Courseiva

CCNA Infrastructure Security Questions

57 of 132 questions · Page 2/2 · Infrastructure Security · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQhard

A company runs a multi-tier web application on AWS. The web tier uses an Application Load Balancer (ALB) in a public subnet, and the application tier runs on EC2 instances in private subnets. The security team recently ran a vulnerability scan and found that the application instances are accessible from the internet on port 8080. The EC2 instances have a security group that allows inbound traffic on port 8080 from the ALB's security group only. However, the ALB's security group allows inbound traffic on port 8080 from 0.0.0.0/0. The architecture also includes a NAT Gateway for outbound internet access from private subnets. The security engineer needs to ensure that only the ALB can communicate with the application instances on port 8080, and that the application instances cannot be directly accessed from the internet. What should the security engineer do?

A.Change the EC2 instance security group to allow inbound traffic on port 8080 from 0.0.0.0/0, and rely on the subnet network ACL to block traffic.
B.Add a rule to the EC2 security group that denies inbound traffic from 0.0.0.0/0 on port 8080.
C.Modify the ALB security group to remove the inbound rule for port 8080 from 0.0.0.0/0, and configure the ALB listener to forward traffic from port 80/443 to port 8080 on the target group.
D.Place the EC2 instances in a public subnet and use a network ACL to block inbound traffic on port 8080 from the internet.
AnswerC

This correctly restricts internet access to the ALB on standard ports and allows the ALB to forward to port 8080.

Why this answer

The ALB's security group should not allow inbound from 0.0.0.0/0 on the application port. Instead, the ALB should listen on port 80/443 from the internet and forward to port 8080 on the instances. The ALB security group rule should be removed, and the listener should be configured on standard ports.

The EC2 security group is already correct.

Practice this question →
77
Multi-Selectmedium

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)

Select 2 answers
A.Amazon GuardDuty
B.AWS Shield Advanced
C.Network ACLs
D.AWS WAF
E.Amazon CloudFront
AnswersB, D

Shield Advanced provides advanced DDoS protection and integrates with WAF.

Why this answer

AWS WAF (Option D) can be associated with an ALB to filter web requests and protect against common exploits like SQL injection and cross-site scripting. AWS Shield Advanced (Option B) provides enhanced DDoS protection and integrates with WAF for additional layer 7 protections. Option A is wrong because GuardDuty is a threat detection service, not an inline web application firewall.

Option C is wrong because Network ACLs operate at the subnet level and do not provide application-layer filtering. Option E is wrong because CloudFront is a CDN, and while it can be used with WAF, it alone does not provide WAF rules.

Practice this question →
78
MCQeasy

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?

A.AWS Key Management Service (KMS)
B.Amazon S3 server-side encryption
C.RDS encryption feature
D.SSL/TLS certificates
AnswerA

KMS provides encryption keys for RDS encryption.

Why this answer

AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.

Exam trap

The trap here is that candidates confuse the RDS encryption feature (which is a checkbox in the console) with a standalone service, when in fact the underlying service that performs the encryption and key management is AWS KMS.

How to eliminate wrong answers

Option B is wrong because Amazon S3 server-side encryption is a feature specific to objects stored in Amazon S3 buckets, not applicable to RDS DB instance storage. Option C is wrong because 'RDS encryption feature' is not a standalone service; it is a feature that relies on AWS KMS to manage the encryption keys — the question asks which service or feature should be used, and KMS is the underlying service that enables RDS encryption. Option D is wrong because SSL/TLS certificates are used to encrypt data in transit between the client and the database, not data at rest stored on disk.

Practice this question →
79
MCQeasy

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

A.Create an Origin Access Control (OAC) for the S3 bucket origin
B.Create a Route 53 health check to verify CloudFront availability
C.Configure CloudFront signed URLs to restrict access
D.Attach a security group to the S3 bucket
AnswerA

OAC ensures only CloudFront can access the S3 bucket.

Why this answer

An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.

Exam trap

The trap here is that candidates often confuse CloudFront signed URLs (which control user access to content) with origin access controls (which restrict which origin server CloudFront can talk to), leading them to pick option C instead of A.

How to eliminate wrong answers

Option B is wrong because a Route 53 health check verifies the availability of a resource (e.g., CloudFront) for DNS failover, but it does not enforce access restrictions or prevent direct access to the S3 bucket. Option C is wrong because CloudFront signed URLs control access to individual objects by requiring authentication tokens, but they do not prevent users from accessing the S3 bucket directly if the bucket is publicly accessible; signed URLs are for per-request authorization, not origin access control. Option D is wrong because S3 buckets do not support security groups; security groups are a network firewall construct for EC2 instances and other VPC resources, not for S3.

Access to S3 is controlled via bucket policies, IAM policies, or OAC.

Practice this question →
80
MCQmedium

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

A.Allow inbound database port from the security group attached to the application instances in the public subnet.
B.Allow inbound database port from 0.0.0.0/0 in the database security group.
C.Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.
D.Allow inbound database port from the public subnet CIDR block in the database security group.
AnswerA

This dynamically allows traffic from all application instances.

Why this answer

Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet.

Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.

Practice this question →
81
Multi-Selectmedium

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Select 3 answers
A.Use S3 Inventory to list objects and their tags.
B.Enable S3 object-level logging in CloudTrail.
C.Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.
D.Create a bucket policy with a condition based on the s3:ExistingObjectTag key.
E.Set a bucket policy that denies access if the object does not have the required tag.
AnswersC, D, E

IAM policies can also use condition keys to restrict access based on tags.

Why this answer

To restrict the IAM role to only access objects with specific tags, three steps are necessary. First, attach an IAM policy to the role using the s3:ExistingObjectTag condition key (option C). This alone, however, can be overridden by a bucket policy that grants broader access.

Second, create a bucket policy that explicitly allows the role to access objects only when they have the required tag (option D). Third, create a bucket policy that denies the role access to objects that do not have the required tag (option E). The combination of IAM and bucket policies ensures tag-based access control is enforced, as IAM provides identity-based restrictions and bucket policies add resource-based checks, including an explicit deny for non-compliant objects.

Exam trap

The trap here is that candidates often confuse S3 Inventory (a reporting tool) or CloudTrail logging (an auditing tool) with access control mechanisms, leading them to select options that do not actually restrict access.

Practice this question →
82
MCQmedium

A company uses AWS Systems Manager Session Manager to manage EC2 instances. The security team wants to ensure that all SSH sessions are logged and that commands are recorded. What should be configured?

A.Enable session logging in the Session Manager preferences to send logs to Amazon S3 and CloudWatch Logs
B.Configure the security group to allow inbound SSH from the Session Manager service
C.Enable AWS CloudTrail to log Systems Manager API calls
D.Create an IAM policy that allows ssm:StartSession and attach it to the instance role
AnswerA

Session Manager preferences allow logging of session activities and command recording.

Why this answer

Session Manager preferences allow logging session activity to Amazon S3 and CloudWatch Logs, which records all commands run during SSH sessions. Option B is incorrect because security groups control network access, not logging. Option C is incorrect because CloudTrail logs API calls to Systems Manager, not the commands executed within a session.

Option D is incorrect because an IAM policy only controls permissions to start sessions, not the logging of session activity.

Practice this question →
83
MCQmedium

A company uses an AWS Network Firewall to inspect traffic between subnets in a VPC. The security team wants to ensure that all traffic from the web tier to the database tier passes through the firewall. The web servers are in subnet A, and the database servers are in subnet B. What routing configuration is required?

