CCNA Infrastructure Security Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because removing the rule without adding a new one would block all SSH access, not just restrict it to the company's range. Option C is wrong because adding a new rule does not automatically deny other traffic; security groups are allow-only, so the existing 0.0.0.0/0 rule would still permit all SSH access. Option D is wrong because outbound rules control outbound traffic, not inbound SSH access; changing outbound rules would not restrict inbound SSH.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling SSH and using AWS Systems Manager Session Manager is an alternative solution, not the most efficient way to restrict SSH access while maintaining existing rules; it changes the access method entirely and may not meet the requirement to restrict SSH specifically. Option B is wrong because network ACLs are stateless and operate at the subnet level, not the instance level; modifying a network ACL would affect all instances in the subnet and require separate inbound and outbound rules for return traffic, making it less efficient and not a direct replacement for a security group rule. Option D is wrong because adding a new security group rule allowing SSH from 203.0.113.0/24 while keeping the existing rule with 0.0.0.0/0 would still allow SSH from all IPs, as security group rules are evaluated as a logical OR; the existing permissive rule would remain in effect, failing to restrict access.

Why this answer

How to eliminate wrong answers

Option B is wrong because Network ACLs are stateless Layer 3/4 filters that only allow or deny based on IP, port, and protocol — they cannot inspect HTTP payloads for SQLi or XSS patterns. Option C is wrong because Security Groups are stateful Layer 3/4 firewalls attached to ENIs; they control which ports and IPs can reach the instance but have no application-layer inspection capability. Option D is wrong because AWS Shield Advanced provides DDoS protection (Layer 3/4 and some Layer 7 volumetric mitigation) but does not perform signature-based inspection for SQLi or XSS.

Why this answer

How to eliminate wrong answers

Option A is wrong because an internet gateway enables bidirectional internet access for public subnets; private subnets cannot use it directly without becoming public. Option B is wrong because a VPN connection connects to on-premises networks, not the internet. Option C is wrong because VPC peering connects two VPCs, not to the internet.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an internet gateway (IGW) attached to a VPC with a default route (0.0.0.0/0) pointing to it would provide internet access only to instances in public subnets (those with a route to the IGW and a public IP), not to instances in a private subnet. Option B is wrong because a VPC endpoint for S3 provides private connectivity to S3 only, not general internet access. Option C is wrong because a NAT gateway configured in a different availability zone would still appear in the route table of the private subnet’s route table (as a default route pointing to the NAT gateway ID) to provide internet access; the question explicitly states there is no NAT gateway or instance in the route table, so this cannot be the cause.

Why this answer

How to eliminate wrong answers

Option A is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to AWS services (like S3 or DynamoDB) without traversing the internet, but it does not provide general internet access for downloading patches from arbitrary internet hosts. Option B is wrong because Direct Connect establishes a dedicated private network connection from on-premises to AWS, but it does not inherently provide internet access; it would require additional routing and an internet gateway to reach the public internet. Option C is wrong because an Internet Gateway alone enables bidirectional communication between the VPC and the internet, but it cannot be directly attached to a private subnet; instances in a private subnet without a public IP cannot use an Internet Gateway for outbound-only traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because opening 8080 to 0.0.0.0/0 on the instances and relying on NACLs inverts the security model and exposes instances directly. Option B is wrong because security groups are allow-only — you cannot create explicit deny rules, so a 'deny 0.0.0.0/0' rule is not possible. Option D is wrong because moving instances to a public subnet increases exposure and NACLs are stateless and coarse, not a substitute for SG-based least privilege.

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC peering connects two separate VPCs, but Lambda functions run within a VPC only when explicitly configured; the default Lambda execution environment is outside any VPC, so peering does not apply unless the Lambda is already in a VPC. Option B is wrong because placing the Lambda function in a public subnet and using a NAT gateway would still route traffic through the internet (via the NAT gateway) to reach the RDS database in a private subnet, which is unnecessary and less secure; direct VPC placement avoids internet traversal. Option D is wrong because VPC endpoints are used for connecting to AWS services like S3 or DynamoDB via PrivateLink, not for connecting to an RDS database; RDS does not support VPC interface endpoints for database connections.

