny all principals would require editing the existing policy, which the question explicitly prohibits; it also does not meet the requirement to avoid deleting the policy.

Practice this question →

38

Multi-Selectmedium

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)

Select 2 answers

A.Amazon GuardDuty

B.AWS Shield Advanced

C.Network ACLs

D.AWS WAF

E.Amazon CloudFront

AnswersB, D

Shield Advanced provides advanced DDoS protection and integrates with WAF.

Why this answer

AWS WAF (Option D) can be associated with an ALB to filter web requests and protect against common exploits like SQL injection and cross-site scripting. AWS Shield Advanced (Option B) provides enhanced DDoS protection and integrates with WAF for additional layer 7 protections. Option A is wrong because GuardDuty is a threat detection service, not an inline web application firewall.

Option C is wrong because Network ACLs operate at the subnet level and do not provide application-layer filtering. Option E is wrong because CloudFront is a CDN, and while it can be used with WAF, it alone does not provide WAF rules.

Practice this question →

39

MCQeasy

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?

A.AWS Key Management Service (KMS)

B.Amazon S3 server-side encryption

C.RDS encryption feature

D.SSL/TLS certificates

AnswerA

KMS provides encryption keys for RDS encryption.

Why this answer

AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.

Exam trap

The trap here is that candidates confuse the RDS encryption feature (which is a checkbox in the console) with a standalone service, when in fact the underlying service that performs the encryption and key management is AWS KMS.

How to eliminate wrong answers

Option B is wrong because Amazon S3 server-side encryption is a feature specific to objects stored in Amazon S3 buckets, not applicable to RDS DB instance storage. Option C is wrong because 'RDS encryption feature' is not a standalone service; it is a feature that relies on AWS KMS to manage the encryption keys — the question asks which service or feature should be used, and KMS is the underlying service that enables RDS encryption. Option D is wrong because SSL/TLS certificates are used to encrypt data in transit between the client and the database, not data at rest stored on disk.

Practice this question →

40

MCQeasy

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

A.Create an Origin Access Control (OAC) for the S3 bucket origin

B.Create a Route 53 health check to verify CloudFront availability

C.Configure CloudFront signed URLs to restrict access

D.Attach a security group to the S3 bucket

AnswerA

OAC ensures only CloudFront can access the S3 bucket.

Why this answer

An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.

Exam trap

The trap here is that candidates often confuse CloudFront signed URLs (which control user access to content) with origin access controls (which restrict which origin server CloudFront can talk to), leading them to pick option C instead of A.

How to eliminate wrong answers

Option B is wrong because a Route 53 health check verifies the availability of a resource (e.g., CloudFront) for DNS failover, but it does not enforce access restrictions or prevent direct access to the S3 bucket. Option C is wrong because CloudFront signed URLs control access to individual objects by requiring authentication tokens, but they do not prevent users from accessing the S3 bucket directly if the bucket is publicly accessible; signed URLs are for per-request authorization, not origin access control. Option D is wrong because S3 buckets do not support security groups; security groups are a network firewall construct for EC2 instances and other VPC resources, not for S3.

Access to S3 is controlled via bucket policies, IAM policies, or OAC.

Practice this question →

41

MCQmedium

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

A.Allow inbound database port from the security group attached to the application instances in the public subnet.

B.Allow inbound database port from 0.0.0.0/0 in the database security group.

C.Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.

D.Allow inbound database port from the public subnet CIDR block in the database security group.

AnswerA

This dynamically allows traffic from all application instances.

Why this answer

Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet.

Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.

Practice this question →

42

Multi-Selectmedium

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Select 3 answers

A.Use S3 Inventory to list objects and their tags.

B.Enable S3 object-level logging in CloudTrail.

C.Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.

D.Create a bucket policy with a condition based on the s3:ExistingObjectTag key.

E.Set a bucket policy that denies access if the object does not have the required tag.

AnswersC, D, E

IAM policies can also use condition keys to restrict access based on tags.

Why this answer

To restrict the IAM role to only access objects with specific tags, three steps are necessary. First, attach an IAM policy to the role using the s3:ExistingObjectTag condition key (option C). This alone, however, can be overridden by a bucket policy that grants broader access.

Second, create a bucket policy that explicitly allows the role to access objects only when they have the required tag (option D). Third, create a bucket policy that denies the role access to objects that do not have the required tag (option E). The combination of IAM and bucket policies ensures tag-based access control is enforced, as IAM provides identity-based restrictions and bucket policies add resource-based checks, including an explicit deny for non-compliant objects.

Exam trap

The trap here is that candidates often confuse S3 Inventory (a reporting tool) or CloudTrail logging (an auditing tool) with access control mechanisms, leading them to select options that do not actually restrict access.