A.Add a route in the route table associated with subnet A that sends all traffic to the firewall endpoint.
B.Add a route in the route table for subnet A with destination subnet B CIDR and target the firewall endpoint. Add a similar route in subnet B's route table with destination subnet A CIDR and target the firewall endpoint.
C.Add a route in the route table associated with subnet B that sends all traffic to the firewall endpoint.
D.Associate both subnets with the same route table and add a route to the firewall endpoint for all traffic.
AnswerB

This ensures both directions go through the firewall.

Why this answer

To force traffic between subnets through the AWS Network Firewall, you need symmetric routes: add a route in subnet A's route table for destination subnet B CIDR with target the firewall endpoint, and similarly add a route in subnet B's route table for destination subnet A CIDR with target the firewall endpoint. This ensures both forward and return traffic pass through the firewall. Option A is wrong because it sends all traffic from subnet A to the firewall, which is overly broad and may break other traffic; more importantly, it does not ensure return traffic from subnet B goes through the firewall.

Option C is wrong because it only handles return traffic from subnet B but not the forward traffic from subnet A. Option D is wrong because both subnets cannot be in the same route table if they need different routes; also, sending all traffic from both subnets to the firewall is not the correct setup for inter-subnet traffic inspection.

Practice this question →
84
MCQmedium

A company has a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL database. The security team has implemented security groups and network ACLs. Recently, a vulnerability scan revealed that the RDS database is accessible from the internet. The security engineer investigates and finds that the database security group allows inbound traffic on port 3306 from 0.0.0.0/0. The engineer also checks the network ACLs and finds that inbound rules allow traffic on port 3306 from 0.0.0.0/0, and outbound rules allow all traffic. The database is in a private subnet. Which combination of steps should the engineer take to remediate the issue while maintaining application functionality?

A.Update the network ACL inbound rule to allow traffic only from the ALB security group. The security group is already correctly configured.
B.Update the database security group to allow inbound traffic on port 3306 only from the ALB security group. Update the network ACL inbound rule to allow traffic from the ALB security group.
C.Update the database security group to allow inbound traffic on port 3306 from the VPC CIDR range. No changes to network ACL are needed.
D.Move the database to a public subnet and restrict the security group to the ALB security group.
AnswerC

Correct because it restricts the database security group to the VPC CIDR range, allowing only internal traffic, while the network ACL remains permissive but is not the primary control for private subnets.

Why this answer

It restricts the database security group to allow inbound traffic on port 3306 only from the VPC CIDR range, which still permits the EC2 instances (within the VPC) to connect to the database. No changes to the network ACL are needed because it is stateless and the database is in a private subnet, so the security group is the primary control for inbound traffic. Option A is incorrect because network ACLs cannot reference security groups; they must use CIDR ranges.

Option B is incorrect because it also attempts to reference a security group in the network ACL, which is not possible. Option D is incorrect because moving the database to a public subnet would expose it to the internet, increasing the attack surface.

Practice this question →
85
Multi-Selectmedium

Which TWO of the following are valid ways to control inbound traffic to an EC2 instance? (Select TWO.)

Select 2 answers
A.Network ACLs
B.IAM policies
C.Amazon CloudWatch alarms
D.AWS Key Management Service (KMS)
E.Security groups
AnswersA, E

NACLs are stateless firewalls applied at the subnet level.

Why this answer

Network ACLs (NACLs) are a valid method to control inbound traffic to an EC2 instance because they act as a stateless firewall at the subnet level. Each NACL rule evaluates inbound traffic based on source IP, protocol, and port, and rules are processed in order from lowest to highest number. Since NACLs are stateless, you must explicitly allow both inbound and outbound traffic for a response to return.

Exam trap

The trap here is that candidates often confuse IAM policies with network-level controls, mistakenly thinking IAM can filter traffic, or they assume CloudWatch alarms can block traffic when they only trigger notifications or auto-scaling actions.

Practice this question →
86
Multi-Selectmedium

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Select 2 answers
A.Amazon GuardDuty
B.AWS WAF
C.Security Groups
D.AWS Shield Advanced
E.Network ACLs
AnswersB, C

WAF provides application-layer protection.

Why this answer

AWS WAF is correct because it provides application-layer protection by inspecting HTTP/HTTPS requests to your web application, allowing you to block common attack patterns such as SQL injection and cross-site scripting (XSS) using customizable rules. Security Groups are correct because they act as a virtual firewall at the instance level (network layer), controlling inbound and outbound traffic based on IP addresses, ports, and protocols, thus forming the first line of defense in a defense-in-depth strategy.

Exam trap

The trap here is that candidates often confuse AWS Shield Advanced (which provides DDoS protection) with application-layer filtering, or assume Network ACLs can inspect application data, when in fact they operate only at the network layer and are stateless.

Practice this question →
87
Multi-Selecthard

A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?

Select 2 answers
A.Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.
B.Create a resource-based policy on the RDS instance.
C.Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.
D.Create a security group rule that references the EC2 instance's security group.
E.Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'.
AnswersA, E

Combines with endpoint policy.

Why this answer

To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect.

Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances.

Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.

Practice this question →
88
Multi-Selectmedium

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation are encrypted at rest. Which THREE configuration steps should be taken?

Select 3 answers
A.Create an AWS Config rule to check for unencrypted S3 buckets.
B.Use a CloudFormation stack policy to prevent updates that remove encryption.
C.Create a service control policy (SCP) that denies creation of S3 buckets without encryption.
D.In the CloudFormation template, specify the BucketEncryption property for each S3 bucket.
E.Create an IAM role that only allows creation of encrypted buckets.
AnswersA, C, D

Detects non-compliance.

Why this answer

Options A, C, and D are correct. AWS Config rules can detect unencrypted S3 buckets and trigger remediation. Service control policies (SCPs) can deny the creation of S3 buckets without encryption at the organizational level.

In CloudFormation templates, specifying the BucketEncryption property ensures encryption is configured at deployment time. Option B is incorrect because a CloudFormation stack policy only prevents updates to existing stacks but does not enforce encryption during initial creation. Option E is incorrect because an IAM role can restrict permissions but does not enforce encryption directly on S3 buckets created by CloudFormation.

Practice this question →
89
MCQmedium

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

A.Allow inbound HTTP traffic from the EC2 instances' own security group
B.Allow inbound HTTP traffic from 0.0.0.0/0
C.Allow inbound HTTP traffic from the VPC CIDR block
D.Allow inbound HTTP traffic from the ALB's security group
AnswerD

This ensures only the ALB can initiate traffic to the EC2 instances.

Why this answer

Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.

Exam trap

The trap here is that candidates often confuse security group referencing with CIDR-based rules, mistakenly thinking that allowing the VPC CIDR (Option C) is sufficient, but this would allow any resource in the VPC, not just the ALB, to reach the EC2 instances.

How to eliminate wrong answers

Option A is wrong because allowing inbound HTTP traffic from the EC2 instances' own security group would permit traffic between the EC2 instances themselves, not from the ALB, and does not restrict access to the ALB only. Option B is wrong because allowing inbound HTTP traffic from 0.0.0.0/0 would permit traffic from any IP address on the internet, completely bypassing the ALB and exposing the EC2 instances directly. Option C is wrong because allowing inbound HTTP traffic from the VPC CIDR block would permit traffic from any resource within the VPC (including other EC2 instances, NAT gateways, or VPN connections), not exclusively from the ALB.

