Knowledge + Practice

CCNA Infrastructure Security Questions

75 of 76 questions · Page 1/2 · Infrastructure Security topic · Answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?

A.Configure the instances' security group to allow traffic from the ALB's security group.

B.Configure the instances' security group to allow traffic from the client's source IP addresses.

C.Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.

D.Assign an IAM role to the instances that allows traffic only from the ALB.

AnswerA

This ensures only traffic that passes through the ALB can reach the instances.

Why this answer

Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.

Exam trap

The trap here is that candidates often confuse network ACLs (stateless, IP-based) with security groups (stateful, group-based) and mistakenly choose option C, not realizing that security group referencing is the correct and more secure method for this scenario.

How to eliminate wrong answers

Option B is wrong because allowing traffic from client source IP addresses would permit direct access to the EC2 instances, bypassing the ALB and defeating the purpose of restricting traffic to only the ALB. Option C is wrong because network ACLs are stateless and operate at the subnet level; they cannot reference security groups and would require manual management of ALB private IP addresses, which can change over time. Option D is wrong because IAM roles control API-level permissions for AWS services, not network traffic; they cannot filter or allow inbound traffic to EC2 instances.

Practice this question →

2

MCQmedium

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all Amazon S3 buckets created by CloudFormation are encrypted by default. Which approach should be taken?

A.Configure an IAM policy that requires all S3 operations to use encryption.

B.Set a bucket policy in the CloudFormation template that denies all actions unless encryption is enabled.

C.Enable AWS Config rule s3-bucket-server-side-encryption-enabled to enforce encryption.

D.Use a bucket policy with a condition that denies s3:PutObject if the x-amz-server-side-encryption header is not present.

AnswerD

This policy enforces encryption on object uploads.

Why this answer

A bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to the bucket must include encryption headers. This enforces server-side encryption at the object level, which is the most direct way to guarantee encryption for all objects placed into S3 buckets created by CloudFormation.

Exam trap

The trap here is that candidates often confuse bucket-level default encryption (which can be overridden by individual requests) with object-level enforcement via bucket policy conditions, leading them to choose AWS Config rules or IAM policies that do not guarantee encryption on every object upload.

How to eliminate wrong answers

Option A is wrong because an IAM policy that requires all S3 operations to use encryption applies to the IAM user or role, not to the S3 bucket itself, and does not enforce encryption on objects uploaded by other principals or services. Option B is wrong because a bucket policy that denies all actions unless encryption is enabled would block legitimate operations that do not involve encryption headers, such as listing buckets or reading metadata, and is overly broad. Option C is wrong because an AWS Config rule like s3-bucket-server-side-encryption-enabled only checks whether the bucket has default encryption configured, but does not enforce encryption on individual object uploads, which can bypass default encryption if the request specifies otherwise.

Practice this question →

3

MCQhard

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is configured to terminate SSL/TLS and forward traffic to the instances over HTTP. The security team wants to ensure that the instances only accept traffic from the ALB, not from any other source. How can this be achieved?

A.Configure the instance security group to allow HTTP traffic only from the VPC CIDR block.

B.Configure the instance security group to allow HTTP traffic only from the ALB's security group.

C.Configure the network ACL on the instance's subnet to allow HTTP traffic only from the ALB's private IP address.

D.Configure the instance security group to allow HTTP traffic only from the subnet CIDR block where the ALB resides.

AnswerB

Referencing the ALB's security group as the source in the instance security group rule limits inbound HTTP to traffic originating from the elastic network interfaces that actually belong to the ALB nodes. This SG-to-SG association follows the ALB as it scales or replaces its ENIs across Availability Zones, because any ENI that is a member of the ALB security group is automatically allowed. It is the recommended, least-privilege approach for placing an EC2 instance behind an Application Load Balancer.

Why this answer

Referencing the ALB's security group in the instance security group rule allows traffic only from the ALB, regardless of the ALB's IP address changes. This leverages AWS security group referencing, which is a managed and scalable way to restrict traffic to a specific source security group. The ALB's security group acts as a logical identifier, ensuring that only traffic forwarded by the ALB reaches the instances.

Exam trap

The trap here is that candidates often confuse security group referencing with IP-based rules, mistakenly thinking that using the ALB's subnet CIDR or VPC CIDR is sufficient, when in fact those approaches allow traffic from any resource in those ranges, not just the ALB.

How to eliminate wrong answers

Option A is wrong because allowing HTTP traffic from the entire VPC CIDR block would permit any resource within the VPC (including compromised instances or unauthorized services) to directly access the instances, bypassing the ALB. Option C is wrong because network ACLs are stateless and operate at the subnet level, not the instance level; they cannot restrict traffic based on the ALB's private IP address reliably since ALB IPs can change, and they would require managing both inbound and outbound rules, which is less secure and more complex than security group referencing. Option D is wrong because allowing traffic from the subnet CIDR block where the ALB resides would permit any resource in that subnet (including other instances or services) to access the instances, not just the ALB itself.

Practice this question →

4

Multi-Selecthard

A company has a VPC with a single public subnet and a single private subnet. The private subnet contains an RDS MySQL database that should not be accessible from the internet. The public subnet contains a bastion host that is used for SSH access to the database instance. The security team wants to ensure that the database can only be accessed from the bastion host. Which two security group rules should be configured? (Choose TWO.)

Select 2 answers

A.Database security group: Allow inbound MySQL from the public subnet CIDR.

B.Database security group: Allow inbound MySQL from the bastion security group.

C.Bastion security group: Allow inbound SSH from a limited corporate IP range.

D.Database security group: Allow inbound MySQL from 0.0.0.0/0.

E.Bastion security group: Allow inbound SSH from 0.0.0.0/0.

AnswersB, C

This restricts database access to the bastion.

Why this answer

Options B and C are correct. The database security group should allow inbound MySQL from the bastion security group (option B), ensuring only the bastion can access the database. The bastion security group should allow inbound SSH only from a limited corporate IP range (option C) to restrict administrative access.

Option A is incorrect because allowing inbound MySQL from the public subnet CIDR would permit any instance in that subnet, not just the bastion. Option D is incorrect as it allows MySQL from the entire internet. Option E is incorrect because it allows SSH from any IP, which is insecure.

Practice this question →

5

MCQeasy

A company wants to block SSH access (port 22) to all EC2 instances from the internet, but allow SSH from a specific management VPN IP range (10.0.0.0/16). Which configuration should be used?

A.Configure a security group to allow inbound SSH from 10.0.0.0/16 only.

B.Use an IAM policy to restrict SSH access to the management IP range.

C.Configure a network ACL to allow inbound SSH from 10.0.0.0/16 and deny from 0.0.0.0/0.

D.Configure a security group to allow inbound SSH from 0.0.0.0/0 and deny from 10.0.0.0/16.

AnswerA

A security group acts as a stateful instance-level firewall with an implicit deny-all for inbound traffic, so configuring a rule that allows inbound TCP port 22 from only 10.0.0.0/16 satisfies the requirement. Because security groups only contain permissive rules, any SSH connection sourced outside that CIDR is automatically blocked by the default deny, without needing an explicit deny. This approach also automatically allows return traffic for established sessions due to statefulness, so no separate outbound rule is required.

Why this answer

Security groups are stateful firewalls that control inbound and outbound traffic at the instance level. By configuring a security group to allow inbound SSH (port 22) only from the management VPN IP range (10.0.0.0/16), all other inbound traffic on port 22 is implicitly denied because security groups operate on a default-deny principle. This meets the requirement to block SSH from the internet while permitting access from the specified internal range.

Exam trap

The trap here is that candidates often confuse the stateless nature of network ACLs with the stateful behavior of security groups, leading them to choose a network ACL solution (Option C) without considering the need for explicit outbound rules, or they incorrectly think security groups can deny specific IP ranges (Option D).

How to eliminate wrong answers

Option B is wrong because IAM policies control permissions for AWS API actions (e.g., ec2:AuthorizeSecurityGroupIngress), not network traffic at the packet level; they cannot filter SSH connections to EC2 instances. Option C is wrong because network ACLs are stateless and require explicit inbound and outbound rules; allowing inbound SSH from 10.0.0.0/16 and denying from 0.0.0.0/0 would work for inbound traffic, but the outbound return traffic must also be explicitly allowed, and the question asks for a configuration that blocks SSH from the internet—security groups are the simpler, correct choice for instance-level control. Option D is wrong because security groups only support allow rules; you cannot explicitly deny traffic from a specific IP range within a security group, and allowing from 0.0.0.0/0 would permit SSH from the internet, which contradicts the requirement.

Practice this question →

6

MCQhard

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

A.The network ACL allows inbound SSH from 0.0.0.0/0

B.The security group rule is being overridden by a more restrictive security group attached to the same instance

C.The security group rule is being evaluated but the instance's operating system firewall is blocking SSH

D.The network ACL denies inbound SSH from all IPs except the specific IP

AnswerD

Network ACLs are stateless and can explicitly deny traffic. If the NACL denies SSH from all IPs except the specific one, it would override the permissive security group rule, explaining why only that IP can connect.

Why this answer

A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction.

Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Practice this question →

7

MCQmedium

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?

A.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}

B.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}

C.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}

D.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}

AnswerA

This condition restricts access to traffic coming through the specified VPC endpoint.

Why this answer

It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.

Exam trap

The trap here is that candidates often confuse `aws:SourceVpc` with `aws:SourceVpce` or mistakenly use IP-based conditions like `aws:SourceIp` or `aws:VpcSourceIp`, not realizing that for S3 bucket policies, the correct condition key to restrict to a specific VPC endpoint is `aws:SourceVpce`, and that `aws:SourceVpc` is not supported for S3 gateway endpoints.

How to eliminate wrong answers

Option B is wrong because `aws:VpcSourceIp` is not a valid condition key; the correct key for VPC endpoint traffic is `aws:SourceVpce` or `aws:SourceVpc`, not an IP-based condition. Option C is wrong because `aws:SourceVpc` condition key checks the VPC ID of the requester, but this only works for VPC endpoints that support the `aws:SourceVpc` key (e.g., some AWS services), and for S3 gateway endpoints, the `aws:SourceVpc` key is not available; instead, `aws:SourceVpce` must be used to restrict to a specific endpoint. Option D is wrong because `aws:SourceIp` condition key cannot be used to restrict traffic from a VPC endpoint, as the source IP of requests through a VPC endpoint is the private IP of the endpoint's network interface, which is not reliably the same as the VPC's CIDR range, and the condition key `aws:SourceIp` is intended for public IP addresses, not private IPs from VPC endpoints.