Practice this question →

43

Multi-Selectmedium

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Select 2 answers

A.Amazon GuardDuty

B.AWS WAF

C.Security Groups

D.AWS Shield Advanced

E.Network ACLs

AnswersB, C

WAF provides application-layer protection.

Why this answer

AWS WAF is correct because it provides application-layer protection by inspecting HTTP/HTTPS requests to your web application, allowing you to block common attack patterns such as SQL injection and cross-site scripting (XSS) using customizable rules. Security Groups are correct because they act as a virtual firewall at the instance level (network layer), controlling inbound and outbound traffic based on IP addresses, ports, and protocols, thus forming the first line of defense in a defense-in-depth strategy.

Exam trap

The trap here is that candidates often confuse AWS Shield Advanced (which provides DDoS protection) with application-layer filtering, or assume Network ACLs can inspect application data, when in fact they operate only at the network layer and are stateless.

Practice this question →

44

Multi-Selecthard

A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?

Select 2 answers

A.Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.

B.Create a resource-based policy on the RDS instance.

C.Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.

D.Create a security group rule that references the EC2 instance's security group.

E.Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'.

AnswersA, E

Combines with endpoint policy.

Why this answer

To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect.

Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances.

Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.

Practice this question →

45

Multi-Selectmedium

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation are encrypted at rest. Which THREE configuration steps should be taken?

Select 3 answers

A.Create an AWS Config rule to check for unencrypted S3 buckets.

B.Use a CloudFormation stack policy to prevent updates that remove encryption.

C.Create a service control policy (SCP) that denies creation of S3 buckets without encryption.

D.In the CloudFormation template, specify the BucketEncryption property for each S3 bucket.

E.Create an IAM role that only allows creation of encrypted buckets.

AnswersA, C, D

Detects non-compliance.

Why this answer

Options A, C, and D are correct. AWS Config rules can detect unencrypted S3 buckets and trigger remediation. Service control policies (SCPs) can deny the creation of S3 buckets without encryption at the organizational level.

In CloudFormation templates, specifying the BucketEncryption property ensures encryption is configured at deployment time. Option B is incorrect because a CloudFormation stack policy only prevents updates to existing stacks but does not enforce encryption during initial creation. Option E is incorrect because an IAM role can restrict permissions but does not enforce encryption directly on S3 buckets created by CloudFormation.

Practice this question →

46

MCQmedium

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

A.Allow inbound HTTP traffic from the EC2 instances' own security group

B.Allow inbound HTTP traffic from 0.0.0.0/0

C.Allow inbound HTTP traffic from the VPC CIDR block

D.Allow inbound HTTP traffic from the ALB's security group

AnswerD

This ensures only the ALB can initiate traffic to the EC2 instances.

Why this answer

Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.

Exam trap

The trap here is that candidates often confuse security group referencing with CIDR-based rules, mistakenly thinking that allowing the VPC CIDR (Option C) is sufficient, but this would allow any resource in the VPC, not just the ALB, to reach the EC2 instances.

How to eliminate wrong answers

Option A is wrong because allowing inbound HTTP traffic from the EC2 instances' own security group would permit traffic between the EC2 instances themselves, not from the ALB, and does not restrict access to the ALB only. Option B is wrong because allowing inbound HTTP traffic from 0.0.0.0/0 would permit traffic from any IP address on the internet, completely bypassing the ALB and exposing the EC2 instances directly. Option C is wrong because allowing inbound HTTP traffic from the VPC CIDR block would permit traffic from any resource within the VPC (including other EC2 instances, NAT gateways, or VPN connections), not exclusively from the ALB.

Practice this question →

47

MCQhard

A company is running a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application serves traffic on port 443. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic from the ALB security group on port 8080. The application works correctly. However, the security team wants to add an additional layer of defense by implementing a web application firewall (WAF) to block common web exploits. The team also wants to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) can access the application for administrative purposes on a separate path. The team has enabled AWS WAF on the ALB and associated a web ACL. They have also created a rule to allow traffic from the corporate IP range and block all other traffic. After deploying these changes, external users (not from corporate IP) cannot access the application at all. The company wants external users to be able to access the main application, but only corporate IPs should access the admin path. What should the security engineer do to fix the issue?

A.Configure the security group of the ALB to allow only corporate IPs.

B.Create two separate ALBs, one for admin traffic and one for main traffic.

C.Remove the WAF rule that blocks all non-corporate traffic and rely on security groups.

D.Modify the WAF rule to allow traffic from the corporate IP range on the admin path and allow all traffic on the main application path.

AnswerD

This allows external users on main path and restricts admin path.