Practice this question →
90
MCQeasy

A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. Which feature should they enable on the S3 bucket?

A.Versioning
B.Server access logging
C.Cross-Region Replication
D.Default encryption
AnswerD

Default encryption ensures all new objects are encrypted at rest.

Why this answer

Amazon S3 default encryption ensures that all new objects are encrypted at rest. Option A (Versioning) is for maintaining multiple versions of objects, not encryption. Option B (Server access logging) logs requests to the bucket.

Option C (Cross-Region Replication) replicates objects to another region but does not enforce encryption. Therefore, the correct answer is D: Default encryption.

Practice this question →
91
MCQeasy

A startup is building a web application on AWS. They have an Application Load Balancer (ALB) in front of EC2 instances in an Auto Scaling group. They want to protect the application from common web exploits like SQL injection and cross-site scripting. They also need to allow only traffic from certain geographic regions. Which AWS service should they use to achieve these requirements?

A.AWS WAF
B.AWS Shield Advanced
C.Security groups on the ALB
D.Network ACLs on the ALB subnets
AnswerA

WAF can block SQL injection, XSS, and geo-match rules.

Why this answer

AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. It also allows you to create rules to block or allow traffic based on geographic regions (geo-match conditions). Option B is incorrect because AWS Shield Advanced provides enhanced DDoS protection, not application-layer filtering.

Option C is incorrect because security groups act as a virtual firewall at the instance level but do not inspect application-layer traffic. Option D is incorrect because network ACLs provide stateless filtering at the subnet level and cannot perform deep packet inspection for web exploits.

Practice this question →
92
MCQhard

A company is running a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application serves traffic on port 443. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0. The EC2 instances are in a private subnet with a security group that allows inbound traffic from the ALB security group on port 8080. The application works correctly. However, the security team wants to add an additional layer of defense by implementing a web application firewall (WAF) to block common web exploits. The team also wants to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) can access the application for administrative purposes on a separate path. The team has enabled AWS WAF on the ALB and associated a web ACL. They have also created a rule to allow traffic from the corporate IP range and block all other traffic. After deploying these changes, external users (not from corporate IP) cannot access the application at all. The company wants external users to be able to access the main application, but only corporate IPs should access the admin path. What should the security engineer do to fix the issue?

A.Configure the security group of the ALB to allow only corporate IPs.
B.Create two separate ALBs, one for admin traffic and one for main traffic.
C.Remove the WAF rule that blocks all non-corporate traffic and rely on security groups.
D.Modify the WAF rule to allow traffic from the corporate IP range on the admin path and allow all traffic on the main application path.
AnswerD

This allows external users on main path and restricts admin path.

Why this answer

The correct action is to modify the WAF rule to allow traffic from corporate IPs on the admin path and allow all other traffic on the main application path. Currently, the WAF rule blocks all non-corporate traffic, which prevents external users from accessing the main application. By creating separate conditions for the admin path (corporate IPs only) and the main path (allow all), the security team can achieve the desired access control.

Option A is incorrect because it would block external users at the security group level. Option B is unnecessary and adds complexity. Option C removes the WAF protection entirely.

Therefore, option D is the correct solution.

Practice this question →
93
MCQeasy

A company is designing a security group for a web application that must receive HTTPS traffic from the internet and send traffic to a backend database. The backend database is an Amazon RDS MySQL instance. What is the best practice for configuring the security groups?

A.Web server SG: inbound HTTPS from 0.0.0.0/0. Database SG: inbound MySQL from web server SG.
B.Web server SG: inbound HTTPS from 0.0.0.0/0, outbound to database SG on port 3306. Database SG: inbound MySQL from web server CIDR block.
C.Web server SG: inbound HTTPS from 0.0.0.0/0, outbound all traffic. Database SG: inbound MySQL from 0.0.0.0/0.
D.Web server SG: inbound HTTPS from 0.0.0.0/0, inbound MySQL from database SG. Database SG: outbound MySQL to web server SG.
AnswerA

Security group references are best practice for inter-tier communication.

Why this answer

The web server security group should allow inbound HTTPS from 0.0.0.0/0 for internet traffic, and the database security group should allow inbound MySQL traffic only from the web server security group (not its CIDR). This follows the principle of least privilege and allows dynamic IP changes. Option B is wrong because outbound rules on the web server SG are unnecessary; security groups are stateful, so return traffic is automatically allowed.

Also, using the web server's CIDR in the database SG is less flexible than referencing the SG. Option C is wrong because allowing outbound all traffic from the web server is too permissive, and allowing inbound MySQL from 0.0.0.0/0 to the database is insecure. Option D is wrong because the web server should not have an inbound rule for MySQL; that would allow direct database access from outside.

Practice this question →
94
MCQhard

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

A.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.
B.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.
C.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.
D.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.
AnswerD

Security group references ensure only instances in the web tier can access the app tier, and only instances in the app tier can access the database.

Why this answer

It uses security group IDs as the source for inbound rules, which allows traffic only from instances associated with the specified security group, regardless of their IP addresses. This provides a dynamic and secure way to control traffic between tiers, as security group IDs are resolved at the instance level and automatically adapt to changes in instance membership. By contrast, using CIDR blocks (as in options A and C) is less secure because it relies on static IP ranges that may not accurately reflect the actual instances in the web or app tiers, and option B is overly permissive by allowing all traffic from the web SG.

Exam trap

The trap here is that candidates often choose CIDR-based rules (options A or C) because they seem simpler, but they fail to recognize that security group IDs provide a more secure and dynamic way to enforce tier-to-tier access, especially in environments with elastic IPs or auto-scaling.

How to eliminate wrong answers

Option A is wrong because it uses CIDR blocks (Web SG CIDR) instead of security group IDs, which is less secure as CIDR blocks can be broader than necessary and do not automatically update when instances change IPs. Option B is wrong because it allows all traffic from the Web SG to the App SG, which is overly permissive and violates the principle of least privilege by permitting unnecessary protocols beyond HTTP. Option C is wrong because it uses a static CIDR block (10.0.0.0/24) for the database tier, which does not restrict access solely to the app tier instances and may allow other resources in that subnet to reach the database.

Practice this question →
95
MCQmedium

A company wants to store audit logs for a minimum of 7 years to meet compliance requirements. The logs are stored in Amazon S3. Which action should be taken to ensure logs are not deleted before 7 years?

A.Enable MFA Delete on the bucket.
B.Configure an S3 Lifecycle policy to transition objects to Glacier after 7 years.
C.Enable S3 Versioning to preserve all versions of objects.
D.Enable S3 Object Lock in Compliance mode with a 7-year retention period on the bucket.
AnswerD

Denies deletion of objects younger than 7 years.

Why this answer

To ensure logs cannot be deleted before 7 years, you must use S3 Object Lock with a Compliance retention period. MFA Delete (A) only adds an MFA requirement for deletions but does not enforce a retention period. Lifecycle policies (B) transition objects but do not prevent deletion.

Versioning (C) preserves previous versions but not the current object. Therefore, option D is the correct choice as it implements an immutable retention policy.

Exam trap

S3 bucket policies do not support an 'object age' condition key. The recommended solution is S3 Object Lock with a retention period.