Why this answer

How to eliminate wrong answers

Option A is wrong because AmazonSSMFullAccess is an AWS-managed policy intended for IAM users or roles that need full administrative access to Systems Manager actions (e.g., creating documents, running automations), not for the EC2 instance role; it grants overly broad permissions that are unnecessary and violate least privilege for the instance. Option B is wrong because AmazonEC2FullAccess provides full access to EC2 resources (e.g., launching instances, modifying security groups) but does not include the specific SSM actions (ssm:UpdateInstanceInformation, ssm:SendCommand, etc.) required for the SSM Agent to register and communicate with Session Manager. Option C is wrong because AdministratorAccess grants full access to all AWS services and resources, which is far beyond the principle of least privilege and is never recommended for an EC2 instance role; it would work technically but is a security anti-pattern that the exam expects you to reject in favor of the minimal policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC Endpoints allow private access to specific AWS services (e.g., S3, DynamoDB) without traversing the internet, but they do not route general VPC traffic (e.g., to on-premises networks) through Direct Connect; they are service-specific, not a replacement for a VGW. Option B is wrong because a VPN backup over the internet would still allow traffic to potentially egress via the internet if the Direct Connect link fails, and the question explicitly requires traffic to go through Direct Connect, not over the internet; a VPN is a backup path, not a mechanism to enforce Direct Connect usage. Option D is wrong because assigning public IPs to instances would actually encourage traffic to route over the internet (via the IGW), defeating the requirement to keep traffic off the internet; Direct Connect does not require public IPs for private VIF traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because hardcoding the KMS key ID in a CloudFormation template reduces flexibility and security—anyone with access to the template can see the key ID, and it prevents reuse across environments without manual edits. Option B is wrong because a CloudFormation parameter with a validation rule only checks the format or allowed values of the input; it does not enforce that the key is actually used by resources in the stack, and users can still supply a different key ID that passes validation. Option D is wrong because an SCP cannot inspect the specific KMS key ID used within a CloudFormation resource property; SCPs operate at the API action level (e.g., denying `cloudformation:CreateStack`) and cannot conditionally allow actions based on the value of a template parameter or resource property.

Why this answer

How to eliminate wrong answers

Option B is wrong because `aws:SourceIp` restricts access based on the requester's IP address, not the encryption of the connection; it does not enforce HTTPS. Option C is wrong because `s3:x-amz-server-side-encryption` controls server-side encryption at rest (e.g., SSE-S3, SSE-KMS), not encryption in transit over the network. Option D is wrong because `aws:UserAgent` filters requests based on the user agent string of the client application, which has no bearing on whether the transport layer is encrypted.

Why this answer

How to eliminate wrong answers

Option B is wrong because allowing 0.0.0.0/0 opens the database to the entire internet, violating the least-privilege requirement. Option C is wrong because network ACLs are stateless and subnet-level; allowing the public subnet CIDR would permit any host in that subnet, not just the application instances, and NACLs cannot reference security groups. Option D is wrong because allowing the public subnet CIDR permits any resource in that subnet — including future unrelated instances — rather than only the application instances identified by their security group.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC peering connects entire VPCs, not subnets, and would allow all traffic between the peered VPCs, not restrict communication to specific resources. Option C is wrong because assigning the same security group to both EC2 and RDS would allow all traffic between any instances using that group, including unintended communication between multiple EC2 instances or other resources, violating the requirement to restrict communication solely to the EC2-RDS pair. Option D is wrong because network ACLs are stateless and operate at the subnet level, requiring explicit allow rules for both inbound and outbound traffic; using deny rules for all traffic except between the two subnets would be complex, error-prone, and still allow any instance in those subnets to communicate, not just the specific EC2 and RDS instances.