Why this answer

The correct action is to modify the WAF rule to allow traffic from corporate IPs on the admin path and allow all other traffic on the main application path. Currently, the WAF rule blocks all non-corporate traffic, which prevents external users from accessing the main application. By creating separate conditions for the admin path (corporate IPs only) and the main path (allow all), the security team can achieve the desired access control.

Option A is incorrect because it would block external users at the security group level. Option B is unnecessary and adds complexity. Option C removes the WAF protection entirely.

Therefore, option D is the correct solution.

Practice this question →

48

MCQeasy

A company is designing a security group for a web application that must receive HTTPS traffic from the internet and send traffic to a backend database. The backend database is an Amazon RDS MySQL instance. What is the best practice for configuring the security groups?

A.Web server SG: inbound HTTPS from 0.0.0.0/0. Database SG: inbound MySQL from web server SG.

B.Web server SG: inbound HTTPS from 0.0.0.0/0, outbound to database SG on port 3306. Database SG: inbound MySQL from web server CIDR block.

C.Web server SG: inbound HTTPS from 0.0.0.0/0, outbound all traffic. Database SG: inbound MySQL from 0.0.0.0/0.

D.Web server SG: inbound HTTPS from 0.0.0.0/0, inbound MySQL from database SG. Database SG: outbound MySQL to web server SG.

AnswerA

Security group references are best practice for inter-tier communication.

Why this answer

The web server security group should allow inbound HTTPS from 0.0.0.0/0 for internet traffic, and the database security group should allow inbound MySQL traffic only from the web server security group (not its CIDR). This follows the principle of least privilege and allows dynamic IP changes. Option B is wrong because outbound rules on the web server SG are unnecessary; security groups are stateful, so return traffic is automatically allowed.

Also, using the web server's CIDR in the database SG is less flexible than referencing the SG. Option C is wrong because allowing outbound all traffic from the web server is too permissive, and allowing inbound MySQL from 0.0.0.0/0 to the database is insecure. Option D is wrong because the web server should not have an inbound rule for MySQL; that would allow direct database access from outside.

Practice this question →

49

MCQhard

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

A.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.

B.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.

C.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.

D.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.

AnswerD

Security group references ensure only instances in the web tier can access the app tier, and only instances in the app tier can access the database.

Why this answer

It uses security group IDs as the source for inbound rules, which allows traffic only from instances associated with the specified security group, regardless of their IP addresses. This provides a dynamic and secure way to control traffic between tiers, as security group IDs are resolved at the instance level and automatically adapt to changes in instance membership. By contrast, using CIDR blocks (as in options A and C) is less secure because it relies on static IP ranges that may not accurately reflect the actual instances in the web or app tiers, and option B is overly permissive by allowing all traffic from the web SG.

Exam trap

The trap here is that candidates often choose CIDR-based rules (options A or C) because they seem simpler, but they fail to recognize that security group IDs provide a more secure and dynamic way to enforce tier-to-tier access, especially in environments with elastic IPs or auto-scaling.

How to eliminate wrong answers

Option A is wrong because it uses CIDR blocks (Web SG CIDR) instead of security group IDs, which is less secure as CIDR blocks can be broader than necessary and do not automatically update when instances change IPs. Option B is wrong because it allows all traffic from the Web SG to the App SG, which is overly permissive and violates the principle of least privilege by permitting unnecessary protocols beyond HTTP. Option C is wrong because it uses a static CIDR block (10.0.0.0/24) for the database tier, which does not restrict access solely to the app tier instances and may allow other resources in that subnet to reach the database.

Practice this question →

50

MCQmedium

A company wants to store audit logs for a minimum of 7 years to meet compliance requirements. The logs are stored in Amazon S3. Which action should be taken to ensure logs are not deleted before 7 years?

A.Enable MFA Delete on the bucket.

B.Configure an S3 Lifecycle policy to transition objects to Glacier after 7 years.

C.Enable S3 Versioning to preserve all versions of objects.

D.Enable S3 Object Lock in Compliance mode with a 7-year retention period on the bucket.

AnswerD

Denies deletion of objects younger than 7 years.

Why this answer

To ensure logs cannot be deleted before 7 years, you must use S3 Object Lock with a Compliance retention period. MFA Delete (A) only adds an MFA requirement for deletions but does not enforce a retention period. Lifecycle policies (B) transition objects but do not prevent deletion.

Versioning (C) preserves previous versions but not the current object. Therefore, option D is the correct choice as it implements an immutable retention policy.

Exam trap

S3 bucket policies do not support an 'object age' condition key. The recommended solution is S3 Object Lock with a retention period.

Practice this question →

51

MCQhard

Refer to the exhibit. A security engineer reviews this CloudFormation template. Which statement about the bucket's public accessibility is correct?

A.The bucket is public because the bucket policy allows GetObject.

B.The bucket is public only for IPs in the 203.0.113.0/24 range.