Practice this question →

8

MCQmedium

Refer to the exhibit. A security engineer runs the CLI command and receives the output shown. The engineer expects to see flow logs for a specific subnet, but the output shows the resource ID as a VPC. What is the most likely reason?

A.The flow log is not active; it shows ACTIVE, so that's not the issue.

B.The flow log is configured to deliver to CloudWatch, but the log group name is incorrect.

C.The IAM role does not have permissions to deliver logs for subnets.

D.The flow log was created at the VPC level, not at the subnet level.

AnswerD

The resource ID in the flow log output is prefixed with "vpc-", which indicates the flow log was created at the VPC level rather than at the subnet level. As a result, the flow log captures all traffic in the VPC, and the query is not filtering for the specific subnet due to the resource scope. To see subnet-specific flow logs, you must create a separate flow log with the subnet ID as the resource ID.

Why this answer

The output shows the resource ID as a VPC (vpc-xxxx), but the security engineer expected to see flow logs for a specific subnet. This indicates that the flow log was created at the VPC level, not at the subnet level. In AWS, VPC Flow Logs can be created at the VPC, subnet, or network interface level, and the resource ID in the flow log output reflects the level at which the log was configured.

Since the engineer expected subnet-level logs, the most likely reason is that the flow log was created for the entire VPC instead of the specific subnet.

Exam trap

The trap here is that candidates may assume the flow log is misconfigured due to permissions or delivery settings, when the real issue is the scope at which the flow log was created—a common confusion between VPC-level and subnet-level flow logs.

How to eliminate wrong answers

Option A is wrong because the flow log is indeed active (ACTIVE status), so inactivity is not the issue. Option B is wrong because the log group name being incorrect would not cause the resource ID to show a VPC instead of a subnet; it would affect log delivery but not the resource identifier in the output. Option C is wrong because IAM role permissions for delivering logs to CloudWatch are not related to the level (VPC vs. subnet) at which the flow log is created; permissions issues would prevent log delivery entirely, not change the resource ID shown.

Practice this question →

9

MCQhard

A security engineer notices that an Amazon EC2 instance has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. The instance is a bastion host. What is a more secure alternative to this configuration?

A.Change the SSH port to a non-standard port to avoid automated attacks.

B.Restrict the inbound SSH rule to a single IP address from the corporate network.

C.Replace the security group rule with a network ACL that allows SSH from 0.0.0.0/0.

D.Remove the inbound SSH rule and use AWS Systems Manager Session Manager to access the instance.

AnswerD

Removing the inbound SSH rule and using AWS Systems Manager Session Manager closes the port 22 listener entirely, so the instance is not reachable over SSH from the network. Session Manager authenticates the user through IAM, authorizes actions with IAM policies, and sends the interactive shell session over an encrypted channel initiated by the SSM Agent. Sessions can be audited and recorded via S3 or CloudWatch Logs, and you can use a VPC endpoint so traffic never traverses an open internet-facing port. This avoids the need for SSH key management and eliminates brute-force exposure.

Why this answer

AWS Systems Manager Session Manager provides secure, auditable, and keyless shell access to EC2 instances without opening any inbound ports. It uses the AWS Systems Manager agent to initiate an outbound connection to the AWS SSM endpoint over HTTPS (port 443), eliminating the need for a bastion host or any inbound SSH rule. This approach also integrates with AWS Identity and Access Management (IAM) for fine-grained access control and AWS CloudTrail for full session logging.

Exam trap

The trap here is that candidates often think restricting SSH to a single IP (Option B) is the most secure approach, but the exam tests the concept of eliminating inbound access entirely through agent-based outbound-only solutions like Session Manager, which is a key principle of the AWS Well-Architected Framework's security pillar.

How to eliminate wrong answers

Option A is wrong because changing the SSH port to a non-standard port only obscures the service from automated scans but does not prevent targeted attacks or port scanning; it violates security by obscurity principles and is not a secure alternative. Option B is wrong because restricting the inbound SSH rule to a single corporate IP address still leaves the bastion host exposed to SSH vulnerabilities, requires maintaining a bastion host, and does not eliminate the attack surface of an open SSH port. Option C is wrong because replacing the security group rule with a network ACL that allows SSH from 0.0.0.0/0 is actually less secure—network ACLs are stateless and do not provide the same stateful filtering as security groups, and they still expose the instance to inbound SSH traffic from the entire internet.

Practice this question →

10

MCQmedium

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

A.The EC2 instances in this security group cannot initiate outbound connections

B.The EC2 instances cannot receive inbound HTTP traffic

C.The security group allows all outbound traffic by default

D.Outbound traffic is allowed because security groups are stateful

AnswerA

Without outbound rules, all outbound traffic is denied.

Why this answer

A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing.

Option D is wrong because the security group does allow inbound HTTP.

Practice this question →

11

Multi-Selectmedium

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Select 2 answers

A.Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.

B.Disable automated backups to reduce storage costs.

C.Enable Multi-AZ deployment for fault tolerance.

D.Assign a public IP address to the RDS instance for easier access from the internet.

E.Enable encryption at rest using AWS KMS.

AnswersA, E

Network isolation improves security.

Why this answer

Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.

Exam trap

The trap here is that candidates often confuse high availability (Multi-AZ) or cost-saving measures (disabling backups) with security controls, when in fact they do not address confidentiality, integrity, or access control.

Practice this question →

12

MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

A.Use an HTTPS listener on the ALB and configure the target group with HTTPS.

B.Use a TCP listener on the ALB and a TCP target group.

C.Configure security group inbound rules to allow only HTTPS traffic.

D.Use an HTTP listener on the ALB and HTTP on the target group.

AnswerA

HTTPS ensures encryption from ALB to instances.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates assume an HTTPS listener alone encrypts all traffic end-to-end, forgetting that the ALB-to-instance leg must also use HTTPS; otherwise, traffic between the ALB and EC2 instances is in plaintext.

How to eliminate wrong answers

Option B is wrong because a TCP listener and TCP target group operate at Layer 4 and do not provide encryption; they forward raw TCP traffic without TLS/SSL termination or re-encryption. Option C is wrong because security group inbound rules only control access at the network level (allowing or denying traffic based on port/protocol) and do not encrypt traffic; encryption is a function of the protocol (HTTPS/TLS), not security group rules. Option D is wrong because using HTTP on both the listener and target group means traffic is transmitted in plaintext at every hop, with no encryption between the ALB and EC2 instances.

Practice this question →

13

MCQeasy

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no resources can be created in a specific AWS Region except for the us-east-1 Region. Which policy type should the security team use?

A.IAM permissions boundary

B.IAM policy applied to the root user

C.Resource-based policy

D.Service control policy (SCP)

AnswerD

Service control policies are the correct account-level control because they establish permission guardrails that apply to every IAM principal and the root user in all linked accounts within an AWS Organization. An SCP can deny actions using a condition such as aws:RequestedRegion, effectively preventing users from making API calls in designated Regions across the entire organization. SCPs do not grant permissions themselves; they just set the maximum allowed access, and they do not affect the management account, which is an important nuance when designing Region restrictions.

Why this answer

Service control policies (SCPs) are the correct choice because they allow you to centrally control the maximum available permissions for all accounts in an AWS Organization. By applying an SCP that denies all actions in a specific region (except us-east-1), the security team can enforce a region restriction across all member accounts, regardless of any IAM policies attached to users or roles. SCPs do not grant permissions themselves but act as a guardrail that limits what IAM policies can allow.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that a simple IAM policy denying region access can achieve the same result, but SCPs are the only mechanism that can enforce restrictions across all users and roles in multiple accounts within an organization.

How to eliminate wrong answers

Option A is wrong because IAM permissions boundaries set the maximum permissions for an IAM user or role within a single account, but they cannot enforce region restrictions across multiple accounts in an organization. Option B is wrong because an IAM policy applied to the root user only affects the root user of a single account and does not scale to all accounts in the organization; also, AWS recommends against using root user credentials for daily operations. Option C is wrong because resource-based policies are attached to individual resources (e.g., S3 buckets, Lambda functions) and control access to that specific resource, not the ability to create resources in a region across an entire account or organization.

Practice this question →

14

MCQhard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The Security Engineer needs to ensure that traffic between VPCs is inspected by a central network appliance. Which architecture should the Engineer implement?

A.Use Transit Gateway with appliance mode enabled on the attachments to the inspection VPC, and route inter-VPC traffic through the inspection VPC.

B.Use VPC Peering connections between all VPCs and route traffic through the inspection VPC.

C.Place the network appliance in a public subnet of the inspection VPC and use internet gateways for routing.

D.Use Transit Gateway with route tables that point to the network appliance's ENI for all inter-VPC traffic.

AnswerA

Transit Gateway appliance mode on the attachments to the inspection VPC is the correct approach because it enables the Transit Gateway to forward packets to the network appliance even when return traffic would enter through a different attachment or follow a different path. This is critical for stateful appliances that must inspect both directions of a connection. Inter-VPC traffic is routed via TGW route tables to the inspection VPC attachment, and the appliance's ENI is the next hop inside that VPC. Without appliance mode, asymmetric routing could cause the appliance or the Transit Gateway to drop packets.

Why this answer

Enabling appliance mode on the Transit Gateway attachments to the inspection VPC forces the Transit Gateway to preserve the source and destination MAC addresses of packets, ensuring that asymmetric routing does not cause the network appliance to drop traffic. By routing inter-VPC traffic through the inspection VPC, the appliance can inspect all packets, and appliance mode ensures that return traffic is sent back through the same appliance, maintaining stateful inspection.

Exam trap

The trap here is that candidates often assume that simply routing traffic through an inspection VPC via Transit Gateway is sufficient, without understanding that appliance mode is required to prevent asymmetric routing and ensure stateful inspection works correctly.

How to eliminate wrong answers

Option B is wrong because VPC Peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic cannot be routed through a central inspection VPC without creating a full mesh of connections and complex routing. Option C is wrong because placing the appliance in a public subnet with an internet gateway would expose it to the internet and is not designed for private inter-VPC traffic inspection; internet gateways are for internet-bound traffic, not VPC-to-VPC routing. Option D is wrong because simply pointing route tables to the network appliance's ENI does not enable appliance mode; without appliance mode, the Transit Gateway may perform MAC address rewriting, causing asymmetric routing and stateful inspection failures.

Practice this question →

15

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

A.The network ACL for the private subnet is blocking outbound traffic

B.The NAT Gateway's security group is blocking outbound traffic to the internet

C.The private subnet route table does not have a route to the NAT Gateway

D.The security group attached to the EC2 instance is blocking inbound traffic

AnswerB

NAT Gateway's security group must allow outbound HTTPS to 0.0.0.0/0.