Why this answer

How to eliminate wrong answers

Option A is wrong because it only routes traffic from subnet A to the firewall endpoint, leaving return traffic from subnet B to subnet A uninspected and potentially breaking stateful flow symmetry. Option C is wrong because it only routes traffic from subnet B to the firewall endpoint, missing the outbound direction from the web tier. Option D is wrong because associating both subnets with the same route table does not automatically route traffic between them through the firewall; a single route table cannot have overlapping CIDR routes that distinguish traffic based on source subnet, and AWS route tables are per-subnet, not per-source, so this would not achieve bidirectional inspection.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'NoEcho' property only masks the parameter value in the console or CLI when the user enters it; it does not prevent the value from being stored in the template or from being exposed in stack outputs if the parameter is referenced there. Option B is wrong because storing the password in template outputs explicitly exposes the sensitive data in the Outputs tab of the CloudFormation console and in the DescribeStacks API response, which is the opposite of secure handling. Option C is wrong because hardcoding the password in the template, even with 'NoEcho', still embeds the plaintext value in the template file itself, which can be exposed through version control, logs, or template retrieval; 'NoEcho' only hides it during parameter input, not from the template content.

Why this answer

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply to both inbound and outbound traffic at the subnet level, but adding a deny rule for all outbound traffic would still allow return traffic for established connections if inbound rules permit it; more importantly, it does not prevent the application servers from initiating connections if a route exists, as the ACL only filters packets that are already routed. Option B is wrong because security groups are stateful and cannot deny outbound traffic; they only support allow rules, and by default all outbound traffic is allowed unless explicitly removed, but removing all outbound rules still permits return traffic for inbound-initiated connections due to statefulness, and the security group does not control routing. Option D is wrong because an egress-only internet gateway is designed for IPv6 traffic to allow outbound-only connections from a private subnet, which would actually enable outbound internet access for IPv6, contrary to the requirement to prevent all outbound internet connections.

Why this answer

How to eliminate wrong answers

Option A is wrong because `aws:VpcSourceIp` is not a valid AWS condition key; the correct key for source IP is `aws:SourceIp`, and it does not restrict based on VPC endpoint. Option B is wrong because `aws:SourceVpc` restricts access based on the VPC ID (e.g., `vpc-12345678`), not the specific VPC endpoint ID, so it would allow any traffic from within that VPC, not just through the endpoint. Option D is wrong because `aws:SourceIp` restricts based on the client's IP address, which is not suitable for VPC endpoint-based access control since the endpoint uses private IPs and the condition key cannot enforce endpoint-specific restrictions.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for downloading patches from arbitrary internet sources. Option C is wrong because attaching an Internet Gateway directly to a private subnet and routing 0.0.0.0/0 traffic to it would make the subnet effectively public, exposing instances to unsolicited inbound traffic and defeating the purpose of a private subnet. Option D is wrong because a bastion host is designed for secure administrative access (SSH/RDP) to private instances, not for routing general internet traffic; using it as a NAT would create a single point of failure, performance bottleneck, and security risk due to its management plane exposure.

Why this answer

How to eliminate wrong answers

Option A is wrong because security groups are stateful firewalls applied at the instance or elastic network interface level, not on transit gateways; transit gateways do not support security groups. Option B is wrong because VPC endpoints (Gateway Endpoints or Interface Endpoints) are used for private connectivity to AWS services (e.g., S3, DynamoDB) and cannot route general inter-VPC traffic through a third-party firewall. Option D is wrong because network ACLs are stateless firewalls applied at the subnet level, not on transit gateways; transit gateways do not support network ACLs.

Why this answer

How to eliminate wrong answers

Option A is wrong because a NAT instance is a single EC2 instance that you must manage, patch, and configure for high availability (e.g., using an Auto Scaling group with a script), and it does not provide the same managed scalability or automatic failover as a NAT Gateway. Option B is wrong because an Internet Gateway (IGW) allows bidirectional traffic; attaching it to a VPC and routing private subnets to it would expose those instances to inbound internet traffic, violating the requirement for private subnets that should only initiate outbound connections. Option D is wrong because an AWS Site-to-Site VPN connects your VPC to an on-premises network over the internet, not to the public internet for software updates; it is designed for hybrid connectivity, not outbound internet access for private subnets.