C.The bucket is private because no ACLs allow public access.

D.The bucket is private because PublicAccessBlockConfiguration blocks all public access.

AnswerD

Correct. The settings block public access regardless of the policy.

Why this answer

The PublicAccessBlockConfiguration blocks all public access settings, including bucket policies that grant public access. Even though the bucket policy allows GetObject from a specific IP range, the RestrictPublicBuckets setting overrides the policy, effectively blocking all public access.

Practice this question →

52

MCQeasy

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that log files are not modified after they are created. Which feature should they enable?

A.Server-side encryption with AWS KMS

B.Log file integrity validation

C.S3 Object Lock

D.CloudWatch Logs integration

AnswerB

This validates that log files have not been modified.

Why this answer

CloudTrail log file integrity validation uses hash chains to detect any modification of log files after they are created. This ensures the authenticity and integrity of the logs. Option A (server-side encryption with AWS KMS) protects confidentiality but does not provide integrity verification.

Option C (S3 Object Lock) prevents deletion or overwrites but does not verify integrity of existing objects. Option D (CloudWatch Logs integration) is for real-time monitoring and alerting, not integrity validation.

Practice this question →

53

MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

A.Set up AWS Config rules to detect non-compliant buckets

B.Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured

C.Create an IAM role that requires encryption and attach it to all users

D.Use an S3 bucket policy with a condition for encryption

AnswerB

SCPs can deny actions based on conditions, enforcing encryption at creation time.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or mistakenly think S3 bucket policies can govern bucket creation, when in fact bucket policies only apply to operations on existing buckets.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets after creation but cannot block the creation itself, leaving a window of non-compliance. Option C is wrong because IAM roles attached to users do not enforce encryption on S3 bucket creation across all accounts in the organization; users can still create buckets without encryption if they have direct S3 permissions or use other roles, and IAM roles cannot override permissions granted by other policies. Option D is wrong because S3 bucket policies are resource-based and apply only to existing buckets, not to the creation of new buckets; they cannot prevent a bucket from being created without encryption.

Practice this question →

54

MCQmedium

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

A.Attach an Elastic IP to the instance.

B.Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.

C.Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.

D.Allow outbound traffic in the instance's security group.

AnswerC

Private subnet instances should not have public IPs; they use NAT gateway for internet access.

Why this answer

An EC2 instance in a private subnet cannot use a public IP address for internet access, as the private subnet's route table directs default traffic to a NAT gateway, not an internet gateway. The public IP is irrelevant because the instance's traffic must traverse the NAT gateway, which requires the instance to have no public IP and the private subnet route to point to the NAT gateway. Removing the public IP ensures the instance uses the NAT gateway's Elastic IP for outbound traffic, resolving the internet access issue.

Exam trap

The trap here is that candidates mistakenly think assigning a public IP or Elastic IP to an instance in a private subnet will grant internet access, overlooking that routing decisions are made at the subnet level, not the instance level.

How to eliminate wrong answers

Option A is wrong because attaching an Elastic IP to the instance does not change the routing; the private subnet's route table still sends 0.0.0.0/0 traffic to the NAT gateway, and the Elastic IP would be ignored since the instance is behind a NAT gateway. Option B is wrong because updating the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway would expose the instance directly to the internet, defeating the purpose of a private subnet and violating security best practices. Option D is wrong because security groups are stateful and allow outbound traffic by default; the issue is routing, not firewall rules.

Practice this question →

55

MCQhard

Refer to the exhibit. A security engineer applies this S3 bucket policy to an S3 bucket. The bucket contains sensitive data. What is the effect of this policy?

A.It allows anonymous users to upload objects.

B.It denies PutObject requests that are not using HTTPS.

C.It denies all PutObject requests to the bucket.

D.It enforces that all objects must be encrypted at rest.

AnswerB

The condition checks for SecureTransport false, so only non-HTTPS requests are denied.

Why this answer

The policy denies PutObject requests that are not using HTTPS (SecureTransport false). So it enforces HTTPS for uploads. Option B is correct.

Option A is incorrect because it does not deny all PutObject. Option C is incorrect because it does not enforce encryption. Option D is incorrect because it does not allow anonymous uploads.

Practice this question →

56

Multi-Selecthard

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Select 2 answers

A.S3 Interface Endpoint in the VPC

B.VPC Peering to a shared services VPC

C.NAT Gateway in a public subnet

D.Internet Gateway attached to the VPC

E.S3 Gateway Endpoint in the VPC

AnswersC, E

Allows outbound internet to EC2 instances in private subnets.

Why this answer

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates or API calls) while blocking unsolicited inbound connections. This satisfies the requirement for outbound internet access without exposing private instances directly.