Why this answer

The NAT Gateway's security group must allow outbound traffic to the internet for the patches to be retrieved. Even though the NAT Gateway allows inbound HTTPS from the private subnet, it also needs an outbound rule permitting HTTPS traffic to 0.0.0.0/0 so that response packets from the internet can flow back through the NAT Gateway to the instance. Without this outbound rule, the NAT Gateway drops the return traffic, preventing the download.

Exam trap

The trap here is that candidates assume the NAT Gateway only needs inbound rules from the private subnet, forgetting that outbound rules are required for return traffic, or they mistakenly think NAT Gateways cannot have security groups at all.

How to eliminate wrong answers

Option A is wrong because the network ACL for the private subnet is not mentioned as blocking traffic; by default, network ACLs allow all inbound and outbound traffic, and the question does not indicate any custom ACL rules that would block outbound HTTPS. Option C is wrong because the private subnet route table already has a default route (0.0.0.0/0) pointing to the NAT Gateway, so routing to the NAT Gateway is correctly configured. Option D is wrong because the security group attached to the EC2 instance allows outbound HTTPS to 0.0.0.0/0, which is sufficient for the instance to initiate the connection; inbound traffic is not relevant for outbound patch downloads.

Practice this question →

16

MCQmedium

A security engineer notices that an EC2 instance in a private subnet is able to make outbound connections to the internet. The instance does not have a public IP, and there is no NAT gateway or instance in the VPC. What is the most likely cause?

A.The VPC has an egress-only internet gateway for IPv6 traffic.

B.The instance has a public IP assigned automatically via Auto-assign Public IP.

C.The instance is using a VPC endpoint (Gateway type) for S3.

D.The subnet's route table has a default route (0.0.0.0/0) pointing to an internet gateway.

AnswerA

An egress-only internet gateway (EIGW) is an IPv6-specific VPC component that enables instances with IPv6 addresses to initiate outbound connectivity to the internet, but it blocks all inbound connections from the internet. Because an EIGW is completely independent of IPv4 addressing, an instance can reside in a private subnet without a public IPv4 address and still reach the internet via a route table entry for ::/0 pointing to the EIGW. In this scenario, the observed internet access is therefore consistent with the VPC having an egress-only internet gateway for IPv6 traffic.

Why this answer

An egress-only internet gateway (EIGW) allows outbound IPv6 traffic from instances in a private subnet without requiring a public IPv4 address or NAT. Since the instance is making outbound connections to the internet and has no public IP or NAT, and the VPC likely has IPv6 enabled, the EIGW is the most plausible cause. Option D is incorrect because a default route to an internet gateway requires the instance to have a public IPv4 address for return traffic, which contradicts the scenario.

Exam trap

The trap here is that candidates assume a private subnet inherently blocks internet access, but the question tests whether they understand that a subnet's route table—not its public/private designation—determines outbound connectivity, and a 0.0.0.0/0 route to an IGW makes it a public subnet regardless of the instance's IP assignment.

How to eliminate wrong answers

Option A is wrong because an egress-only internet gateway (EIGW) only supports IPv6 traffic, and the question does not mention IPv6; it would not enable outbound IPv4 connections. Option B is wrong because the instance does not have a public IP, and Auto-assign Public IP only applies at launch; even if enabled, the instance would have a public IP, contradicting the premise. Option C is wrong because a VPC Gateway Endpoint for S3 only provides private connectivity to S3, not general internet access; it cannot route traffic to arbitrary internet destinations.

Practice this question →

17

MCQeasy

A Security Engineer needs to block SSH traffic (port 22) from the internet to all EC2 instances in a VPC. Which approach is the most secure and scalable?

A.Add a security group rule to deny inbound traffic on port 22 from 0.0.0.0/0.

B.Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.

C.Add a network ACL rule to allow inbound traffic on port 22 from 0.0.0.0/0 and then add a deny rule for the same traffic.

D.Add a security group rule to block inbound traffic on port 22 from 0.0.0.0/0 at the VPC level.

AnswerB

A network ACL (NACL) is a stateless firewall applied at the subnet level, and it explicitly supports both allow and deny rules. By adding a deny rule for inbound TCP port 22 from 0.0.0.0/0 with a low rule number, you block all SSH traffic from any source from entering the subnet. This is the correct method because security groups cannot provide an explicit deny, and the NACL rule operates at the subnet boundary rather than at individual resources.

Why this answer

Network ACLs (NACLs) are stateless and operate at the subnet level, allowing you to explicitly deny inbound SSH traffic from 0.0.0.0/0. This approach is more secure and scalable than security group rules because NACLs can block traffic before it reaches the instance, and they support explicit deny rules, which security groups do not. Security groups only support allow rules, so you cannot add a deny rule to block SSH traffic; you must omit the allow rule, which is less explicit and can be accidentally overridden.

Exam trap

The trap here is that candidates often confuse security groups with network ACLs, assuming security groups can have explicit deny rules, when in fact only NACLs support deny rules and operate at the subnet level.

How to eliminate wrong answers

Option A is wrong because security groups do not support deny rules; they only support allow rules, so adding a 'deny' rule is syntactically invalid and cannot be implemented. Option C is wrong because NACLs evaluate rules in order by rule number, and an allow rule with a lower number would permit the traffic before a deny rule with a higher number is evaluated, making the deny ineffective; additionally, allowing then denying the same traffic is redundant and not a best practice. Option D is wrong because security groups cannot be applied at the VPC level; they are associated with individual ENIs or instances, not the entire VPC, and they do not support deny rules.

Practice this question →

18

MCQhard

A company is designing a network architecture for a critical application that must meet strict compliance requirements. The application consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The instances need to access an Amazon RDS database in a different VPC. The company wants to minimize exposure to the internet. Which solution should the company use?

A.Use a site-to-site VPN connection between the VPCs.

B.Use a NAT gateway in the database VPC and route traffic through it.

C.Use a VPC Peering connection between the two VPCs.

D.Use an internet gateway and route traffic over the internet with security groups.

AnswerC

A VPC peering connection privately connects two VPCs using AWS's internal backbone, with no traffic traversing the public internet and no need for a public IP address, VPN appliance, or gateway. It creates direct layer-3 route table entries between the VPC CIDRs, and because the relationship is native to AWS, traffic stays isolated from external carriers. For a single application-to-database pair with non-overlapping CIDRs, VPC peering is the simplest and most cost-effective way to establish low-latency private connectivity.

Why this answer

VPC Peering establishes a private, direct network connection between two VPCs using AWS's internal infrastructure, with no exposure to the internet. Traffic stays within the AWS global network, meeting strict compliance requirements for minimizing internet exposure. This allows EC2 instances in the application VPC to communicate with the RDS database in the database VPC securely and with low latency, using private IP addresses.

Exam trap

The trap here is that candidates often confuse VPC Peering with site-to-site VPN, thinking VPN is required for cross-VPC connectivity, but VPC Peering is the correct AWS-native solution for private VPC-to-VPC communication without internet exposure.

How to eliminate wrong answers

Option A is wrong because a site-to-site VPN connection is used to connect an on-premises network to a VPC, not to connect two VPCs within AWS; it would introduce internet exposure (via the VPN tunnel over the public internet) and unnecessary complexity. Option B is wrong because a NAT gateway is designed to allow instances in a private subnet to initiate outbound traffic to the internet, not to enable private communication between two VPCs; routing traffic through a NAT gateway would force traffic over the internet and break the requirement to minimize exposure. Option D is wrong because using an internet gateway and routing traffic over the internet with security groups exposes the traffic to the public internet, violating the compliance requirement to minimize internet exposure; security groups alone cannot prevent the inherent risk of internet-based communication.

Practice this question →

19

Multi-Selectmedium

A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)

Select 2 answers

A.Configure a NAT gateway in the private subnet for the application servers.

B.Place the web servers in a public subnet with a route to an internet gateway.

C.Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.

D.Place the application servers in a public subnet with a route to an internet gateway.

E.Configure the application servers' security group to allow traffic only from the web servers' security group.

AnswersB, E

This allows internet traffic to reach the web servers.

Why this answer

Placing web servers in a public subnet with a route to an internet gateway allows them to receive inbound traffic from the internet. This is the standard AWS design for internet-facing resources, where the subnet's route table directs 0.0.0.0/0 traffic to an internet gateway, enabling direct communication from the internet.

Exam trap

The trap here is that candidates often confuse network ACLs with security groups, incorrectly assuming that a stateless network ACL with IP-based rules is the correct way to restrict traffic between tiers, when in fact security group references provide a more secure and manageable solution.

Practice this question →

20

MCQhard

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

A.Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.

B.Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.

C.Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.

D.Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.

AnswerD

This encrypts both frontend and backend traffic.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates often assume HTTPS on the listener alone is sufficient, overlooking that the target group protocol must also be HTTPS to encrypt traffic between the ALB and instances, not just between clients and the ALB.

How to eliminate wrong answers

Option A is wrong because using HTTP on both the listener and target group means traffic is in plaintext, violating the encryption requirement. Option B is wrong because while the listener uses HTTPS, the target group uses HTTP, so traffic between the ALB and EC2 instances is unencrypted, which does not meet the requirement. Option C is wrong because TCP protocol at the listener and target group does not provide application-layer encryption; SSL certificates on EC2 instances alone do not encrypt traffic without HTTPS configuration on the target group.

Practice this question →

21

Multi-Selecthard

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Select 2 answers

A.Deploy an HTTP forward proxy in the public subnet.

B.Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.

C.Set up a transit gateway and attach the VPC to it.

D.Create a gateway endpoint for Amazon S3.

E.Place the NAT device in a public subnet with a route to an internet gateway.

AnswersB, E

This routes outbound traffic from private subnets to the NAT device.

Why this answer

To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose.

Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.

Practice this question →

22

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to inspect all traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

A.Set up AWS Direct Connect and route all traffic through the on-premises firewall.

B.Use Transit Gateway with appliance mode and route tables to direct traffic through a firewall appliance in a central VPC.

C.Create VPC peering connections between each VPC and the firewall VPC.

D.Configure network ACLs in each VPC to block traffic unless it comes from the firewall.

AnswerB

Transit Gateway with appliance mode enables asymmetric routing support, allowing a gateway route table to forward traffic from source VPCs to the central inspection VPC, while the firewall appliance then routes return traffic back through the same appliance, ensuring both directions are inspected. By using separate route tables associated with each VPC attachment, you can force all inter-VPC and outbound traffic through the firewall appliance, which scales horizontally and keeps security inspection centralized.