Why this answer

How to eliminate wrong answers

Option A is wrong because allowing inbound HTTP traffic from the EC2 instances' own security group would permit traffic between the EC2 instances themselves, not from the ALB, and does not restrict access to the ALB only. Option B is wrong because allowing inbound HTTP traffic from 0.0.0.0/0 would permit traffic from any IP address on the internet, completely bypassing the ALB and exposing the EC2 instances directly. Option C is wrong because allowing inbound HTTP traffic from the VPC CIDR block would permit traffic from any resource within the VPC (including other EC2 instances, NAT gateways, or VPN connections), not exclusively from the ALB.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a solution for VPC-to-S3 access without internet; it adds unnecessary complexity and cost. Option C is wrong because attaching an internet gateway and adding a route to the private subnet would require the instance to have a public IP or a NAT device to reach the internet, and the question explicitly states 'without internet access'. Option D is wrong because a NAT gateway provides outbound internet access for private instances, which contradicts the requirement of no internet access; it also introduces a dependency on a public subnet and an internet gateway.

Why this answer

How to eliminate wrong answers

Option A is wrong because the internet gateway is a network routing component, not a security group source; security groups cannot reference an internet gateway. Option C is wrong because allowing 0.0.0.0/0 would permit direct inbound traffic from the internet, which defeats the purpose of placing instances in a private subnet and bypasses the ALB. Option D is wrong because allowing the VPC CIDR would permit traffic from any resource within the VPC, including potentially compromised instances, rather than restricting traffic to only the ALB.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating access keys for the root user violates AWS security best practices; root user access keys provide unrestricted, permanent credentials that cannot be rotated or scoped down, and AWS recommends never using them for API calls. Option C is wrong because using the root user for daily administrative tasks exposes the account to unnecessary risk; instead, AWS Identity and Access Management (IAM) users with appropriate permissions should be used for routine operations. Option D is wrong because sharing the root user password with the IT team undermines accountability and security; AWS recommends using IAM roles or a secure password management system for emergency access, not distributing the root password.

Why this answer

How to eliminate wrong answers

Option B is wrong because the EC2 instance does not need to be in a public subnet; Session Manager works with instances in private subnets as long as they have outbound internet access (via NAT gateway or VPC endpoints) to reach the Systems Manager endpoints. Option C is wrong because the instance does not require a public IP address; Session Manager uses the SSM agent to initiate an outbound connection to AWS, so the instance can be fully private with no public IP. Option D is wrong because Session Manager explicitly avoids opening inbound SSH ports; the security group does not need to allow inbound SSH from 0.0.0.0/0, and in fact, a best practice is to block all inbound SSH traffic when using Session Manager.

Why this answer

How to eliminate wrong answers

Option A is wrong because IAM is an access management service for controlling permissions to AWS resources, not a secrets storage service; it cannot store or rotate database credentials. Option B is wrong because KMS is a key management service for creating and controlling encryption keys, not for storing or rotating secrets like database credentials. Option C is wrong because Systems Manager Parameter Store can store secrets as SecureString parameters but lacks built-in automatic rotation capabilities; it requires custom solutions or integration with Secrets Manager to achieve rotation.

Why this answer

How to eliminate wrong answers

Option A is wrong because Versioning only preserves multiple versions of objects — it has no encryption capability and does not enforce encryption at rest. Option B is wrong because Server Access Logging records requests made to the bucket for auditing purposes; it does not encrypt data. Option C is wrong because Cross-Region Replication copies objects to another bucket in a different region for durability or latency, but it does not enforce encryption at rest on the source bucket.

Why this answer

How to eliminate wrong answers

Option A is wrong because SCPs can only deny or allow actions (e.g., prevent disabling CloudTrail), but they cannot enforce enabling a service; they are not proactive configuration tools. Option B is wrong because using a cross-account IAM role to enable CloudTrail in each account is manual, error-prone, and does not scale; it also fails to enforce compliance automatically across all regions. Option C is wrong because AWS Config rules can detect non-compliance but cannot automatically enable CloudTrail; remediation actions require additional automation (e.g., AWS Systems Manager Automation), and Config itself is not a provisioning tool.