Exam trap

The trap here is that candidates often choose an Internet Gateway (Option D) thinking it can be restricted via security groups or NACLs, but an Internet Gateway itself does not filter traffic—it simply enables bidirectional routing, and blocking inbound traffic requires additional controls like a NAT Gateway or a stateful firewall, which is not the intended design for private subnets.

Practice this question →

57

Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Select 2 answers

A.Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.

B.Add a route in the private subnet's route table pointing to the NAT gateway.

C.Attach an internet gateway to the private subnet's route table.

D.Create a VPC gateway endpoint for Amazon S3.

E.Deploy a NAT gateway in a public subnet.

AnswersB, E

Correct: This routes outbound internet traffic through the NAT gateway.

Why this answer

A NAT gateway, when deployed in a public subnet with an associated Elastic IP and a route to an internet gateway, allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's private IP address to forward outbound traffic through it.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an internet gateway, mistakenly thinking that adding an internet gateway to a private subnet's route table provides outbound-only access, when in fact it enables bidirectional internet connectivity and requires public IPs on the instances.

Practice this question →

58

Multi-Selectmedium

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Select 3 answers

A.AWS CloudTrail event history

B.Amazon CloudWatch Logs

C.VPC Flow Logs

D.AWS CloudTrail

E.AWS Config

AnswersA, D, E

Event history provides a searchable view of the last 90 days of API calls.

Why this answer

D, and E are correct. CloudTrail logs all API calls, including who made the call. CloudTrail event history provides a view of the last 90 days.

AWS Config records configuration changes, including security group creation. Option B is wrong because CloudWatch Logs does not capture API calls unless specifically configured. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Practice this question →

59

MCQeasy

A company wants to provide temporary security credentials to users accessing AWS resources from a mobile app. Which AWS service should they use?

A.AWS Signer

B.AWS Directory Service

C.Amazon Cognito Identity Pools (Federated Identities)

D.AWS IAM roles for cross-account access

AnswerC

Cognito Identity Pools issue temporary AWS credentials.

Why this answer

Amazon Cognito Identity Pools (Federated Identities) allow you to create unique identities for your users and federate them with identity providers. With an identity pool, you can obtain temporary, limited-privilege AWS credentials to access other AWS services. This is the correct service for providing temporary security credentials to users accessing AWS resources from a mobile app.

Option A (AWS Signer) is for code signing, not temporary credentials. Option B (AWS Directory Service) is for managing Microsoft Active Directory, not for generating temporary credentials. Option D (AWS IAM roles for cross-account access) is for granting access between AWS accounts, not for mobile app users.

Practice this question →

60

MCQeasy

A security engineer is configuring a security group for a web server that should only accept HTTPS traffic from the internet. Which inbound rule should be set?

A.TCP port 3389 from 0.0.0.0/0

B.TCP port 22 from 0.0.0.0/0

C.TCP port 80 from 0.0.0.0/0

D.TCP port 443 from 0.0.0.0/0

AnswerD

Port 443 is HTTPS.

Why this answer

HTTPS uses TCP port 443, which must be open to the internet (0.0.0.0/0) for web traffic. Option A is incorrect because port 3389 is used by RDP, not HTTPS. Option B is incorrect because port 22 is used by SSH for secure shell access, not web traffic.

Option C is incorrect because port 80 is used by HTTP, not HTTPS.

Practice this question →

61

Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for whitelisting by third-party services. Which TWO actions should the engineer take?

Select 2 answers

A.Use a VPC Peering connection to a central VPC with an Internet Gateway.

B.Deploy a NAT Gateway in a private subnet.

C.Configure the private subnet route table with a default route to an Internet Gateway.

D.Deploy a NAT Gateway in a public subnet and assign an Elastic IP.

E.Attach an Internet Gateway to the VPC.

AnswersD, E

Correct placement and IP assignment for outbound traffic.

Why this answer

A NAT Gateway in a public subnet with an Elastic IP allows private instances to access the internet using a single IP. Route tables for private subnets must point default route (0.0.0.0/0) to the NAT Gateway.

Practice this question →

62

Multi-Selecthard

Which THREE are AWS best practices for securing an Amazon EC2 instance? (Choose three.)

Select 3 answers

A.Store database credentials in instance metadata for easy retrieval.

B.Launch instances in the default VPC for easier network configuration.

C.Use security groups to control inbound and outbound traffic.

D.Disable password-based authentication and use SSH key pairs instead.

E.Regularly apply security patches using AWS Systems Manager Patch Manager.

AnswersC, D, E

Security groups are the primary mechanism for controlling network traffic to EC2 instances.

Why this answer

Security groups act as a virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level. By default, security groups are stateful and allow only explicitly permitted traffic, which is a fundamental AWS best practice for network security. Using security groups helps implement the principle of least privilege by restricting access to only necessary ports and protocols.