Why this answer

Transit Gateway with appliance mode enables the firewall appliance in a central VPC to receive traffic from all attached VPCs with symmetric routing, ensuring that both forward and return traffic flows through the same appliance. By configuring route tables to direct inter-VPC traffic to the firewall appliance's elastic network interface (ENI), the security team can inspect all traffic without requiring complex peering or on-premises backhauling.

Exam trap

The trap here is that candidates may assume VPC peering or network ACLs can achieve transitive traffic inspection, but they fail to recognize that only Transit Gateway with appliance mode provides the necessary symmetric routing and transitive routing capabilities for centralized firewall inspection.

How to eliminate wrong answers

Option A is wrong because routing all traffic through an on-premises firewall via AWS Direct Connect introduces unnecessary latency, bandwidth costs, and dependency on the on-premises network, which is not a native AWS architecture for VPC-to-VPC inspection. Option C is wrong because VPC peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic between two VPCs would not automatically flow through a third-party firewall VPC unless complex routing and additional appliances are manually configured, making it unscalable. Option D is wrong because network ACLs are stateless and operate at the subnet level, not at the traffic inspection layer; they cannot force traffic through a firewall appliance or provide deep packet inspection, and blocking traffic based on source IP alone is insufficient for security policy enforcement.

Practice this question →

23

MCQhard

Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?

A.The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.

B.The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.

C.The security group allows outbound all traffic, which violates the principle of least privilege.

D.The instance type t2.micro is not available in the specified subnet's Availability Zone.

AnswerA

Incorrect. SCPs cannot deny actions based on the content of security group rules (e.g., permissiveness). They can only deny based on resource identifiers like security group IDs.

Why this answer

The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive.

The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.

Exam trap

Candidates often assume 'UnauthorizedOperation' always indicates missing IAM permissions, but SCPs can cause this error even when the user has explicit Allow, due to an explicit deny on specific resources or conditions.

How to eliminate wrong answers

Option B is wrong because allowing inbound HTTPS from RFC 1918 address space (private IPs) is not inherently problematic and would not trigger an 'UnauthorizedOperation' error; the error is about authorization, not subnet placement. Option C is wrong because outbound all traffic is a default security group setting and does not violate the principle of least privilege in a way that would cause an 'UnauthorizedOperation' error; SCPs typically focus on inbound rules for overly permissive access. Option D is wrong because t2.micro is a standard instance type available in most Availability Zones; if it were unavailable, the error would be 'InsufficientInstanceCapacity' or 'InvalidParameterValue', not 'UnauthorizedOperation'.

Practice this question →

24

Multi-Selectmedium

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Select 2 answers

A.Create a bastion host in the public subnet and configure the web server to use it as a proxy.

B.Create a VPC endpoint for Amazon S3.

C.Create a NAT Gateway in the public subnet.

D.Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

E.Add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway.

AnswersC, E

NAT Gateway enables outbound internet access for instances in private subnets.

Why this answer

A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with a bastion host or assume that a VPC endpoint for S3 can provide general internet access, but the key distinction is that a NAT Gateway enables outbound internet connectivity for private subnets without exposing them to inbound traffic.

Practice this question →

25

MCQeasy

A company wants to restrict access to an Amazon S3 bucket so that only users from a specific AWS account can upload objects. Which policy mechanism should be used?

A.Create a bucket policy with a condition that checks the aws:SourceAccount condition key.

B.Attach an IAM policy to the bucket that denies access to all users except those from the allowed account.

C.Generate a pre-signed URL for each upload request.

D.Configure the bucket ACL to grant access only to the allowed account's canonical user ID.

AnswerA

A bucket policy with an aws:SourceAccount condition key evaluates the account ID of the IAM principal that signs the request and is enforced by S3 when the bucket is accessed. This condition is evaluated against the requester's account number, allowing you to allow or deny access based on that account without specifying individual user ARNs. It is the recommended approach because it uses a resource-based policy that directly supports condition keys, and it ensures all requests from unintended accounts are rejected.

Why this answer

A bucket policy with the `aws:SourceAccount` condition key allows you to restrict access to a specific AWS account. When users from the allowed account upload objects, the condition evaluates the source account ID, ensuring only requests originating from that account are permitted. This is the recommended approach for cross-account access control in S3, as it directly enforces the account-level restriction at the bucket policy level.

Exam trap

The trap here is that candidates confuse IAM policies with resource-based policies, thinking an IAM policy can be attached to an S3 bucket, or they mistakenly believe bucket ACLs or pre-signed URLs can enforce account-level restrictions.

How to eliminate wrong answers

Option B is wrong because IAM policies are attached to IAM users, groups, or roles, not directly to S3 buckets; you cannot attach an IAM policy to a bucket. Option C is wrong because pre-signed URLs grant temporary access to specific objects for any user with the URL, regardless of AWS account, and do not restrict uploads to a specific account. Option D is wrong because bucket ACLs are legacy and do not support account-level restrictions based on AWS account IDs; they use canonical user IDs, which are not the same as AWS account IDs and are less flexible for cross-account control.

Practice this question →

26

MCQmedium

A security engineer sees the above security group configuration for an EC2 instance. The instance hosts a web application that should only be accessible from the internal network (10.0.0.0/8) over HTTPS, and SSH should not be open to the internet. What is the security issue with this configuration?

A.The outbound rule allows all traffic to all destinations.

B.The inbound HTTPS rule is too permissive.

C.The inbound SSH rule is too permissive.

D.There is no security issue; the configuration is correct.

AnswerA

The outbound rule is defined as allowing all traffic to 0.0.0.0/0, meaning any instance associated with this security group can initiate connections to any IP address on any port. This violates the principle of least privilege because if an attacker compromises the instance, they could use it as a pivot to exfiltrate sensitive data or launch outbound attacks. Even though inbound HTTPS may also be overly broad, the outbound any-any rule is a critical misconfiguration because it provides no egress filtering or restrictions to required services.

Why this answer

The outbound rule allowing all traffic to all destinations (0.0.0.0/0) violates the principle of least privilege. While the inbound rules restrict HTTPS to the internal network (10.0.0.0/8) and SSH is not open to the internet, the outbound rule permits any instance in the security group to initiate connections to any IP address and port, including malicious external hosts. This could allow data exfiltration or outbound attacks, which is a security issue even if inbound access is properly restricted.

Exam trap

The trap here is that candidates focus solely on inbound rules (HTTPS and SSH) and overlook the outbound rule, assuming that stateful security groups automatically handle outbound traffic safely, but AWS explicitly tests that outbound rules must also be restricted to follow least privilege.

How to eliminate wrong answers

Option B is wrong because the inbound HTTPS rule is correctly scoped to the internal network (10.0.0.0/8), which aligns with the requirement that the web application should only be accessible from the internal network. Option C is wrong because the inbound SSH rule is not open to the internet (0.0.0.0/0) in the provided configuration; it is restricted to the internal network (10.0.0.0/8), so it is not too permissive. Option D is wrong because the outbound rule is overly permissive, creating a security risk that makes the configuration incorrect.

Practice this question →

27

Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Select 3 answers

A.AWS WAF attached to the NAT gateway.

B.An internet gateway attached to the VPC.

C.Route tables in the private subnets with a default route (0.0.0.0/0) pointing to the NAT gateway.

D.A VPC gateway endpoint for S3.

E.A NAT gateway in a public subnet.

AnswersB, C, E

The internet gateway provides internet access for the public subnet where the NAT gateway resides.

Why this answer

An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.

Exam trap

The trap here is that candidates often think a NAT gateway alone provides internet access, forgetting that the NAT gateway must be placed in a public subnet with a route to an internet gateway, and that the private subnet’s default route must point to the NAT gateway, not the IGW.

Practice this question →

28

MCQhard

A security engineer is reviewing the following IAM policy attached to an S3 bucket: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*", "Condition": { "IpAddress": { "aws:SourceIp": "10.0.0.0/8" } } } ] } The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

A.The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

B.The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.

C.The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

D.The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.

AnswerB

The policy sets Principal to '*' in a bucket policy, which means every principal—including unauthenticated anonymous users—is included in the scope of the statement. The condition on aws:SourceIp narrows the network source to a specific IP CIDR, but it does not require any AWS credentials, identity, or account relationship. As a result, any person or service whose traffic originates from that IP range can read objects in the bucket, making the bucket effectively public to that entire network.

Why this answer

The bucket policy uses `"Principal": "*"` combined with `"Effect": "Allow"`, which explicitly grants public access to anyone who meets the condition. While the condition restricts access to the `10.0.0.0/8` IP range, the policy itself is still a public bucket policy — it allows any authenticated or unauthenticated user from that IP range to read objects. This violates the principle of least privilege and exposes sensitive data to any user on the corporate network, not just authorized IAM roles or users.

Exam trap

The trap here is that candidates focus on the IP restriction condition and assume it makes the policy secure, overlooking the fact that `"Principal": "*"` still makes the bucket publicly accessible to any user within that IP range, which is a direct violation of AWS shared responsibility and least privilege principles.

How to eliminate wrong answers

Option A is wrong because the default behavior of IAM and S3 bucket policies is to deny all access unless explicitly allowed; there is no 'default allow' that would permit requests outside the IP range — the policy simply does not grant access to IPs outside `10.0.0.0/8`, so they are implicitly denied. Option C is wrong because the `aws:SourceIp` condition key correctly evaluates the source IP of the request, and while proxies can alter the perceived IP, the condition still works as intended for direct requests; the concern about proxy IPs is a valid operational consideration but not the primary security flaw of this policy. Option D is wrong because the lack of `s3:ListBucket` does not create a security vulnerability — it only prevents listing objects, which is a separate access control concern, and the policy's primary issue is granting public access to sensitive data.

Practice this question →

29

MCQeasy

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which security mechanism should be used?

A.Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.

B.Assign an IAM role to the S3 bucket.

C.Attach a security group to the S3 bucket.

D.Configure a network ACL on the VPC subnet to allow traffic to S3.

AnswerA

A bucket policy can use the aws:SourceVpce condition key to restrict access to a specific VPC endpoint. This allows only traffic that arrives through the corresponding gateway or interface endpoint to reach the bucket, while all other sources, including the public internet, are denied. This resource-based control is the correct way to enforce VPC-only access to an S3 bucket.

Why this answer

An S3 bucket policy can include a condition that restricts access to traffic originating from a specific VPC endpoint. By using the `aws:SourceVpce` condition key, the policy ensures that only requests coming through the specified VPC endpoint (interface or gateway) are allowed to read objects, effectively locking down access to the VPC.

Exam trap

The trap here is that candidates often confuse network-level controls (security groups, NACLs) with resource-based policies, mistakenly thinking they can apply security groups or NACLs to S3 buckets, when in fact S3 only supports bucket policies and IAM policies for access control.