Practice this question →
96
MCQhard

Refer to the exhibit. A security engineer reviews this CloudFormation template. Which statement about the bucket's public accessibility is correct?

A.The bucket is public because the bucket policy allows GetObject.
B.The bucket is public only for IPs in the 203.0.113.0/24 range.
C.The bucket is private because no ACLs allow public access.
D.The bucket is private because PublicAccessBlockConfiguration blocks all public access.
AnswerD

Correct. The settings block public access regardless of the policy.

Why this answer

The PublicAccessBlockConfiguration blocks all public access settings, including bucket policies that grant public access. Even though the bucket policy allows GetObject from a specific IP range, the RestrictPublicBuckets setting overrides the policy, effectively blocking all public access.

Practice this question →
97
MCQhard

A company is deploying a multi-tier web application across multiple Availability Zones. The application includes a web tier, application tier, and database tier. The security team requires that the web tier can communicate with the application tier only on port 8080, and the application tier can communicate with the database tier only on port 3306. Which security group configuration should be used?

A.In the application tier security group, allow inbound from the web tier security group on port 8080. In the database tier security group, allow inbound from the application tier security group on port 3306.
B.In the database tier security group, allow inbound from the application tier's CIDR block on port 3306.
C.In the application tier security group, allow inbound from the web tier's CIDR block on port 8080.
D.In the web tier security group, allow outbound to 0.0.0.0/0 on port 8080.
AnswerA

Using security group IDs as sources ensures only those groups can communicate.

Why this answer

Security groups allow you to reference other security groups as sources in inbound rules. This enables traffic to flow between instances based on their security group membership, without needing to know IP addresses. Option A correctly uses the application tier security group as the source for the inbound rule on port 8080, and the database tier security group as the source for the inbound rule on port 3306.

Option B is incorrect because it uses CIDR blocks for the database tier, which is less specific and could allow traffic from unintended sources. Option C is incorrect because it uses CIDR blocks for the web tier, also less specific. Option D is incorrect because an outbound rule from the web tier does not control which source can initiate communication; inbound rules must be defined on the application tier security group.

Practice this question →
98
MCQeasy

A company is using AWS CloudTrail to log API calls. The security team wants to ensure that log files are not modified after they are created. Which feature should they enable?

A.Server-side encryption with AWS KMS
B.Log file integrity validation
C.S3 Object Lock
D.CloudWatch Logs integration
AnswerB

This validates that log files have not been modified.

Why this answer

CloudTrail log file integrity validation uses hash chains to detect any modification of log files after they are created. This ensures the authenticity and integrity of the logs. Option A (server-side encryption with AWS KMS) protects confidentiality but does not provide integrity verification.

Option C (S3 Object Lock) prevents deletion or overwrites but does not verify integrity of existing objects. Option D (CloudWatch Logs integration) is for real-time monitoring and alerting, not integrity validation.

Practice this question →
99
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

A.Set up AWS Config rules to detect non-compliant buckets
B.Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured
C.Create an IAM role that requires encryption and attach it to all users
D.Use an S3 bucket policy with a condition for encryption
AnswerB

SCPs can deny actions based on conditions, enforcing encryption at creation time.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or mistakenly think S3 bucket policies can govern bucket creation, when in fact bucket policies only apply to operations on existing buckets.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets after creation but cannot block the creation itself, leaving a window of non-compliance. Option C is wrong because IAM roles attached to users do not enforce encryption on S3 bucket creation across all accounts in the organization; users can still create buckets without encryption if they have direct S3 permissions or use other roles, and IAM roles cannot override permissions granted by other policies. Option D is wrong because S3 bucket policies are resource-based and apply only to existing buckets, not to the creation of new buckets; they cannot prevent a bucket from being created without encryption.

Practice this question →
100
MCQmedium

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

A.Attach an Elastic IP to the instance.
B.Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.
C.Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.
D.Allow outbound traffic in the instance's security group.
AnswerC

Private subnet instances should not have public IPs; they use NAT gateway for internet access.

Why this answer

An EC2 instance in a private subnet cannot use a public IP address for internet access, as the private subnet's route table directs default traffic to a NAT gateway, not an internet gateway. The public IP is irrelevant because the instance's traffic must traverse the NAT gateway, which requires the instance to have no public IP and the private subnet route to point to the NAT gateway. Removing the public IP ensures the instance uses the NAT gateway's Elastic IP for outbound traffic, resolving the internet access issue.

Exam trap

The trap here is that candidates mistakenly think assigning a public IP or Elastic IP to an instance in a private subnet will grant internet access, overlooking that routing decisions are made at the subnet level, not the instance level.

How to eliminate wrong answers

Option A is wrong because attaching an Elastic IP to the instance does not change the routing; the private subnet's route table still sends 0.0.0.0/0 traffic to the NAT gateway, and the Elastic IP would be ignored since the instance is behind a NAT gateway. Option B is wrong because updating the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway would expose the instance directly to the internet, defeating the purpose of a private subnet and violating security best practices. Option D is wrong because security groups are stateful and allow outbound traffic by default; the issue is routing, not firewall rules.

Practice this question →
101
MCQhard

Refer to the exhibit. A security engineer applies this S3 bucket policy to an S3 bucket. The bucket contains sensitive data. What is the effect of this policy?

A.It allows anonymous users to upload objects.
B.It denies PutObject requests that are not using HTTPS.
C.It denies all PutObject requests to the bucket.
D.It enforces that all objects must be encrypted at rest.
AnswerB

The condition checks for SecureTransport false, so only non-HTTPS requests are denied.

Why this answer

The policy denies PutObject requests that are not using HTTPS (SecureTransport false). So it enforces HTTPS for uploads. Option B is correct.

Option A is incorrect because it does not deny all PutObject. Option C is incorrect because it does not enforce encryption. Option D is incorrect because it does not allow anonymous uploads.

Practice this question →
102
Multi-Selecthard

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Select 2 answers
A.S3 Interface Endpoint in the VPC
B.VPC Peering to a shared services VPC
C.NAT Gateway in a public subnet
D.Internet Gateway attached to the VPC
E.S3 Gateway Endpoint in the VPC
AnswersC, E

Allows outbound internet to EC2 instances in private subnets.

Why this answer

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates or API calls) while blocking unsolicited inbound connections. This satisfies the requirement for outbound internet access without exposing private instances directly.

Exam trap

The trap here is that candidates often choose an Internet Gateway (Option D) thinking it can be restricted via security groups or NACLs, but an Internet Gateway itself does not filter traffic—it simply enables bidirectional routing, and blocking inbound traffic requires additional controls like a NAT Gateway or a stateful firewall, which is not the intended design for private subnets.

Practice this question →
103
Multi-Selecteasy

A company wants to allow only specific IP addresses to access an S3 bucket. Which two methods can achieve this? (Choose TWO.)

Select 2 answers
A.Use an IAM policy with a condition that limits access to specific IP addresses.
B.Configure a network ACL on the subnet that blocks traffic from all but specific IPs.
C.Enable VPC Flow Logs to filter traffic from specific IPs.
D.Attach a security group to the S3 bucket that allows traffic only from specific IPs.
E.Use an S3 bucket policy with a condition that limits access to specific IP addresses.
AnswersA, E

IAM policies can also use aws:SourceIp condition.