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Shield Advanced provides DDoS protection, not web exploit protection like SQL injection or XSS, and does not offer geographic traffic filtering. Option C is wrong because security groups on the ALB control IP/port-based access, not web exploits or geographic filtering. Option D is wrong because network ACLs on subnets are stateless and control IP/port traffic, not application-layer attacks or geo-blocking.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because it uses a CIDR block for the database inbound rule instead of referencing the web server security group, which is less precise and can break if IPs change. Option C is wrong because allowing MySQL from 0.0.0.0/0 exposes the database to the entire internet, a severe security risk. Option D is wrong because it reverses the direction — the web server should not accept inbound MySQL from the database, and the database should not initiate outbound MySQL to the web server.

Why this answer

How to eliminate wrong answers

Option A is wrong because it uses CIDR blocks (Web SG CIDR) instead of security group IDs, which is less secure as CIDR blocks can be broader than necessary and do not automatically update when instances change IPs. Option B is wrong because it allows all traffic from the Web SG to the App SG, which is overly permissive and violates the principle of least privilege by permitting unnecessary protocols beyond HTTP. Option C is wrong because it uses a static CIDR block (10.0.0.0/24) for the database tier, which does not restrict access solely to the app tier instances and may allow other resources in that subnet to reach the database.

Why this answer

How to eliminate wrong answers

Option A is wrong because MFA Delete only requires additional authentication for delete operations; it does not prevent an authorized user with MFA from deleting objects before 7 years. Option B is wrong because a lifecycle transition to Glacier after 7 years does not prevent deletion; lifecycle policies manage storage class, not immutability. Option C is wrong because S3 Versioning preserves versions but does not prevent deletion of the current version or the entire object; a user can still delete all versions.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the explicit Deny statement only denies access over HTTP, and this request is over HTTPS, so the Deny condition is not satisfied. Option B is wrong because while the request is over HTTPS, it does not satisfy the IP range condition in the Allow statement, so it is not allowed. Option C is wrong because the Deny condition is not satisfied, but the request still fails due to the lack of an explicit Allow matching the IP address, leading to an implicit Deny.

Why this answer

How to eliminate wrong answers

Option B is wrong because it adds an outbound rule to the web security group for traffic to the database security group on port 3306, but security groups are stateful—if the inbound rule on the database security group allows traffic from the web security group, the return traffic is automatically permitted, making the outbound rule redundant and not the primary mechanism to restrict database access. Option C is wrong because it uses a network ACL for the database tier, which is stateless and requires separate inbound and outbound rules, increasing administrative overhead; additionally, referencing a subnet CIDR instead of a security group is less flexible and does not automatically adapt to changes in the web tier. Option D is wrong because network ACLs do not support referencing security groups as a source or destination—they only support CIDR blocks, IP addresses, or service prefixes, so the rule 'allowing all traffic from the web security group' is invalid and would not work.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Shield Advanced provides DDoS protection and does not have native SQL injection detection capabilities; it can work with WAF but cannot independently block SQLi. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events for malicious activity, but it does not inspect HTTP request payloads for SQL injection patterns and cannot block traffic in real-time at the ALB. Option D is wrong because security groups operate at the network layer (Layer 3/4) and cannot inspect application-layer payloads for SQL injection patterns; they only filter based on IP addresses, ports, and protocols.

Why this answer

How to eliminate wrong answers

Option B (Resource) is wrong because the Resource element in a KMS key policy identifies the key itself (e.g., the key ARN), not the entity allowed to use it; it does not restrict which IAM role can decrypt. Option C (Action) is wrong because the Action element defines the cryptographic operations (like kms:Decrypt) that are allowed, but it does not specify who can perform them. Option D (Effect) is wrong because the Effect element only sets whether the policy statement allows or denies access (e.g., 'Allow' or 'Deny'), but it does not identify the specific IAM role permitted to decrypt.

Why this answer

How to eliminate wrong answers

Option B is wrong because SQS queue policies can work without specifying a principal if the policy is attached to the queue itself, and the `Principal` element can be omitted or set to `*` to allow all principals, but the issue here is not the absence of a principal. Option C is wrong because `ArnLike` is not deprecated; it is a valid condition operator used for pattern matching on ARNs, and the `aws:SourceArn` condition is commonly used with `ArnLike` to restrict access to specific resources. Option D is wrong because `aws:SourceIp` can be used with SQS queue policies to restrict access based on IP addresses, but it is not the issue here; the problem is the overly permissive second statement.