How to eliminate wrong answers

Option B is wrong because IAM roles are assigned to principals (users, services) to grant permissions, not to S3 buckets; buckets themselves cannot assume roles. Option C is wrong because security groups are network-level firewalls for EC2 instances and other AWS resources, but S3 buckets are not network interfaces and cannot have security groups attached. Option D is wrong because network ACLs control traffic at the subnet level and cannot restrict access to a specific S3 bucket; they also cannot enforce bucket-level conditions like VPC endpoint IDs.

Practice this question →

30

MCQhard

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: - All EC2 instances are launched in private subnets. - The IAM roles used by EC2 instances follow the principle of least privilege. - Security groups restrict inbound and outbound traffic. - AWS Systems Manager Patch Manager is used to patch instances. - AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. - Amazon GuardDuty is enabled. Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

A.Enable VPC Flow Logs to monitor traffic to S3.

B.Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.

C.Deploy AWS WAF in front of the S3 bucket.

D.Create an AWS Config rule to detect S3 access from EC2 instances.

AnswerB

Creating an S3 VPC endpoint and attaching a bucket policy that denies all access unless the request originates from that endpoint confines S3 traffic to the AWS internal network, removing exposure to the public internet. This, combined with replacing SSH with AWS Systems Manager Session Manager, eliminates inbound SSH ports and relies on IAM-based, auditable session access instead of static keys. Together, these controls shrink the attack surface and provide preventive, policy-enforced protection against both network-level exfiltration and credential compromise.

Why this answer

Using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.

Exam trap

The trap here is that candidates may choose VPC Flow Logs (Option A) thinking it provides active protection, but it is only a monitoring tool that does not reduce the blast radius; the key is to implement network-level and access-level restrictions that prevent data exfiltration even if an instance is compromised.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs only provide visibility into traffic patterns and do not actively limit the blast radius or prevent data exfiltration. Option C is wrong because AWS WAF is a web application firewall designed to protect web-facing resources like ALB or CloudFront, not S3 buckets directly; it cannot restrict access from EC2 instances to S3. Option D is wrong because an AWS Config rule is a detective control that can detect non-compliant access after it occurs, but it does not proactively limit the blast radius or prevent exfiltration in real time.

Practice this question →

31

Multi-Selectmedium

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Select 3 answers

A.VPN connection

B.Internet gateway

C.Security groups

D.Network ACLs

E.VPC Flow Logs

AnswersC, D, E

Instance-level firewall.

Why this answer

Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Exam trap

The trap here is that candidates often confuse connectivity components (VPN, Internet gateway) with security controls, or they overlook that VPC Flow Logs are a detective control (not preventive) but still a valid part of defense in depth, leading them to select A or B instead of the correct trio of security groups, network ACLs, and VPC Flow Logs.

Practice this question →

32

Multi-Selecthard

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Select 2 answers

A.Use AWS KMS to encrypt the traffic.

B.Use AWS Certificate Manager to issue certificates for the connection.

C.Enable MACsec on the Direct Connect connection.

D.Use SSL/TLS to encrypt the traffic between on-premises and AWS.

E.Establish an IPsec VPN tunnel over the Direct Connect connection.

AnswersC, E

MACsec provides encryption at the data link layer.

Why this answer

MACsec (IEEE 802.1AE) provides encryption at Layer 2 (data link layer) and can be enabled directly on a Direct Connect connection. This encrypts all traffic between the on-premises router and the AWS Direct Connect endpoint without requiring any changes to higher-layer protocols, making it transparent to applications.

Exam trap

The trap here is that candidates often assume encryption must happen at higher layers (like SSL/TLS) or through a separate service (like KMS), but the exam tests knowledge of Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec over Direct Connect) as the two valid methods to encrypt traffic over a Direct Connect connection.

Practice this question →

33

MCQhard

A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?

A.Launch a proxy server in a public subnet and configure the application to use the proxy.

B.Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.

C.Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.

D.Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.

AnswerB

A VPC endpoint for Amazon S3 (a gateway endpoint) allows resources in private subnets to access S3 using private IP addresses with traffic staying entirely within the AWS network, without any internet gateway, NAT device, or VPN connection. Since patches are stored in S3 buckets, the application can retrieve patch files directly over the endpoint, and an endpoint for DynamoDB can handle patch metadata or state tables. This satisfies the no-internet-route requirement while enabling secure patch downloads.

Why this answer

It uses VPC endpoints for Amazon S3 (and optionally DynamoDB) to provide private connectivity to AWS services without requiring an internet gateway. By storing the security patches in an S3 bucket with a custom domain alias (e.g., patches.example.com), the application can download patches through the VPC endpoint, meeting the requirement of no internet route and minimizing operational overhead. Options A and D require an internet gateway, which creates a route to the internet.

Option C does not provide access to an external domain like patches.example.com.

Exam trap

Candidates may assume that AWS Systems Manager Patch Manager can download patches from any external domain via VPC endpoints, but SSM endpoints only provide private access to AWS services, not arbitrary external domains. The correct approach is to store patches in an AWS service like S3 and use a VPC endpoint.

How to eliminate wrong answers

Option A is wrong because launching a proxy server in a public subnet requires the VPC to have an internet gateway and a route to the internet, which violates the requirement that the VPC must not have a route to the internet. Option B is wrong because VPC endpoints for Amazon S3 and DynamoDB are designed for accessing those specific AWS services, not for downloading patches from an external domain like patches.example.com; they cannot route traffic to arbitrary internet destinations. Option D is wrong because deploying a NAT gateway in a public subnet requires the VPC to have an internet gateway attached to the public subnet, which again creates a route to the internet, directly contradicting the requirement.

Practice this question →

34

Multi-Selecthard

A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)

Select 3 answers

A.Take a snapshot of the unencrypted instance, copy it with encryption, and restore.

B.Modify the DB instance to enable encryption after creation.

C.Create a read replica with encryption enabled, even if the source is unencrypted.

D.Enable encryption on an existing read replica of an encrypted source.

E.Enable encryption when creating the DB instance.

AnswersA, D, E

This is a valid method to encrypt an existing database.

Why this answer

You can take a snapshot of an unencrypted Amazon RDS for MySQL DB instance, create an encrypted copy of that snapshot, and then restore a new DB instance from the encrypted snapshot. This process effectively encrypts the data at rest, as the restored instance will inherit the encryption setting from the snapshot. AWS RDS does not allow enabling encryption on an existing unencrypted DB instance directly, so this snapshot-based approach is the standard workaround.

Exam trap

The trap here is that candidates assume you can enable encryption on an existing RDS instance via a simple modification (Option B), but AWS explicitly prohibits this, requiring a snapshot-based migration instead.

Practice this question →

35

MCQeasy

A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?

A.AWS CloudHSM

B.AWS Certificate Manager (ACM)

C.AWS Key Management Service (AWS KMS)

D.AWS Secrets Manager

AnswerC

AWS Key Management Service (AWS KMS) is a fully managed service that centralizes the creation, storage, rotation, and deletion of customer master keys (CMKs). S3 integrates with KMS through server-side encryption (SSE-KMS), where S3 uses a KMS key to encrypt each object's data key automatically and enforces IAM policies on key usage. This gives you centralized control, auditability through CloudTrail, and seamless S3 encryption, making KMS the correct and standard service for encrypting data at rest in S3.

Why this answer

AWS Key Management Service (AWS KMS) is the correct service because it is a fully managed, centralized service that allows you to create, manage, and control the encryption keys used to encrypt data at rest in Amazon S3. S3 integrates directly with KMS via Server-Side Encryption with AWS KMS (SSE-KMS), enabling you to use customer managed keys (CMKs) or AWS managed keys to enforce granular access control and audit key usage through AWS CloudTrail.

Exam trap

The trap here is that candidates often confuse AWS CloudHSM with KMS because both involve encryption keys, but CloudHSM is a hardware-based key storage service that lacks native integration with S3 for centralized key management, whereas KMS is the intended service for SSE-KMS.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) for generating and storing keys, but it does not centrally manage encryption keys for S3; it requires manual integration and does not offer native S3 encryption key management. Option B is wrong because AWS Certificate Manager (ACM) is designed to provision, manage, and deploy public and private SSL/TLS certificates for network encryption, not for managing encryption keys for data at rest in S3. Option D is wrong because AWS Secrets Manager is used to securely store and rotate secrets such as database credentials and API keys, not to centrally manage encryption keys for S3 server-side encryption.

Practice this question →

36

MCQhard

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?

A.The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.

B.The NAT gateway does not have an Elastic IP address assigned.

C.The security group for the NAT gateway does not allow inbound traffic from the private subnets.

D.The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.

AnswerA

For instances in a private subnet to reach the internet through a NAT gateway, the subnet's route table must have a default route (0.0.0.0/0) with the NAT gateway as the target. If this route is missing, any outbound internet-bound traffic has no valid next hop and is dropped, causing the connectivity failure. After adding this route, ensure the NAT gateway itself is in a public subnet with an associated Elastic IP and that the public subnet's route table points 0.0.0.0/0 to an internet gateway. This is the most direct and common cause when private instances cannot access the internet.

Why this answer

The most likely cause is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from private instances cannot reach the NAT gateway, and thus cannot access the internet. Option B is incorrect because a NAT gateway must have an Elastic IP assigned during creation, so it would not be missing.

Option C is incorrect because NAT gateways do not have security groups; they are managed by AWS and the security group concept does not apply. Option D is incorrect because network ACLs are stateless and must allow both inbound and outbound traffic, but the issue here is more likely with routing.

Exam trap

The trap is that the engineer focuses on a non-existent security group for the NAT gateway, while the real issue is the missing default route in the private subnet's route table. Candidates may incorrectly assume security groups apply to NAT gateways or overlook the route table configuration.

How to eliminate wrong answers

Option A is wrong because it is actually the most likely cause of the issue—the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway for internet access; without it, traffic cannot be directed to the NAT gateway. Option B is wrong because a NAT gateway requires an Elastic IP address to function; if it were missing, the NAT gateway would not be provisioned correctly, but the question states the NAT gateway is set up, implying an EIP is assigned. Option D is wrong because network ACLs are stateless and must allow both inbound and outbound traffic for ephemeral ports; however, the private subnet's network ACL typically allows outbound HTTP/HTTPS by default, and inbound traffic from the internet is not required for instances initiating outbound connections.

Practice this question →

37

MCQmedium

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } ] } Which step should be taken to secure the bucket while maintaining access for authorized users?

A.Use AWS Config to automatically block all public access.

B.Create an IAM role with S3 access and assign it to the bucket.

C.Add a Deny statement for any IP address outside the corporate network.