Why this answer

IAM policies can include a condition key like `aws:SourceIp` to restrict API calls to specific IP addresses. Since S3 API requests are authenticated via IAM, this condition effectively limits which IPs can perform operations on the bucket. Option E is correct because S3 bucket policies also support the `aws:SourceIp` condition key, allowing you to define IP-based access restrictions directly on the bucket resource itself, independent of the requester's IAM identity.

Exam trap

The trap here is that candidates often confuse network ACLs or security groups with S3 access control, not realizing that S3 is a global service that does not reside within a VPC subnet and cannot have security groups attached.

Practice this question →
104
MCQeasy

A company wants to host a static website in an Amazon S3 bucket. The bucket must be private and accessible only through an Amazon CloudFront distribution. Which configuration ensures that CloudFront can access the S3 bucket while blocking direct access via S3 URL?

A.Use CloudFront signed URLs and configure the bucket policy to allow access from CloudFront IP ranges
B.Enable S3 Block Public Access and configure CloudFront to use the bucket as an origin
C.Configure the bucket policy to allow s3:GetObject from the CloudFront service principal
D.Create an Origin Access Control (OAC) and update the bucket policy to allow access only to the CloudFront distribution
AnswerD

OAC ensures only CloudFront can access the bucket via a special principal.

Why this answer

An Origin Access Control (OAC) allows CloudFront to access an S3 bucket securely. You create an OAC, associate it with the CloudFront distribution, and update the bucket policy to grant s3:GetObject permissions only from that OAC. This blocks direct S3 URL access because the bucket policy denies access to any other principal.

Option A is incorrect because CloudFront signed URLs are for end-user access control, not for origin authentication. Option B is incorrect because enabling S3 Block Public Access alone does not grant CloudFront access; you must also configure a bucket policy that allows CloudFront. Option C is incorrect because using the CloudFront service principal (OAI) is an older method; while it can work, OAC is the current recommended approach with enhanced security.

Practice this question →
105
Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Select 2 answers
A.Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.
B.Add a route in the private subnet's route table pointing to the NAT gateway.
C.Attach an internet gateway to the private subnet's route table.
D.Create a VPC gateway endpoint for Amazon S3.
E.Deploy a NAT gateway in a public subnet.
AnswersB, E

Correct: This routes outbound internet traffic through the NAT gateway.

Why this answer

A NAT gateway, when deployed in a public subnet with an associated Elastic IP and a route to an internet gateway, allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's private IP address to forward outbound traffic through it.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an internet gateway, mistakenly thinking that adding an internet gateway to a private subnet's route table provides outbound-only access, when in fact it enables bidirectional internet connectivity and requires public IPs on the instances.

Practice this question →
106
MCQmedium

A company has a requirement to log all network traffic flowing through a VPC, including traffic between EC2 instances within the same subnet. Which AWS service should be used?

A.VPC Flow Logs
B.Amazon GuardDuty
C.AWS Config
D.AWS CloudTrail
AnswerA

Correct. VPC Flow Logs capture network traffic information at the VPC, subnet, or ENI level, meeting the requirement to log all traffic including intra-subnet traffic.

Why this answer

VPC Flow Logs is the correct service to log all network traffic flowing through a VPC, including traffic between EC2 instances within the same subnet. It captures IP traffic information at the VPC, subnet, or elastic network interface level. Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs and other data sources but does not log traffic itself.

AWS Config records resource configuration changes and evaluates them against desired configurations, not network traffic. AWS CloudTrail logs API calls made within the AWS environment, not network traffic.

Practice this question →
107
Multi-Selectmedium

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Select 3 answers
A.AWS CloudTrail event history
B.Amazon CloudWatch Logs
C.VPC Flow Logs
D.AWS CloudTrail
E.AWS Config
AnswersA, D, E

Event history provides a searchable view of the last 90 days of API calls.

Why this answer

D, and E are correct. CloudTrail logs all API calls, including who made the call. CloudTrail event history provides a view of the last 90 days.

AWS Config records configuration changes, including security group creation. Option B is wrong because CloudWatch Logs does not capture API calls unless specifically configured. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Practice this question →
108
MCQeasy

A company wants to provide temporary security credentials to users accessing AWS resources from a mobile app. Which AWS service should they use?

A.AWS Signer
B.AWS Directory Service
C.Amazon Cognito Identity Pools (Federated Identities)
D.AWS IAM roles for cross-account access
AnswerC

Cognito Identity Pools issue temporary AWS credentials.

Why this answer

Amazon Cognito Identity Pools (Federated Identities) allow you to create unique identities for your users and federate them with identity providers. With an identity pool, you can obtain temporary, limited-privilege AWS credentials to access other AWS services. This is the correct service for providing temporary security credentials to users accessing AWS resources from a mobile app.

Option A (AWS Signer) is for code signing, not temporary credentials. Option B (AWS Directory Service) is for managing Microsoft Active Directory, not for generating temporary credentials. Option D (AWS IAM roles for cross-account access) is for granting access between AWS accounts, not for mobile app users.

Practice this question →
109
MCQhard

A company uses AWS Shield Advanced to protect its web application against DDoS attacks. The application is behind an Application Load Balancer (ALB) with a web application firewall (AWS WAF) in front. The security team notices that some requests are being blocked by AWS WAF, but the source IP addresses are legitimate customers. What step should the team take to minimize false positives?

A.Implement rate-based rules with a count action and use the count data to create custom rules.
B.Switch to using AWS Managed Rules for IP reputation lists.
C.Increase the WAF rate-based rule threshold to allow more requests.
D.Reconfigure the ALB idle timeout to a higher value.
AnswerA

Rate-based rules with count allow monitoring and adjusting thresholds to avoid false positives.

Why this answer

Implementing rate-based rules with a count action allows you to collect data on blocked requests without actually blocking them. You can then use this data to create custom rules that differentiate between legitimate traffic and attacks, reducing false positives. Option B is incorrect because AWS Managed Rules for IP reputation lists are designed to block known malicious IPs, which could include legitimate customers' IPs if they are misclassified, potentially increasing false positives.

Option C is incorrect because increasing the WAF rate-based rule threshold would allow more requests before blocking, which might reduce false positives temporarily but could also allow more attack traffic. Option D is incorrect because reconfiguring the ALB idle timeout does not affect WAF blocking decisions; idle timeout controls how long the ALB waits before closing idle connections.

Practice this question →
110
MCQeasy

A security engineer is configuring a security group for a web server that should only accept HTTPS traffic from the internet. Which inbound rule should be set?

A.TCP port 3389 from 0.0.0.0/0
B.TCP port 22 from 0.0.0.0/0
C.TCP port 80 from 0.0.0.0/0
D.TCP port 443 from 0.0.0.0/0
AnswerD

Port 443 is HTTPS.

Why this answer

HTTPS uses TCP port 443, which must be open to the internet (0.0.0.0/0) for web traffic. Option A is incorrect because port 3389 is used by RDP, not HTTPS. Option B is incorrect because port 22 is used by SSH for secure shell access, not web traffic.

Option C is incorrect because port 80 is used by HTTP, not HTTPS.

Practice this question →
111
MCQmedium

A company wants to launch an Amazon EC2 instance that must be accessible via SSH from the company's corporate network (IP range 198.51.100.0/24). The instance should not be accessible from the internet. Which network configuration should the security engineer recommend?