Why this answer

How to eliminate wrong answers

Option B is wrong because using the application tier's CIDR block is less secure and brittle — it permits any resource in that subnet, not just the application instances, and breaks if IPs change. Option C is wrong because using the web tier's CIDR block similarly allows any host in that subnet, violating least privilege, and it does not restrict to the web tier's actual instances. Option D is wrong because allowing outbound to 0.0.0.0/0 on port 8080 from the web tier does not control inbound access to the application tier and is overly permissive; security groups are stateful, so outbound rules are not the mechanism for restricting tier-to-tier inbound traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because KMS server-side encryption protects confidentiality at rest but does not detect or prevent post-creation modification — an attacker with KMS access could still alter logs. Option C is wrong because S3 Object Lock provides WORM protection but is an S3 feature, not a CloudTrail integrity mechanism, and requires enabling on the bucket separately; it prevents deletion/overwrite but does not provide cryptographic verification of log integrity. Option D is wrong because CloudWatch Logs integration streams events for monitoring but does not validate the integrity of delivered CloudTrail log files.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets after creation but cannot block the creation itself, leaving a window of non-compliance. Option C is wrong because IAM roles attached to users do not enforce encryption on S3 bucket creation across all accounts in the organization; users can still create buckets without encryption if they have direct S3 permissions or use other roles, and IAM roles cannot override permissions granted by other policies. Option D is wrong because S3 bucket policies are resource-based and apply only to existing buckets, not to the creation of new buckets; they cannot prevent a bucket from being created without encryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy explicitly denies requests, not allows anonymous uploads; there is no Allow statement granting public access. Option C is wrong because the Deny only applies when SecureTransport is false — HTTPS PutObject requests are permitted, so it does not deny all uploads. Option D is wrong because the policy conditions on transport security (HTTPS), not on encryption at rest; enforcing at-rest encryption requires conditions on 's3:x-amz-server-side-encryption'.

Why this answer

How to eliminate wrong answers

Option A is wrong because bucket policies and IAM policies are evaluated together; an explicit deny in either will override an allow, but there is no bucket policy mentioned in the scenario, and the IAM policy itself is the likely cause of denial. Option B is wrong because the policy explicitly includes `s3:GetObject` in the `Action` list, so the action is allowed by the policy statement. Option D is wrong because the policy is directly attached to the IAM user, not requiring role assumption; the user is already operating under the attached policy.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Single Sign-On (SSO) is a service for managing user access and authentication across multiple AWS accounts and applications, not for restricting service usage. Option B is wrong because AWS CloudTrail is a logging and monitoring service that records API activity, but it does not enforce or restrict which services can be used. Option C is wrong because IAM cross-account roles allow users in one account to assume roles in another account for access, but they do not provide a centralized mechanism to deny specific services across all accounts.

Why this answer

How to eliminate wrong answers

Option A is wrong because using CloudFront signed URLs is for restricting access to content at the user level, not for securing the origin; also, allowing access from CloudFront IP ranges is not secure because those IPs can change and are shared. Option B is wrong because simply enabling S3 Block Public Access and using the bucket as an origin does not grant CloudFront access; the bucket would remain private and CloudFront would be denied unless you also configure OAC or OAI. Option C is wrong because allowing 's3:GetObject' from the CloudFront service principal alone is not sufficient; you need to specify the specific distribution and use OAC or OAI to authenticate the request.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files from AWS resources, but it does not natively capture API-level changes to security group rules; it would require custom integration or agent-based logging. Option C is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) flowing through ENIs, not the configuration changes to security group rules themselves. Option D is wrong because AWS Config evaluates and records resource configuration changes over time, but it is not the primary service for auditing API calls; CloudTrail is the service that records the API actions that trigger those configuration changes, while AWS Config focuses on the resulting state.