Exam trap

The trap here is that candidates may think instance metadata is a secure place to store credentials because it is convenient, but AWS explicitly warns against this due to the risk of exposure through SSRF or other instance-level vulnerabilities.

Practice this question →

63

Multi-Selecthard

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Select 2 answers

A.Create an S3 Gateway Endpoint in the VPC

B.Attach a VPC Endpoint Policy to the Gateway Endpoint to restrict access to the specific bucket

C.Attach an Internet Gateway to the VPC

D.Create an S3 Interface Endpoint in the VPC

E.Use a NAT Gateway to route the traffic to the internet

AnswersA, B

Provides private connectivity to S3.

Why this answer

A VPC Gateway Endpoint (option A) allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. This is the correct foundational component because it uses prefix lists in the route table to direct S3 traffic to the endpoint, bypassing the need for an Internet Gateway or NAT Gateway.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both are equally valid for S3, but Gateway Endpoints are the correct and cost-effective choice for S3 access from private subnets, while Interface Endpoints are used for services like API Gateway or Kinesis.

Practice this question →

64

Multi-Selecthard

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Select 2 answers

A.AWS Firewall Manager

B.AWS Network Firewall

C.VPC Peering

D.AWS WAF

E.Amazon GuardDuty

AnswersA, B

Firewall Manager provides centralized management of firewall rules across accounts and resources.

Why this answer

AWS Firewall Manager (Option A) provides centralized management of firewall rules and policies across accounts in AWS Organizations, enabling consistent enforcement of network security. AWS Network Firewall (Option B) offers managed network firewall services that can be centrally deployed and managed via Firewall Manager. Option C (VPC Peering) is a network connectivity feature, not a security management service.

Option D (AWS WAF) protects web applications at the application layer, not network-level security. Option E (Amazon GuardDuty) is a threat detection service, not a network security management tool.

Practice this question →

65

Multi-Selectmedium

A security engineer is configuring a VPC with public and private subnets. The engineer wants to ensure that the private subnet instances cannot initiate outbound connections to the internet but can receive responses from the internet if initiated from within the VPC. Which TWO configurations should be used?

Select 2 answers

A.Configure the private subnet security group to allow inbound traffic from the public subnet's security group.

B.Configure the private subnet route table to not have a route to an Internet Gateway or NAT Gateway.

C.Attach an Internet Gateway to the VPC and add a route to it in the private subnet route table.

D.Attach a NAT Gateway to the private subnet and add a route to it.

E.Configure the private subnet Network ACL to allow outbound traffic to 0.0.0.0/0.

AnswersA, B

Allows responses from public subnet.

Why this answer

Allows inbound traffic from the public subnet (e.g., from a load balancer) but does not affect outbound initiation. Option B ensures the private subnet has no route to the internet, preventing instances from initiating outbound traffic. Options C and D would allow outbound initiation.

Option E is insufficient because the route table is the primary control for outbound traffic.

Practice this question →

66

MCQeasy

A company wants to ensure that all data sent to an S3 bucket is encrypted in transit. Which policy statement should be added to the bucket policy?

A.Allow if aws:SecureTransport is false

B.Deny unless aws:SecureTransport is false

C.Allow if aws:SecureTransport is true

D.Deny if aws:SecureTransport is false

AnswerD

Denies HTTP, forces HTTPS.

Why this answer

The condition 'aws:SecureTransport' checks whether the request was sent over HTTPS. By denying requests when 'aws:SecureTransport' is false, the bucket policy blocks any HTTP requests, ensuring all data is encrypted in transit. Option A allows HTTP requests.

Option B denies HTTPS requests. Option C allows HTTPS but does not explicitly deny HTTP, making it less secure.

Practice this question →

67

Multi-Selecteasy

A company wants to use AWS CloudTrail to log all API calls in an AWS account. The security engineer needs to ensure that the logs are encrypted at rest and are accessible only to authorized personnel. Which THREE steps should the engineer take? (Choose THREE.)

Select 3 answers

A.Enable MFA delete on the S3 bucket.

B.Enable server-side encryption on the S3 bucket that stores CloudTrail logs.

C.Attach a service control policy (SCP) to the root account.

D.Create an IAM policy that grants access to the S3 bucket only to specific users or roles.

E.Configure the S3 bucket policy to require encrypted connections (aws:SecureTransport).

AnswersB, D, E

Encrypts logs at rest.

Why this answer

Options B, D, and E are correct. Enabling server-side encryption on the S3 bucket (B) ensures logs are encrypted at rest. Creating an IAM policy that grants access only to specific users or roles (D) ensures only authorized personnel can access logs.