A.Place the instance in a private subnet with a route to an internet gateway, and add a security group rule that allows SSH inbound from 198.51.100.0/24.
B.Place the instance in a public subnet, and add a network ACL rule that denies all inbound traffic from 0.0.0.0/0.
C.Place the instance in a private subnet, and add a security group rule that allows SSH inbound from 198.51.100.0/24.
D.Place the instance in a public subnet, and add a security group rule that allows SSH inbound from 0.0.0.0/0.
AnswerC

The instance is in a private subnet, and the security group restricts SSH to the corporate IP range.

Why this answer

The instance must be placed in a private subnet to prevent direct internet access. A security group rule allowing SSH inbound from the corporate IP range (198.51.100.0/24) permits access only from the corporate network. Option A is incorrect because a private subnet with a route to an internet gateway becomes a public subnet, enabling internet access.

Option B is incorrect because a public subnet with a network ACL denying all inbound traffic from 0.0.0.0/0 also blocks the corporate IP range, and the instance remains in a public subnet. Option D is incorrect because a public subnet with a security group allowing SSH from 0.0.0.0/0 permits access from the entire internet. Therefore, only option C satisfies both requirements: private subnet and security group restriction to the corporate IP range.

Practice this question →
112
Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for whitelisting by third-party services. Which TWO actions should the engineer take?

Select 2 answers
A.Use a VPC Peering connection to a central VPC with an Internet Gateway.
B.Deploy a NAT Gateway in a private subnet.
C.Configure the private subnet route table with a default route to an Internet Gateway.
D.Deploy a NAT Gateway in a public subnet and assign an Elastic IP.
E.Attach an Internet Gateway to the VPC.
AnswersD, E

Correct placement and IP assignment for outbound traffic.

Why this answer

A NAT Gateway in a public subnet with an Elastic IP allows private instances to access the internet using a single IP. Route tables for private subnets must point default route (0.0.0.0/0) to the NAT Gateway.

Practice this question →
113
Multi-Selecthard

Which THREE are AWS best practices for securing an Amazon EC2 instance? (Choose three.)

Select 3 answers
A.Store database credentials in instance metadata for easy retrieval.
B.Launch instances in the default VPC for easier network configuration.
C.Use security groups to control inbound and outbound traffic.
D.Disable password-based authentication and use SSH key pairs instead.
E.Regularly apply security patches using AWS Systems Manager Patch Manager.
AnswersC, D, E

Security groups are the primary mechanism for controlling network traffic to EC2 instances.

Why this answer

Security groups act as a virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level. By default, security groups are stateful and allow only explicitly permitted traffic, which is a fundamental AWS best practice for network security. Using security groups helps implement the principle of least privilege by restricting access to only necessary ports and protocols.

Exam trap

The trap here is that candidates may think instance metadata is a secure place to store credentials because it is convenient, but AWS explicitly warns against this due to the risk of exposure through SSRF or other instance-level vulnerabilities.

Practice this question →
114
Multi-Selecthard

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Select 2 answers
A.Create an S3 Gateway Endpoint in the VPC
B.Attach a VPC Endpoint Policy to the Gateway Endpoint to restrict access to the specific bucket
C.Attach an Internet Gateway to the VPC
D.Create an S3 Interface Endpoint in the VPC
E.Use a NAT Gateway to route the traffic to the internet
AnswersA, B

Provides private connectivity to S3.

Why this answer

A VPC Gateway Endpoint (option A) allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. This is the correct foundational component because it uses prefix lists in the route table to direct S3 traffic to the endpoint, bypassing the need for an Internet Gateway or NAT Gateway.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both are equally valid for S3, but Gateway Endpoints are the correct and cost-effective choice for S3 access from private subnets, while Interface Endpoints are used for services like API Gateway or Kinesis.

Practice this question →
115
Multi-Selecthard

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Select 2 answers
A.AWS Firewall Manager
B.AWS Network Firewall
C.VPC Peering
D.AWS WAF
E.Amazon GuardDuty
AnswersA, B

Firewall Manager provides centralized management of firewall rules across accounts and resources.

Why this answer

AWS Firewall Manager (Option A) provides centralized management of firewall rules and policies across accounts in AWS Organizations, enabling consistent enforcement of network security. AWS Network Firewall (Option B) offers managed network firewall services that can be centrally deployed and managed via Firewall Manager. Option C (VPC Peering) is a network connectivity feature, not a security management service.

Option D (AWS WAF) protects web applications at the application layer, not network-level security. Option E (Amazon GuardDuty) is a threat detection service, not a network security management tool.

Practice this question →
116
Multi-Selectmedium

A security engineer is configuring a VPC with public and private subnets. The engineer wants to ensure that the private subnet instances cannot initiate outbound connections to the internet but can receive responses from the internet if initiated from within the VPC. Which TWO configurations should be used?

Select 2 answers
A.Configure the private subnet security group to allow inbound traffic from the public subnet's security group.
B.Configure the private subnet route table to not have a route to an Internet Gateway or NAT Gateway.
C.Attach an Internet Gateway to the VPC and add a route to it in the private subnet route table.
D.Attach a NAT Gateway to the private subnet and add a route to it.
E.Configure the private subnet Network ACL to allow outbound traffic to 0.0.0.0/0.
AnswersA, B

Allows responses from public subnet.

Why this answer

Allows inbound traffic from the public subnet (e.g., from a load balancer) but does not affect outbound initiation. Option B ensures the private subnet has no route to the internet, preventing instances from initiating outbound traffic. Options C and D would allow outbound initiation.

Option E is insufficient because the route table is the primary control for outbound traffic.

Practice this question →
117
Multi-Selecthard

Which THREE measures can be taken to secure a VPC's network boundary? (Choose three.)

Select 3 answers
A.Attach an S3 bucket policy to restrict access to the bucket.
B.Use security groups to control inbound and outbound traffic at the instance level.
C.Attach an internet gateway to the VPC.
D.Use network ACLs to add an additional layer of stateless filtering at the subnet level.
E.Enable VPC Flow Logs to capture and analyze traffic metadata.
AnswersB, D, E

Security groups are stateful firewalls for instances.

Why this answer

Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level (stateful). They are a fundamental measure for securing the VPC network boundary by allowing only specified traffic to reach the instances, based on rules that evaluate source/destination IP, protocol, and port. This provides a critical layer of defense directly at the compute resource.

Exam trap

The trap here is confusing network security controls (security groups, network ACLs, VPC Flow Logs) with resource-level policies (S3 bucket policies) or connectivity components (internet gateway), leading candidates to select options that do not directly secure the VPC's network boundary.

Practice this question →
118
MCQeasy

A company wants to ensure that all data sent to an S3 bucket is encrypted in transit. Which policy statement should be added to the bucket policy?

A.Allow if aws:SecureTransport is false
B.Deny unless aws:SecureTransport is false
C.Allow if aws:SecureTransport is true
D.Deny if aws:SecureTransport is false
AnswerD

Denies HTTP, forces HTTPS.

Why this answer

The condition 'aws:SecureTransport' checks whether the request was sent over HTTPS. By denying requests when 'aws:SecureTransport' is false, the bucket policy blocks any HTTP requests, ensuring all data is encrypted in transit. Option A allows HTTP requests.

Option B denies HTTPS requests. Option C allows HTTPS but does not explicitly deny HTTP, making it less secure.

Practice this question →
119
Multi-Selecteasy

A company wants to use AWS CloudTrail to log all API calls in an AWS account. The security engineer needs to ensure that the logs are encrypted at rest and are accessible only to authorized personnel. Which THREE steps should the engineer take? (Choose THREE.)