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes logs (including VPC Flow Logs) for malicious activity — it does not itself log network traffic. Option C is wrong because AWS Config records resource configuration changes and evaluates compliance against rules; it does not capture network traffic. Option D is wrong because AWS CloudTrail logs API activity (who called which AWS API), not network traffic flowing through a VPC.

Why this answer

How to eliminate wrong answers

Option A is wrong because allowing the VPC's CIDR on port 3306 would permit any resource in the VPC (including unauthorized instances, Lambda functions in the same VPC, or even compromised hosts) to connect to the database, violating the principle of least privilege. Option B is wrong because allowing the subnet CIDR of the application server still opens the database to all instances in that subnet, not just the specific application server, and does not protect against lateral movement within the subnet. Option D is wrong because it configures an outbound rule on the application server's security group, which controls traffic leaving the application server, not inbound access to the RDS instance; the RDS security group's inbound rules are what enforce which sources can connect to the database.

Why this answer

How to eliminate wrong answers

Option A is wrong because encryption at rest protects data stored on disk, not data in transit over the network. Option B is wrong because a VPN connection is unnecessary and irrelevant when both resources are in the same VPC; VPNs are used for hybrid connectivity, not for intra-VPC traffic encryption. Option C is wrong because security groups are stateful firewalls that control traffic based on IP addresses and ports, not encryption protocols; they cannot enforce or negotiate SSL/TLS encryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that primarily protects against application-layer (Layer 7) attacks and provides edge-based DDoS mitigation, but it does not offer dedicated network-layer DDoS protection for EC2 instances directly. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events to identify malicious activity, but it does not actively mitigate or block DDoS attacks at the network layer. Option D is wrong because AWS WAF is a web application firewall that operates at Layer 7 (HTTP/HTTPS) to filter malicious requests like SQL injection or cross-site scripting, and it cannot mitigate network-layer (Layer 3/4) attacks such as SYN floods or UDP amplification.

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for anomalous behavior, but it does not inspect or block application-layer requests like SQL injection at the ALB level. Option C is wrong because Amazon Inspector is a vulnerability assessment service that scans EC2 instances and container images for software vulnerabilities and network exposure, not for detecting or blocking live web application attacks. Option D is wrong because AWS Shield Advanced provides DDoS protection against volumetric and state-exhaustion attacks, but it does not include application-layer inspection for SQL injection payloads.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Managed Rules for IP reputation lists block based on known malicious IPs, but legitimate customers may be falsely flagged if their IPs are misclassified or shared, and this doesn't address the root cause of false positives from rate-based rules. Option C is wrong because simply increasing the rate-based rule threshold may allow more malicious traffic through and doesn't solve the false positive issue for legitimate customers who might still exceed the new threshold. Option D is wrong because ALB idle timeout is unrelated to WAF false positives; it controls connection persistence and has no impact on request blocking decisions.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because TCP 3389 is RDP (Remote Desktop Protocol) for Windows — exposing it to 0.0.0.0/0 is a critical security risk and unrelated to HTTPS. Option B is wrong because TCP 22 is SSH for Linux administration — again a dangerous public exposure and not HTTPS. Option C is wrong because TCP 80 is unencrypted HTTP, not HTTPS; allowing it would permit plaintext web traffic, violating the requirement for HTTPS only.

Why this answer

How to eliminate wrong answers

Option A is wrong because a NAT Gateway enables outbound internet access for private instances but still routes traffic through the internet, exposing the instance to potential risks and incurring data transfer costs. Option B is wrong because AWS Site-to-Site VPN connects on-premises networks to a VPC over the internet, but it does not provide private access to S3 from within the VPC without internet egress. Option C is wrong because an Internet Gateway allows bidirectional internet traffic, which would expose the EC2 instance to the internet, violating the requirement to keep it isolated.

Why this answer

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) rules target script injection into web pages, not SQL injection into database queries, and the two attack vectors use different payload patterns and inspection points. Option C is wrong because rate-based rules limit request volume per IP to mitigate DDoS or brute-force attacks, but they do not inspect request content for SQL injection signatures. Option D is wrong because geographic match rules block traffic based on country of origin, which is irrelevant to SQL injection payloads that can originate from any location.