Configuring the S3 bucket policy to require encrypted connections (E) enforces encryption in transit. Option A is incorrect because MFA delete does not encrypt logs; it adds an extra authentication step for delete operations. Option C is incorrect because service control policies (SCPs) apply at the organization level and are not used to control access to individual S3 buckets in this context.

Practice this question →

68

MCQhard

A security engineer needs to ensure that all data in transit between an Application Load Balancer (ALB) and EC2 instances is encrypted. What configuration is required?

A.Configure the security group to allow traffic on port 443.

B.Configure the ALB listener with HTTPS protocol.

C.Configure the ALB to terminate TLS connections.

D.Configure the target group to use HTTPS protocol.

AnswerD

Target group using HTTPS encrypts traffic between ALB and EC2.

Why this answer

To encrypt traffic between ALB and EC2, the target group must use HTTPS protocol. Option D is correct. Option A (security group) controls access, not encryption.

Option B (listener protocol) is for client-to-ALB encryption. Option C (TLS termination) is for the listener, not backend.

Practice this question →

69

Multi-Selecteasy

A company uses AWS Systems Manager Session Manager to provide SSH access to EC2 instances without needing to open inbound ports. The security team wants to ensure that all session activity is logged and that only authorized users can start sessions. Which combination of actions should be taken? (Choose TWO.)

Select 2 answers

A.Configure the EC2 instances to require SSH key pairs for authentication.

B.Enable AWS CloudTrail to log StartSession API calls.

C.Enable VPC Flow Logs to monitor network traffic.

D.Create IAM policies that allow the ssm:StartSession action only for specific users or roles.

E.Use security groups to restrict inbound traffic to the Session Manager endpoints.

AnswersB, D

CloudTrail logs all API calls, including Session Manager starts.

Why this answer

The correct answers are B and D. Enabling CloudTrail logging captures StartSession API calls, providing an audit trail of session activity. Creating IAM policies that allow the ssm:StartSession action for specific users or roles ensures that only authorized users can initiate sessions.

Option A is incorrect because Session Manager does not require SSH key pairs; it uses IAM for authentication. Option C is not the primary method for logging session activity; VPC Flow Logs monitor network traffic but not API calls. Option E is unnecessary because Session Manager does not rely on inbound ports.

Practice this question →

70

MCQhard

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to ensure that only specific IAM roles can use a particular KMS key to encrypt and decrypt data. What is the most secure way to achieve this?

A.Create an IAM policy that allows kms:Encrypt and kms:Decrypt for the roles and attach it to the roles.

B.Create a KMS key policy that grants access only to the specific IAM roles using the kms:CallerArn condition.

C.Create a KMS key policy that grants access to the account and use IAM policies to restrict the roles.

D.Create a KMS key policy with Principal "*" and a condition that the request originates from the roles.

AnswerB

This restricts key usage to the specified roles.

Why this answer

Using a key policy with a condition for the kms:CallerArn attribute restricts usage to the specified roles. Option A is wrong because IAM policies alone cannot restrict KMS key usage if the key policy allows all principals. Option C is wrong because key policy with Principal "*" grants access to all, even with a condition.

Option D is wrong because a condition for the IAM role's ARN is not a standard KMS condition key.

Practice this question →

71

MCQmedium

A security team needs to audit all changes to security group rules across multiple AWS accounts in an organization. Which combination of services should be used to meet this requirement?

A.Amazon CloudWatch Logs and AWS CloudTrail.

B.Amazon GuardDuty and AWS Security Hub.

C.AWS Trusted Advisor and AWS Config.

D.AWS Config and AWS CloudTrail.

AnswerD

AWS Config tracks resource changes; CloudTrail records API calls.

Why this answer

AWS Config can track changes to security group rules by recording configuration history, while AWS CloudTrail logs API calls that modify security groups. Together, they provide a complete audit trail across multiple accounts. Option A is incorrect because CloudWatch Logs is for monitoring logs, not configuration changes; CloudTrail alone logs API calls but lacks the configuration tracking that Config provides.

Option B is incorrect because GuardDuty and Security Hub are focused on threat detection and security posture, not auditing configuration changes. Option C is incorrect because Trusted Advisor provides best-practice checks and does not log changes; Config alone cannot capture API call details.

Practice this question →

72

MCQmedium

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

A.The IAM role is not attached to the EC2 instance profile.

B.The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.

C.The PublicAccessBlockConfiguration is blocking the bucket policy.

D.The role does not have s3:ListBucket permission.

AnswerC

The settings BlockPublicPolicy and RestrictPublicBuckets can prevent the policy from granting access even to specific roles.