Select 3 answers
A.Enable MFA delete on the S3 bucket.
B.Enable server-side encryption on the S3 bucket that stores CloudTrail logs.
C.Attach a service control policy (SCP) to the root account.
D.Create an IAM policy that grants access to the S3 bucket only to specific users or roles.
E.Configure the S3 bucket policy to require encrypted connections (aws:SecureTransport).
AnswersB, D, E

Encrypts logs at rest.

Why this answer

Options B, D, and E are correct. Enabling server-side encryption on the S3 bucket (B) ensures logs are encrypted at rest. Creating an IAM policy that grants access only to specific users or roles (D) ensures only authorized personnel can access logs.

Configuring the S3 bucket policy to require encrypted connections (E) enforces encryption in transit. Option A is incorrect because MFA delete does not encrypt logs; it adds an extra authentication step for delete operations. Option C is incorrect because service control policies (SCPs) apply at the organization level and are not used to control access to individual S3 buckets in this context.

Practice this question →
120
MCQhard

A security engineer needs to ensure that all data in transit between an Application Load Balancer (ALB) and EC2 instances is encrypted. What configuration is required?

A.Configure the security group to allow traffic on port 443.
B.Configure the ALB listener with HTTPS protocol.
C.Configure the ALB to terminate TLS connections.
D.Configure the target group to use HTTPS protocol.
AnswerD

Target group using HTTPS encrypts traffic between ALB and EC2.

Why this answer

To encrypt traffic between ALB and EC2, the target group must use HTTPS protocol. Option D is correct. Option A (security group) controls access, not encryption.

Option B (listener protocol) is for client-to-ALB encryption. Option C (TLS termination) is for the listener, not backend.

Practice this question →
121
Multi-Selecteasy

A company uses AWS Systems Manager Session Manager to provide SSH access to EC2 instances without needing to open inbound ports. The security team wants to ensure that all session activity is logged and that only authorized users can start sessions. Which combination of actions should be taken? (Choose TWO.)

Select 2 answers
A.Configure the EC2 instances to require SSH key pairs for authentication.
B.Enable AWS CloudTrail to log StartSession API calls.
C.Enable VPC Flow Logs to monitor network traffic.
D.Create IAM policies that allow the ssm:StartSession action only for specific users or roles.
E.Use security groups to restrict inbound traffic to the Session Manager endpoints.
AnswersB, D

CloudTrail logs all API calls, including Session Manager starts.

Why this answer

The correct answers are B and D. Enabling CloudTrail logging captures StartSession API calls, providing an audit trail of session activity. Creating IAM policies that allow the ssm:StartSession action for specific users or roles ensures that only authorized users can initiate sessions.

Option A is incorrect because Session Manager does not require SSH key pairs; it uses IAM for authentication. Option C is not the primary method for logging session activity; VPC Flow Logs monitor network traffic but not API calls. Option E is unnecessary because Session Manager does not rely on inbound ports.

Practice this question →
122
MCQhard

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to ensure that only specific IAM roles can use a particular KMS key to encrypt and decrypt data. What is the most secure way to achieve this?

A.Create an IAM policy that allows kms:Encrypt and kms:Decrypt for the roles and attach it to the roles.
B.Create a KMS key policy that grants access only to the specific IAM roles using the kms:CallerArn condition.
C.Create a KMS key policy that grants access to the account and use IAM policies to restrict the roles.
D.Create a KMS key policy with Principal "*" and a condition that the request originates from the roles.
AnswerB

This restricts key usage to the specified roles.

Why this answer

Using a key policy with a condition for the kms:CallerArn attribute restricts usage to the specified roles. Option A is wrong because IAM policies alone cannot restrict KMS key usage if the key policy allows all principals. Option C is wrong because key policy with Principal "*" grants access to all, even with a condition.

Option D is wrong because a condition for the IAM role's ARN is not a standard KMS condition key.

Practice this question →
123
MCQhard

A company has the S3 bucket policy shown in the exhibit. The bucket contains sensitive data that should only be accessible from within the corporate network (10.0.0.0/16). However, users inside the corporate network report that they cannot access objects in the bucket. What is the most likely cause?

A.Users do not have the appropriate IAM role assigned.
B.Users are accessing the bucket through a VPC endpoint, which changes the source IP.
C.The policy does not have a Deny statement.
D.The bucket policy requires SSL but the connection is not using HTTPS.
AnswerB

VPC endpoints use private IPs; the IpAddress condition may not match.

Why this answer

The condition uses IpAddress, which evaluates the source IP of the request. If users are accessing via a VPC endpoint, the source IP is not the client IP but the endpoint's private IP, which may not be in the specified range. Option A is wrong because a condition exists.

Option C is wrong because IAM roles are not relevant to the public policy. Option D is wrong because SSL is not required by the policy.

Practice this question →
124
Matchingmedium

Match each AWS Storage service encryption feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Server-side encryption with S3 managed keys

Server-side encryption with AWS KMS

Server-side encryption with customer-provided keys

Encryption at rest for EBS volumes

Encryption at rest for RDS instances

Why these pairings

AWS storage services offer various encryption options. S3 SSE-S3 and SSE-KMS are server-side encryption methods with different key management approaches. Client-side encryption occurs before data upload.

EBS encryption is transparent block-level encryption, and Glacier automatically encrypts data at rest.

Practice this question →
125
MCQmedium

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC Endpoint are allowed. Which policy element should be used in the bucket policy?

A.aws:SourceVpc
B.aws:VpcSourceIp
C.aws:SourceIp
D.aws:SourceVpce
AnswerD

aws:SourceVpce is the correct condition key to restrict access to a specific VPC Endpoint by specifying the VPC Endpoint ID in the bucket policy's Condition element.

Why this answer

The correct condition key to restrict access to a specific VPC Endpoint is 'aws:SourceVpce'. This key allows you to specify the VPC Endpoint ID in the bucket policy's Condition element. Option D (aws:SourceVpce) is correct.

Option A (aws:SourceVpc) is incorrect because it restricts to a VPC ID, not a VPC Endpoint. Option B (aws:VpcSourceIp) is not a valid condition key. Option C (aws:SourceIp) is used for IP-based restrictions, not VPC endpoints.

Practice this question →
126
MCQmedium

A security team needs to audit all changes to security group rules across multiple AWS accounts in an organization. Which combination of services should be used to meet this requirement?

A.Amazon CloudWatch Logs and AWS CloudTrail.
B.Amazon GuardDuty and AWS Security Hub.
C.AWS Trusted Advisor and AWS Config.
D.AWS Config and AWS CloudTrail.
AnswerD

AWS Config tracks resource changes; CloudTrail records API calls.

Why this answer

AWS Config can track changes to security group rules by recording configuration history, while AWS CloudTrail logs API calls that modify security groups. Together, they provide a complete audit trail across multiple accounts. Option A is incorrect because CloudWatch Logs is for monitoring logs, not configuration changes; CloudTrail alone logs API calls but lacks the configuration tracking that Config provides.

Option B is incorrect because GuardDuty and Security Hub are focused on threat detection and security posture, not auditing configuration changes. Option C is incorrect because Trusted Advisor provides best-practice checks and does not log changes; Config alone cannot capture API call details.