D.Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.

AnswerD

Restricts access to the VPC endpoint.

Why this answer

Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible.

Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Practice this question →

38

MCQhard

A company is designing a shared services VPC architecture with multiple VPCs connected via a transit gateway. The security engineer needs to ensure that all traffic between VPCs is inspected by a centralized firewall appliance deployed in the shared services VPC. What configuration is required?

A.Create VPC peering connections between each VPC and the shared services VPC.

B.Configure transit gateway route tables to route all inter-VPC traffic through the firewall appliance.

C.Use security groups to route traffic through the firewall.

D.Deploy a Gateway Load Balancer (GWLB) in the shared services VPC and register the firewall as a target.

AnswerB

A transit gateway with carefully designed route tables is the standard way to enforce centralized inspection: attach all VPCs to the transit gateway, then configure a route in each spoke VPC's propagation that sends inter-VPC destination CIDRs to the firewall appliance's elastic network interface in the shared services VPC. The firewall inspects and forwards the traffic back to the transit gateway, which delivers it to the destination VPC. This enables deterministic, high-availability routing through the security appliance.

Why this answer

A transit gateway can use separate route tables to control traffic flow. By configuring the transit gateway route tables to point the default route (0.0.0.0/0) or specific inter-VPC CIDR ranges to a network interface of the centralized firewall appliance in the shared services VPC, all traffic between VPCs is forced through the firewall for inspection. This design ensures that the firewall acts as a central inspection point without requiring VPC peering or complex routing.

Exam trap

The trap here is that candidates often confuse the role of a Gateway Load Balancer (GWLB) with routing, assuming that deploying a GWLB alone will automatically route traffic through the firewall, when in fact the transit gateway route tables must be explicitly configured to direct traffic to the GWLB endpoint or the firewall ENI.

How to eliminate wrong answers

Option A is wrong because VPC peering connections do not support transitive routing; each peering connection is a one-to-one link, so traffic between two peered VPCs cannot be routed through a third VPC without additional complex routing and would not force inspection through the firewall. Option C is wrong because security groups are stateful virtual firewalls that control traffic at the instance level based on rules, not routing; they cannot route traffic through a separate appliance or enforce traffic inspection paths. Option D is wrong because a Gateway Load Balancer (GWLB) is used to distribute traffic to a fleet of third-party appliances (e.g., firewalls) for inline inspection, but it does not by itself route inter-VPC traffic through the firewall; the transit gateway route tables must still be configured to direct traffic to the GWLB endpoint, making this an incomplete solution without the correct routing configuration.

Practice this question →

39

MCQhard

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

A.Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.

B.Inbound rule: Allow HTTP/HTTPS from the ALB's security group.

C.Outbound rule: Allow all traffic to the ALB's security group only.

D.Outbound rule: Deny all traffic to 0.0.0.0/0.

E.Outbound rule: Allow all traffic to 0.0.0.0/0.

AnswerB, D

This ensures only ALB traffic reaches the instances.

Why this answer

Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.

Exam trap

The trap here is that candidates often confuse stateful security group behavior with stateless network ACLs, mistakenly thinking that a deny-all outbound rule will block return traffic for inbound connections, or they incorrectly assume that allowing outbound traffic to the ALB's security group is sufficient to prevent internet access.

How to eliminate wrong answers

Option A is wrong because allowing HTTP/HTTPS from 0.0.0.0/0 would permit direct internet traffic to the EC2 instances, bypassing the ALB and violating the security requirement. Option C is wrong because outbound rules in security groups are stateful; allowing traffic to the ALB's security group is unnecessary and does not prevent outbound internet connections—stateful return traffic is automatically allowed, but outbound-initiated traffic to the internet would still be permitted unless explicitly denied. Option E is wrong because allowing all outbound traffic to 0.0.0.0/0 would permit instances to initiate outbound connections to the internet, directly contradicting the requirement.

Practice this question →

40

MCQhard

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

A.Create an Interface VPC Endpoint for S3.

B.Create a Gateway VPC Endpoint for S3 and update the route table.

C.Route the traffic through a NAT Gateway to the internet.

D.Assign a public IP address to the EC2 instance and allow it to access S3 via internet.

AnswerB

Private and secure access to S3.

Why this answer

A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.

Exam trap

The trap here is that candidates often confuse Interface VPC Endpoints (which are required for most AWS services) with Gateway VPC Endpoints (which are only for S3 and DynamoDB), leading them to choose the more expensive and complex Interface Endpoint for S3.

How to eliminate wrong answers

Option A is wrong because an Interface VPC Endpoint for S3 is not the most secure and efficient choice; it incurs hourly costs and requires additional security group management, while a Gateway Endpoint is free and simpler for S3 access. Option C is wrong because routing traffic through a NAT Gateway to the internet is less secure (traffic leaves AWS network) and less efficient (adds cost and latency) compared to a VPC Endpoint. Option D is wrong because assigning a public IP address to the EC2 instance exposes it to the internet, violating security best practices for private subnets, and requires internet gateway routing, which is neither secure nor efficient for S3 access.

Practice this question →

41

MCQeasy

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

A.Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

B.Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.

C.Use a Network Load Balancer with TLS listeners and target groups.

D.Configure security groups to allow only HTTPS traffic.

AnswerB

This ensures traffic between ALB and instances is encrypted.

Why this answer

It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.

Exam trap

The trap here is that candidates often confuse 'encryption in transit' with 'network access control' (security groups) or assume that any load balancer with TLS listeners guarantees encryption between the load balancer and targets, but only an ALB with HTTPS target groups re-encrypts traffic to the instances, while an NLB with TLS passthrough does not re-encrypt.

How to eliminate wrong answers

Option A is wrong because TCP passthrough does not terminate TLS at the ALB; instead, it forwards raw TCP traffic to the instances, which would require the instances to handle SSL termination themselves, and the ALB cannot inspect or re-encrypt the traffic, so the data between the ALB and instances may not be encrypted if the instances are not configured correctly. Option C is wrong because a Network Load Balancer with TLS listeners and target groups encrypts traffic between clients and the NLB, but the NLB does not re-encrypt traffic to targets; it passes the original TLS session through, so the data between the NLB and EC2 instances is still encrypted, but the question specifically asks for an ALB, not an NLB, and using an NLB would not meet the requirement to use an Application Load Balancer. Option D is wrong because security groups only control network access (allow/deny traffic) and do not enforce encryption; they can allow HTTPS traffic, but they do not ensure that the data is actually encrypted in transit.

Practice this question →

42

MCQmedium

A company is using Amazon EC2 instances in a VPC with a security group that allows inbound SSH from 0.0.0.0/0. A security engineer needs to restrict SSH access to only the company's public IP range (203.0.113.0/24) while maintaining all other existing rules. What is the MOST efficient way to accomplish this?

A.Disable SSH and use AWS Systems Manager Session Manager to connect to instances.

B.Create a network ACL with an inbound rule allowing SSH from 203.0.113.0/24 and deny all other traffic.

C.Modify the existing security group rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.

D.Create a new security group rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

AnswerC

Modifying the existing rule is the correct action because security group inbound rules are evaluated as an allow list, and changing the source to 203.0.113.0/24 removes the wildcard entry while authorizing only the specified IP range. The update is an in-place edit, so no duplicate rule remains and the stateful security group automatically permits the return traffic for established SSH sessions. The existing rule should be changed rather than appended because any remaining 0.0.0.0/0 rule would continue to allow all source IPs.

Why this answer

Modifying the existing security group rule's source from 0.0.0.0/0 to 203.0.113.0/24 directly restricts inbound SSH to the company's public IP range without affecting any other rules. Security groups are stateful and rule changes apply immediately, making this the most efficient approach as it requires only a single edit to the existing rule.

Exam trap

The trap here is that candidates may think adding a more specific allow rule overrides a broader allow rule, but security groups use an allow-list model where all rules are additive, so the original 0.0.0.0/0 rule must be removed or modified to actually restrict access.

How to eliminate wrong answers

Option A is wrong because disabling SSH and using AWS Systems Manager Session Manager is an alternative solution, not the most efficient way to restrict SSH access while maintaining existing rules; it changes the access method entirely and may not meet the requirement to restrict SSH specifically. Option B is wrong because network ACLs are stateless and operate at the subnet level, not the instance level; modifying a network ACL would affect all instances in the subnet and require separate inbound and outbound rules for return traffic, making it less efficient and not a direct replacement for a security group rule. Option D is wrong because adding a new security group rule allowing SSH from 203.0.113.0/24 while keeping the existing rule with 0.0.0.0/0 would still allow SSH from all IPs, as security group rules are evaluated as a logical OR; the existing permissive rule would remain in effect, failing to restrict access.

Practice this question →

43

MCQmedium

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

A.AWS WAF

B.Network ACLs

C.Security Groups

D.AWS Shield Advanced

AnswerA

AWS WAF filters and monitors HTTP requests to protect against web exploits.

Why this answer

AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering.

AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.

Practice this question →

44

MCQeasy

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

A.Internet gateway

B.VPN connection

C.VPC peering connection

AnswerD

A NAT gateway enables outbound internet access for private subnets.

Why this answer

(NAT gateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access.

Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.

Practice this question →

45

MCQhard

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

A.Delete the IAM role that is allowed access to the bucket.

B.Use AWS WAF to block the IP addresses of the compromised role.

C.Modify the bucket policy to deny all principals.

D.Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.

AnswerD

A deny condition with an impossible IP address blocks all access effectively.

Why this answer

Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.

Exam trap

The trap here is that candidates may think modifying the bucket policy to deny all principals (Option C) is acceptable, but the question explicitly forbids deleting the policy, and modifying it to deny all principals is a form of policy deletion; the correct approach uses a conditional deny with an impossible condition to avoid altering the original policy structure.

How to eliminate wrong answers

Option A is wrong because deleting the IAM role would permanently remove the role and its permissions, which is not reversible and may break other dependencies; the question requires blocking access without deleting the bucket or policy. Option B is wrong because AWS WAF is a web application firewall that operates at the application layer (HTTP/HTTPS) and cannot directly block S3 API requests, which use AWS Signature Version 4 and are not HTTP requests that WAF can inspect. Option C is wrong because modifying the bucket policy to deny all principals would require editing the existing policy, which the question explicitly prohibits; it also does not meet the requirement to avoid deleting the policy.

Practice this question →

46

MCQeasy

A security engineer is configuring a new VPC with public and private subnets. The application servers in the private subnet need to download patches from the internet. Which component is required?