Why this answer

How to eliminate wrong answers

Option A is wrong because security groups are network-level firewalls for EC2 instances and cannot be assigned to S3 buckets; S3 is a managed service that does not support security group attachments. Option B is wrong because `aws:SourceIp` condition in IAM policies checks the originating IP address, not the VPC, so it cannot restrict access based on VPC membership and would not work for traffic from a VPC endpoint where the source IP is internal. Option D is wrong because network ACLs are stateless firewalls attached to subnets, not to S3 buckets, and they cannot control access to S3 at the bucket level.

Why this answer

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and cannot reference prefix lists of subnets as a source in inbound rules; they only support CIDR blocks, IP ranges, or protocol/port numbers. Option B is wrong because network ACLs require explicit allow and return traffic rules (stateless), and using subnet CIDRs creates administrative overhead when subnets change or scale, plus they cannot dynamically follow instances that move between subnets. Option C is wrong because referencing public IP addresses is fragile (IPs can change with scaling or NAT), violates the principle of using private addressing within a VPC, and adds administrative burden to track and update IPs.

Why this answer

How to eliminate wrong answers

Option B is wrong because IAM policies control who can perform actions (e.g., CreateStack) but cannot enforce specific tag keys or values on resources created by CloudFormation; IAM conditions like 'aws:RequestTag' only apply to tagging actions on the API call itself, not to tags on the resulting stack resources. Option C is wrong because AWS Config can detect non-compliant stacks after they are created and trigger remediation (e.g., via Systems Manager Automation), but it is reactive and does not prevent the initial deployment of non-compliant stacks. Option D is wrong because Service Control Policies (SCPs) are applied at the AWS Organizations level to restrict permissions for accounts, but they cannot enforce tags on CloudFormation stacks; SCPs can only deny API actions based on request parameters, not validate tags on resources after creation.

Why this answer

How to eliminate wrong answers

Option A is wrong because security groups in AWS are stateful and include a default allow-all outbound rule unless it has been explicitly removed; the exhibit does not show the outbound rules, so claiming there are none is unsupported. Option B is wrong because the rule shown is for port 80 (HTTP), not port 22 (SSH); SSH access from any IP would require a separate inbound rule for TCP/22 from 0.0.0.0/0, which is not present in the output. Option D is wrong because a security group's rule listing does not reveal how many EC2 instances are associated with it; that information comes from the instance's network interface configuration, not the group's rule set.

Why this answer

How to eliminate wrong answers

Option A is wrong because ALB nodes use elastic network interfaces (ENIs) with private IPs that can change during scaling or replacement, making this approach brittle and requiring constant updates; it also violates the principle of using security group references for dynamic environments. Option B is wrong because allowing HTTPS from 0.0.0.0/0 still permits traffic from any source, failing to restrict access to only the ALB, and removing the HTTP rule does not address the requirement. Option C is wrong because referencing an ALB's ENI is not a valid security group rule source; security groups can only reference other security groups or CIDR blocks, not specific ENIs.

Why this answer

How to eliminate wrong answers

Option A is wrong because the `x-amz-server-side-encryption` header is used to enforce encryption at rest (server-side encryption), not encryption in transit; it does not control whether the connection uses HTTPS. Option C is wrong because enabling default encryption on the bucket (e.g., SSE-S3) only encrypts objects at rest in S3, not the data in transit between the client and S3. Option D is wrong because while CloudFront with HTTPS can enforce encryption in transit for content delivery, it does not apply to direct S3 bucket access via the S3 API or other endpoints; the bucket policy itself must enforce the condition.

Why this answer

How to eliminate wrong answers

Option A is wrong because encryption at rest using AWS KMS protects data stored on disk, not data in transit; it does not encrypt network traffic between clients and the RDS instance. Option C is wrong because an S3 bucket policy enforces encryption in transit for S3 traffic only, not for RDS traffic; it is irrelevant to RDS connectivity. Option D is wrong because an AWS Transit Gateway is used to route traffic between VPCs and on-premises networks, not to enforce encryption; it does not provide any encryption of data in transit between clients and RDS.