Practice this question →
127
MCQmedium

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

A.The IAM role is not attached to the EC2 instance profile.
B.The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.
C.The PublicAccessBlockConfiguration is blocking the bucket policy.
D.The role does not have s3:ListBucket permission.
AnswerC

The settings BlockPublicPolicy and RestrictPublicBuckets can prevent the policy from granting access even to specific roles.

Why this answer

The PublicAccessBlockConfiguration at the account or bucket level overrides any bucket policy that grants public or cross-account access. Even though the bucket policy may allow the DataAccessRole to read objects, the PublicAccessBlockConfiguration blocks all public or cross-account access, causing AccessDenied errors. This is the most likely cause because the bucket policy is effectively ignored when public access blocks are enabled.

Exam trap

The SCS-C02 exam often tests the misconception that a bucket policy alone is sufficient to grant cross-account access, without considering that PublicAccessBlockConfiguration can silently override it, leading candidates to overlook this setting.

How to eliminate wrong answers

Option A is wrong because the IAM role is not attached to an EC2 instance profile; the role is assumed directly by users, not by an EC2 instance, so an instance profile is irrelevant. Option B is wrong because there is no mention of SSE-KMS encryption in the exhibit, and the error is AccessDenied, not a KMS-related permission error (which would typically be a different error message). Option D is wrong because the s3:ListBucket permission is required for listing objects, not for reading individual objects; the error occurs when trying to read objects, which requires s3:GetObject, not s3:ListBucket.

Practice this question →
128
MCQmedium

A company wants to restrict access to an S3 bucket so that only objects uploaded with server-side encryption using AWS KMS are allowed. The bucket policy uses the 's3:x-amz-server-side-encryption' condition key. However, users can still upload unencrypted objects. What is the most likely reason?

A.The user's IAM policy overrides the bucket policy.
B.The bucket policy uses an Allow effect instead of Deny for the condition.
C.The condition key is misspelled.
D.The bucket policy does not explicitly deny s3:PutObject.
AnswerB

The condition must be used in a Deny statement to block unencrypted uploads. An Allow statement only permits encrypted uploads but does not prevent unencrypted ones.

Why this answer

The bucket policy must use a Deny effect with the condition key 's3:x-amz-server-side-encryption' to block unencrypted uploads. An Allow effect only permits encrypted uploads but does not prevent unencrypted ones, because the default behavior is to allow if no explicit Deny applies. Therefore, the correct answer is B: the bucket policy uses an Allow effect instead of Deny for the condition.

Practice this question →
129
MCQhard

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

A.Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.
B.Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.
C.Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.
D.Add a network ACL to the private subnet that denies inbound HTTP traffic.
AnswerB

This blocks inbound traffic while allowing outbound-initiated traffic.

Why this answer

Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help.

Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Practice this question →
130
Multi-Selecthard

A company has a VPC with public and private subnets. The private subnets contain Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which combination of controls should the security team implement? (Choose TWO.)

Select 2 answers
A.Ensure that the route tables for the subnets containing RDS instances do not have a route to an internet gateway.
B.Configure security group inbound rules to allow only specific IP ranges and deny 0.0.0.0/0.
C.Place the RDS instances in public subnets with network ACLs blocking inbound traffic.
D.Add a network ACL rule to deny all inbound traffic to the RDS subnets.
E.Use an AWS WAF web ACL attached to the RDS instances.
AnswersA, B

Private subnets should not have a route to an internet gateway to prevent direct internet access.

Why this answer

To ensure RDS instances are not accessible from the internet, you must prevent any network path from the internet to the instances. Option A is correct because if the subnet's route table lacks a route to an internet gateway, traffic cannot reach the internet, and internet traffic cannot reach the instances via the gateway. Option B is correct because security group rules act as a virtual firewall at the instance level; by not allowing inbound traffic from 0.0.0.0/0 and only allowing specific IP ranges, you restrict internet access.

Option C is incorrect because placing RDS instances in public subnets would expose them to the internet regardless of NACLs; public subnets have a route to an internet gateway. Option D is incorrect because a network ACL denying all inbound traffic is overly restrictive and would block all traffic to the subnets, including legitimate internal traffic; also, NACLs are stateless and require separate outbound rules. Option E is incorrect because AWS WAF is for web application traffic at the application layer (HTTP/HTTPS) and does not apply to RDS instances directly; it is used with CloudFront, ALB, or API Gateway.

Practice this question →
131
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all new member accounts automatically deny public access to S3 buckets. Which policy should be attached to the root organizational unit?

A.Attach an S3 bucket policy to each bucket
B.Attach an IAM policy to the root user
C.Attach a trust policy to the OrganizationAccountAccessRole
D.Attach a service control policy (SCP) to the root OU
AnswerD

SCPs can set permission boundaries across entire accounts, denying actions like s3:PutBucketPublicAccessBlock.

Why this answer

An SCP attached to the root OU can deny public access to S3 buckets across all accounts in the organization. Option A is incorrect because an S3 bucket policy applies only to individual buckets, not across accounts. Option B is incorrect because an IAM policy attached to the root user applies only to that user and does not affect S3 bucket policies.

Option C is incorrect because a trust policy is used for IAM role trust relationships, not for controlling S3 bucket access.

Practice this question →
132
MCQmedium

Refer to the exhibit. A security engineer creates the S3 bucket policy above to allow an IAM role to upload objects only from the corporate network IP range (10.0.0.0/16). However, users report that they can still upload objects from outside the range when assuming the role. What is the most likely cause?

A.The condition key aws:SourceIp does not support the IP range 10.0.0.0/16 because it is a private IP range.
B.The bucket policy uses Allow instead of Deny; an explicit Deny is needed to block requests that do not meet the condition.
C.The IAM role's trust policy does not restrict who can assume the role.
D.The resource ARN should not include the trailing /*.
AnswerB

Because the IAM role already has an Allow, an Allow with condition does not restrict; a Deny is required.

Why this answer

An S3 bucket policy with an Allow effect grants access to anyone who meets the condition, but it does not explicitly deny requests that do not meet the condition. In IAM and resource-based policies, an Allow that includes a condition only applies when the condition is true; if the condition is false, the Allow is not evaluated, but other policies (like the IAM role's permissions) may still grant access. To block uploads from outside the corporate IP range, an explicit Deny with the same condition (or a NotIpAddress condition) is required to override any other Allow that might apply.

Exam trap

The trap here is that candidates assume an Allow with a condition implicitly denies all other requests, but AWS policy evaluation requires an explicit Deny to block access that does not meet the condition.

How to eliminate wrong answers

Option A is wrong because the aws:SourceIp condition key supports private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) when the request originates from within a VPC or corporate network; the limitation is that aws:SourceIp cannot be used for requests that come through a VPC endpoint (where aws:VpcSourceIp should be used instead), but private IP ranges are otherwise valid. Option C is wrong because the IAM role's trust policy controls who can assume the role, not the network source of the request; even if the trust policy is restrictive, the bucket policy's Allow condition is still insufficient to block uploads from outside the IP range. Option D is wrong because the resource ARN with a trailing /* is correct for granting access to all objects within the bucket; omitting the /* would restrict the policy to the bucket itself (e.g., s3:ListBucket), not to object-level actions like s3:PutObject.

Practice this question →
← PreviousPage 2 of 2 · 132 questions total

Ready to test yourself?

Try a timed practice session using only Infrastructure Security questions.

Start 20-question session