A.VPC endpoint

B.Direct Connect

C.Internet gateway

AnswerD

A NAT gateway is a managed AWS service that enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates or API calls) while preventing unsolicited inbound connections. It is deployed in a public subnet with an Elastic IP address, and the private subnet's route table sends non-local traffic to the NAT gateway's network interface. This exactly matches the requirement to provide outbound internet access for private subnet instances without exposing them to inbound traffic.

Why this answer

A NAT gateway is required to allow instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing the internet from initiating inbound connections to those instances. The NAT gateway resides in a public subnet with an attached Internet Gateway, and it translates the private IP addresses of the application servers to the NAT gateway's Elastic IP address for outbound traffic.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an Internet Gateway, mistakenly thinking an Internet Gateway can be attached directly to a private subnet, but an Internet Gateway only works with resources that have public IP addresses, whereas a NAT gateway enables outbound internet access for private instances without public IPs.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to AWS services (like S3 or DynamoDB) without traversing the internet, but it does not provide general internet access for downloading patches from arbitrary internet hosts. Option B is wrong because Direct Connect establishes a dedicated private network connection from on-premises to AWS, but it does not inherently provide internet access; it would require additional routing and an internet gateway to reach the public internet. Option C is wrong because an Internet Gateway alone enables bidirectional communication between the VPC and the internet, but it cannot be directly attached to a private subnet; instances in a private subnet without a public IP cannot use an Internet Gateway for outbound-only traffic.

Practice this question →

47

Multi-Selectmedium

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)

Select 2 answers

A.Amazon GuardDuty

B.AWS Shield Advanced

C.Network ACLs

D.AWS WAF

E.Amazon CloudFront

AnswersB, D

Shield Advanced provides advanced DDoS protection and integrates with WAF.

Why this answer

AWS WAF (Option D) can be associated with an ALB to filter web requests and protect against common exploits like SQL injection and cross-site scripting. AWS Shield Advanced (Option B) provides enhanced DDoS protection and integrates with WAF for additional layer 7 protections. Option A is wrong because GuardDuty is a threat detection service, not an inline web application firewall.

Option C is wrong because Network ACLs operate at the subnet level and do not provide application-layer filtering. Option E is wrong because CloudFront is a CDN, and while it can be used with WAF, it alone does not provide WAF rules.

Practice this question →

48

MCQeasy

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?

A.AWS Key Management Service (KMS)

B.Amazon S3 server-side encryption

C.RDS encryption feature

D.SSL/TLS certificates

AnswerA

KMS provides encryption keys for RDS encryption.

Why this answer

AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.

Exam trap

The trap here is that candidates confuse the RDS encryption feature (which is a checkbox in the console) with a standalone service, when in fact the underlying service that performs the encryption and key management is AWS KMS.

How to eliminate wrong answers

Option B is wrong because Amazon S3 server-side encryption is a feature specific to objects stored in Amazon S3 buckets, not applicable to RDS DB instance storage. Option C is wrong because 'RDS encryption feature' is not a standalone service; it is a feature that relies on AWS KMS to manage the encryption keys — the question asks which service or feature should be used, and KMS is the underlying service that enables RDS encryption. Option D is wrong because SSL/TLS certificates are used to encrypt data in transit between the client and the database, not data at rest stored on disk.

Practice this question →

49

MCQmedium

A company has an AWS Lambda function that needs to access an Amazon RDS database. The database is in a private subnet. Which configuration will allow the Lambda function to securely access the database without traversing the internet?

A.Create a VPC peering connection between the Lambda VPC and the RDS VPC.

B.Place the Lambda function in a public subnet and use a NAT gateway to access the RDS database.

C.Configure the Lambda function to run in the same VPC as the RDS database, in the same private subnet.

D.Use a VPC endpoint for Lambda to connect to the RDS database.

AnswerC

Attaching the Lambda function to the VPC and placing it in the same private subnet as the RDS instance allows the function's elastic network interface to communicate directly with the database over private IP addresses. This satisfies the security group rules—Lambda can use its own security group to allow inbound traffic to RDS on the database port. There is no need for internet access or NAT, and the connection remains within the private network. This is the recommended AWS pattern for Lambda plus RDS in the same VPC.

Why this answer

Placing the Lambda function in the same VPC and the same private subnet as the RDS database allows the Lambda function to communicate with the database directly over the AWS network using private IP addresses. This configuration ensures traffic does not traverse the internet, and it leverages VPC routing and security groups for access control. Lambda functions must be configured with VPC settings to access resources in private subnets, and when both are in the same subnet, no additional gateways or peering are required.

Exam trap

The trap here is that candidates often assume Lambda functions always run inside a VPC by default, but in reality, Lambda runs in an AWS-managed VPC unless explicitly configured with VPC settings, and they mistakenly think VPC endpoints can be used for any AWS service, including RDS, when in fact RDS does not support VPC interface endpoints for database connections.

How to eliminate wrong answers

Option A is wrong because VPC peering connects two separate VPCs, but Lambda functions run within a VPC only when explicitly configured; the default Lambda execution environment is outside any VPC, so peering does not apply unless the Lambda is already in a VPC. Option B is wrong because placing the Lambda function in a public subnet and using a NAT gateway would still route traffic through the internet (via the NAT gateway) to reach the RDS database in a private subnet, which is unnecessary and less secure; direct VPC placement avoids internet traversal. Option D is wrong because VPC endpoints are used for connecting to AWS services like S3 or DynamoDB via PrivateLink, not for connecting to an RDS database; RDS does not support VPC interface endpoints for database connections.

Practice this question →

50

MCQeasy

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

A.Create an Origin Access Control (OAC) for the S3 bucket origin

B.Create a Route 53 health check to verify CloudFront availability

C.Configure CloudFront signed URLs to restrict access

D.Attach a security group to the S3 bucket

AnswerA

OAC ensures only CloudFront can access the S3 bucket.

Why this answer

An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.

Exam trap

The trap here is that candidates often confuse CloudFront signed URLs (which control user access to content) with origin access controls (which restrict which origin server CloudFront can talk to), leading them to pick option C instead of A.

How to eliminate wrong answers

Option B is wrong because a Route 53 health check verifies the availability of a resource (e.g., CloudFront) for DNS failover, but it does not enforce access restrictions or prevent direct access to the S3 bucket. Option C is wrong because CloudFront signed URLs control access to individual objects by requiring authentication tokens, but they do not prevent users from accessing the S3 bucket directly if the bucket is publicly accessible; signed URLs are for per-request authorization, not origin access control. Option D is wrong because S3 buckets do not support security groups; security groups are a network firewall construct for EC2 instances and other VPC resources, not for S3.

Access to S3 is controlled via bucket policies, IAM policies, or OAC.

Practice this question →

51

MCQmedium

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

A.Allow inbound database port from the security group attached to the application instances in the public subnet.

B.Allow inbound database port from 0.0.0.0/0 in the database security group.

C.Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.

D.Allow inbound database port from the public subnet CIDR block in the database security group.

AnswerA

This dynamically allows traffic from all application instances.

Why this answer

Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet.

Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.

Practice this question →

52

Multi-Selectmedium

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Select 3 answers

A.Use S3 Inventory to list objects and their tags.

B.Enable S3 object-level logging in CloudTrail.

C.Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.

D.Create a bucket policy with a condition based on the s3:ExistingObjectTag key.

E.Set a bucket policy that denies access if the object does not have the required tag.

AnswersC, D, E

IAM policies can also use condition keys to restrict access based on tags.

Why this answer

To restrict the IAM role to only access objects with specific tags, three steps are necessary. First, attach an IAM policy to the role using the s3:ExistingObjectTag condition key (option C). This alone, however, can be overridden by a bucket policy that grants broader access.

Second, create a bucket policy that explicitly allows the role to access objects only when they have the required tag (option D). Third, create a bucket policy that denies the role access to objects that do not have the required tag (option E). The combination of IAM and bucket policies ensures tag-based access control is enforced, as IAM provides identity-based restrictions and bucket policies add resource-based checks, including an explicit deny for non-compliant objects.

Exam trap

The trap here is that candidates often confuse S3 Inventory (a reporting tool) or CloudTrail logging (an auditing tool) with access control mechanisms, leading them to select options that do not actually restrict access.

Practice this question →

53

MCQmedium

A company has deployed a multi-tier web application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The security team wants to ensure that the application servers cannot initiate outbound connections to the internet. What should the team do?

A.Add a deny rule for all outbound traffic in the network ACL of the private subnet.

B.Modify the security group of the application servers to deny all outbound traffic.

C.Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.

D.Attach an egress-only internet gateway to the private subnet.

AnswerC

Removing the default route (0.0.0.0/0) to an internet gateway or NAT gateway from the private subnet's route table eliminates the only path for outbound traffic to reach the internet. Route tables govern where traffic is sent from the subnet; without a default route, any packet destined outside the VPC has no route and is dropped. This does not affect inbound traffic, which is controlled by security groups and network ACLs, making it a precise and effective solution.

Why this answer

Removing the default route (0.0.0.0/0) from the private subnet's route table ensures that any traffic destined for the internet has no valid path, effectively preventing application servers from initiating outbound internet connections. Network ACLs and security groups are stateful or stateless filters but do not control routing; without a route, packets cannot leave the subnet regardless of allow rules. This aligns with the principle of using route tables to enforce network segmentation in a multi-tier architecture.

Exam trap

The trap here is that candidates often confuse security group rules or network ACLs with routing decisions, mistakenly believing that blocking outbound traffic at the firewall level is sufficient, when in fact AWS routes traffic before applying security group or ACL rules, so without a route, no traffic can leave the subnet regardless of allow rules.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply to both inbound and outbound traffic at the subnet level, but adding a deny rule for all outbound traffic would still allow return traffic for established connections if inbound rules permit it; more importantly, it does not prevent the application servers from initiating connections if a route exists, as the ACL only filters packets that are already routed. Option B is wrong because security groups are stateful and cannot deny outbound traffic; they only support allow rules, and by default all outbound traffic is allowed unless explicitly removed, but removing all outbound rules still permits return traffic for inbound-initiated connections due to statefulness, and the security group does not control routing. Option D is wrong because an egress-only internet gateway is designed for IPv6 traffic to allow outbound-only connections from a private subnet, which would actually enable outbound internet access for IPv6, contrary to the requirement to prevent all outbound internet connections.

Practice this question →

54

MCQhard

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

A.Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway

B.Create a VPC endpoint for Amazon S3 and route traffic through it

C.Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

D.Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

AnswerA

The NAT Gateway is deployed in a public subnet with an Elastic IP and performs source network address translation for instances in private subnets. Outbound packets are sent to the NAT Gateway via the 0.0.0.0/0 route, and return traffic is delivered back through the same stateful translation. Because private instances lack public IPs and the route table points to the NAT Gateway rather than an internet gateway, unsolicited inbound connections cannot reach them, making this the standard design for outbound-only internet access.