Why this answer

The PublicAccessBlockConfiguration at the account or bucket level overrides any bucket policy that grants public or cross-account access. Even though the bucket policy may allow the DataAccessRole to read objects, the PublicAccessBlockConfiguration blocks all public or cross-account access, causing AccessDenied errors. This is the most likely cause because the bucket policy is effectively ignored when public access blocks are enabled.

Exam trap

The SCS-C02 exam often tests the misconception that a bucket policy alone is sufficient to grant cross-account access, without considering that PublicAccessBlockConfiguration can silently override it, leading candidates to overlook this setting.

How to eliminate wrong answers

Option A is wrong because the IAM role is not attached to an EC2 instance profile; the role is assumed directly by users, not by an EC2 instance, so an instance profile is irrelevant. Option B is wrong because there is no mention of SSE-KMS encryption in the exhibit, and the error is AccessDenied, not a KMS-related permission error (which would typically be a different error message). Option D is wrong because the s3:ListBucket permission is required for listing objects, not for reading individual objects; the error occurs when trying to read objects, which requires s3:GetObject, not s3:ListBucket.

Practice this question →

73

Multi-Selecthard

A company has a VPC with public and private subnets. The private subnets contain Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which combination of controls should the security team implement? (Choose TWO.)

Select 2 answers

A.Ensure that the route tables for the subnets containing RDS instances do not have a route to an internet gateway.

B.Configure security group inbound rules to allow only specific IP ranges and deny 0.0.0.0/0.

C.Place the RDS instances in public subnets with network ACLs blocking inbound traffic.

D.Add a network ACL rule to deny all inbound traffic to the RDS subnets.

E.Use an AWS WAF web ACL attached to the RDS instances.

AnswersA, B

Private subnets should not have a route to an internet gateway to prevent direct internet access.

Why this answer

To ensure RDS instances are not accessible from the internet, you must prevent any network path from the internet to the instances. Option A is correct because if the subnet's route table lacks a route to an internet gateway, traffic cannot reach the internet, and internet traffic cannot reach the instances via the gateway. Option B is correct because security group rules act as a virtual firewall at the instance level; by not allowing inbound traffic from 0.0.0.0/0 and only allowing specific IP ranges, you restrict internet access.

Option C is incorrect because placing RDS instances in public subnets would expose them to the internet regardless of NACLs; public subnets have a route to an internet gateway. Option D is incorrect because a network ACL denying all inbound traffic is overly restrictive and would block all traffic to the subnets, including legitimate internal traffic; also, NACLs are stateless and require separate outbound rules. Option E is incorrect because AWS WAF is for web application traffic at the application layer (HTTP/HTTPS) and does not apply to RDS instances directly; it is used with CloudFront, ALB, or API Gateway.

Practice this question →

74

MCQmedium

Refer to the exhibit. A security engineer creates the S3 bucket policy above to allow an IAM role to upload objects only from the corporate network IP range (10.0.0.0/16). However, users report that they can still upload objects from outside the range when assuming the role. What is the most likely cause?

A.The condition key aws:SourceIp does not support the IP range 10.0.0.0/16 because it is a private IP range.

B.The bucket policy uses Allow instead of Deny; an explicit Deny is needed to block requests that do not meet the condition.

C.The IAM role's trust policy does not restrict who can assume the role.

D.The resource ARN should not include the trailing /*.

AnswerB

Because the IAM role already has an Allow, an Allow with condition does not restrict; a Deny is required.

Why this answer

An S3 bucket policy with an Allow effect grants access to anyone who meets the condition, but it does not explicitly deny requests that do not meet the condition. In IAM and resource-based policies, an Allow that includes a condition only applies when the condition is true; if the condition is false, the Allow is not evaluated, but other policies (like the IAM role's permissions) may still grant access. To block uploads from outside the corporate IP range, an explicit Deny with the same condition (or a NotIpAddress condition) is required to override any other Allow that might apply.

Exam trap

The trap here is that candidates assume an Allow with a condition implicitly denies all other requests, but AWS policy evaluation requires an explicit Deny to block access that does not meet the condition.

How to eliminate wrong answers

Option A is wrong because the aws:SourceIp condition key supports private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) when the request originates from within a VPC or corporate network; the limitation is that aws:SourceIp cannot be used for requests that come through a VPC endpoint (where aws:VpcSourceIp should be used instead), but private IP ranges are otherwise valid. Option C is wrong because the IAM role's trust policy controls who can assume the role, not the network source of the request; even if the trust policy is restrictive, the bucket policy's Allow condition is still insufficient to block uploads from outside the IP range. Option D is wrong because the resource ARN with a trailing /* is correct for granting access to all objects within the bucket; omitting the /* would restrict the policy to the bucket itself (e.g., s3:ListBucket), not to object-level actions like s3:PutObject.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Infrastructure Security questions.

Start 20-question session