Why this answer

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing any unsolicited inbound traffic from the internet. The private subnet route table sends 0.0.0.0/0 traffic to the NAT Gateway, which then forwards it through the Internet Gateway (IGW) attached to the VPC. This provides the highest security because the private instances remain unreachable from the internet, unlike using an IGW directly or a bastion host for routing.

Exam trap

The trap here is that candidates often confuse a bastion host (for administrative access) with a NAT device (for outbound internet routing), or incorrectly assume that a VPC endpoint can provide general internet access instead of just private connectivity to specific AWS services.

How to eliminate wrong answers

Option B is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for downloading patches from arbitrary internet sources. Option C is wrong because attaching an Internet Gateway directly to a private subnet and routing 0.0.0.0/0 traffic to it would make the subnet effectively public, exposing instances to unsolicited inbound traffic and defeating the purpose of a private subnet. Option D is wrong because a bastion host is designed for secure administrative access (SSH/RDP) to private instances, not for routing general internet traffic; using it as a NAT would create a single point of failure, performance bottleneck, and security risk due to its management plane exposure.

Practice this question →

55

MCQhard

A company uses an AWS Transit Gateway to connect multiple VPCs and on-premises networks. A security engineer needs to ensure that traffic between VPCs is inspected by a third-party firewall appliance. Which architecture should be used?

A.Configure security groups on the transit gateway to inspect traffic.

B.Create VPC endpoints for each VPC to route traffic through the firewall.

C.Attach the firewall appliance to a dedicated inspection VPC and route traffic from other VPCs through the inspection VPC using transit gateway route tables.

D.Use network ACLs on the transit gateway to filter traffic.

AnswerC

This is the standard centralized inspection architecture: deploy the firewall appliance in a dedicated inspection VPC and attach that VPC to the transit gateway, then use separate transit gateway route tables to force all traffic from spoke VPCs to route to the inspection VPC before it proceeds to other attachments. The inspection VPC must also have route tables that forward traffic back to the transit gateway toward the final destination, enabling asymmetric return-path handling and stateful inspection. This design works because the transit gateway routes based on its route tables, so the firewall becomes an inline bump-in-the-wire for all inter-VPC traffic while maintaining a single control point.

Why this answer

It uses a dedicated inspection VPC as a central point for traffic inspection. By attaching the third-party firewall appliance to this inspection VPC and manipulating transit gateway route tables, you can force all inter-VPC traffic to be routed through the firewall for inspection. This architecture leverages the transit gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without modifying individual VPC routing.

Exam trap

The trap here is that candidates often confuse transit gateway capabilities with VPC-level constructs like security groups or network ACLs, assuming they can be applied directly to the transit gateway, when in fact transit gateway traffic inspection requires a separate inspection VPC architecture.

How to eliminate wrong answers

Option A is wrong because security groups are stateful firewalls applied at the instance or elastic network interface level, not on transit gateways; transit gateways do not support security groups. Option B is wrong because VPC endpoints (Gateway Endpoints or Interface Endpoints) are used for private connectivity to AWS services (e.g., S3, DynamoDB) and cannot route general inter-VPC traffic through a third-party firewall. Option D is wrong because network ACLs are stateless firewalls applied at the subnet level, not on transit gateways; transit gateways do not support network ACLs.

Practice this question →

56

Multi-Selectmedium

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Select 2 answers

A.Amazon GuardDuty

B.AWS WAF

C.Security Groups

D.AWS Shield Advanced

E.Network ACLs

AnswersB, C

WAF provides application-layer protection.

Why this answer

AWS WAF is correct because it provides application-layer protection by inspecting HTTP/HTTPS requests to your web application, allowing you to block common attack patterns such as SQL injection and cross-site scripting (XSS) using customizable rules. Security Groups are correct because they act as a virtual firewall at the instance level (network layer), controlling inbound and outbound traffic based on IP addresses, ports, and protocols, thus forming the first line of defense in a defense-in-depth strategy.

Exam trap

The trap here is that candidates often confuse AWS Shield Advanced (which provides DDoS protection) with application-layer filtering, or assume Network ACLs can inspect application data, when in fact they operate only at the network layer and are stateless.

Practice this question →

57

Multi-Selecthard

A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?

Select 2 answers

A.Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.

B.Create a resource-based policy on the RDS instance.

C.Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.

D.Create a security group rule that references the EC2 instance's security group.

E.Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'.

AnswersA, E

Combines with endpoint policy.

Why this answer

To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect.

Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances.

Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.

Practice this question →

58

MCQmedium

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

A.Allow inbound HTTP traffic from the EC2 instances' own security group

B.Allow inbound HTTP traffic from 0.0.0.0/0

C.Allow inbound HTTP traffic from the VPC CIDR block

D.Allow inbound HTTP traffic from the ALB's security group

AnswerD

This ensures only the ALB can initiate traffic to the EC2 instances.

Why this answer

Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.

Exam trap

The trap here is that candidates often confuse security group referencing with CIDR-based rules, mistakenly thinking that allowing the VPC CIDR (Option C) is sufficient, but this would allow any resource in the VPC, not just the ALB, to reach the EC2 instances.

How to eliminate wrong answers

Option A is wrong because allowing inbound HTTP traffic from the EC2 instances' own security group would permit traffic between the EC2 instances themselves, not from the ALB, and does not restrict access to the ALB only. Option B is wrong because allowing inbound HTTP traffic from 0.0.0.0/0 would permit traffic from any IP address on the internet, completely bypassing the ALB and exposing the EC2 instances directly. Option C is wrong because allowing inbound HTTP traffic from the VPC CIDR block would permit traffic from any resource within the VPC (including other EC2 instances, NAT gateways, or VPN connections), not exclusively from the ALB.

Practice this question →

59

MCQhard

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

A.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.

B.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.

C.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.

D.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.

AnswerD

Security group references ensure only instances in the web tier can access the app tier, and only instances in the app tier can access the database.

Why this answer

It uses security group IDs as the source for inbound rules, which allows traffic only from instances associated with the specified security group, regardless of their IP addresses. This provides a dynamic and secure way to control traffic between tiers, as security group IDs are resolved at the instance level and automatically adapt to changes in instance membership. By contrast, using CIDR blocks (as in options A and C) is less secure because it relies on static IP ranges that may not accurately reflect the actual instances in the web or app tiers, and option B is overly permissive by allowing all traffic from the web SG.

Exam trap

The trap here is that candidates often choose CIDR-based rules (options A or C) because they seem simpler, but they fail to recognize that security group IDs provide a more secure and dynamic way to enforce tier-to-tier access, especially in environments with elastic IPs or auto-scaling.

How to eliminate wrong answers

Option A is wrong because it uses CIDR blocks (Web SG CIDR) instead of security group IDs, which is less secure as CIDR blocks can be broader than necessary and do not automatically update when instances change IPs. Option B is wrong because it allows all traffic from the Web SG to the App SG, which is overly permissive and violates the principle of least privilege by permitting unnecessary protocols beyond HTTP. Option C is wrong because it uses a static CIDR block (10.0.0.0/24) for the database tier, which does not restrict access solely to the app tier instances and may allow other resources in that subnet to reach the database.

Practice this question →

60

MCQmedium

A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?

A.Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.

B.Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.

C.Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.

D.Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.

AnswerA

Security groups are stateful and support referencing other security groups as a source, allowing an inbound rule on the database security group to permit traffic only from instances associated with the web security group on port 3306. This removes the need to track instance IP addresses or rely on broad CIDR ranges, and it automatically scales with the web tier's launch or termination. Because security groups are stateful, return traffic from the database to the web tier is implicitly allowed, reducing operational overhead while maintaining least-privilege access.

Why this answer

Security groups are stateful and support referencing other security groups as a source, which allows you to permit traffic from the web security group to the database security group on port 3306 without needing to specify IP addresses. This approach minimizes administrative overhead as security group rules are automatically applied to all instances associated with the group, and changes propagate without updating network ACLs or CIDR ranges. The web security group can have an inbound rule allowing HTTPS (port 443) from the internet (0.0.0.0/0), while the database security group only allows inbound MySQL/Aurora (port 3306) from the web security group, meeting the access requirements precisely.

Exam trap

The trap here is that candidates often confuse the stateful nature of security groups with the stateless nature of network ACLs, leading them to incorrectly add outbound rules (Option B) or choose network ACLs (Options C and D) when security group references provide a simpler, more scalable solution.

How to eliminate wrong answers

Option B is wrong because it adds an outbound rule to the web security group for traffic to the database security group on port 3306, but security groups are stateful—if the inbound rule on the database security group allows traffic from the web security group, the return traffic is automatically permitted, making the outbound rule redundant and not the primary mechanism to restrict database access. Option C is wrong because it uses a network ACL for the database tier, which is stateless and requires separate inbound and outbound rules, increasing administrative overhead; additionally, referencing a subnet CIDR instead of a security group is less flexible and does not automatically adapt to changes in the web tier. Option D is wrong because network ACLs do not support referencing security groups as a source or destination—they only support CIDR blocks, IP addresses, or service prefixes, so the rule 'allowing all traffic from the web security group' is invalid and would not work.

Practice this question →

61

MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

A.Set up AWS Config rules to detect non-compliant buckets

B.Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured

C.Create an IAM role that requires encryption and attach it to all users

D.Use an S3 bucket policy with a condition for encryption

AnswerB

SCPs can deny actions based on conditions, enforcing encryption at creation time.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or mistakenly think S3 bucket policies can govern bucket creation, when in fact bucket policies only apply to operations on existing buckets.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets after creation but cannot block the creation itself, leaving a window of non-compliance. Option C is wrong because IAM roles attached to users do not enforce encryption on S3 bucket creation across all accounts in the organization; users can still create buckets without encryption if they have direct S3 permissions or use other roles, and IAM roles cannot override permissions granted by other policies. Option D is wrong because S3 bucket policies are resource-based and apply only to existing buckets, not to the creation of new buckets; they cannot prevent a bucket from being created without encryption.

Practice this question →

62

MCQmedium

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

A.Attach an Elastic IP to the instance.

B.Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.

C.Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.

D.Allow outbound traffic in the instance's security group.

AnswerC

Private subnet instances should not have public IPs; they use NAT gateway for internet access.

Why this answer

An EC2 instance in a private subnet cannot use a public IP address for internet access, as the private subnet's route table directs default traffic to a NAT gateway, not an internet gateway. The public IP is irrelevant because the instance's traffic must traverse the NAT gateway, which requires the instance to have no public IP and the private subnet route to point to the NAT gateway. Removing the public IP ensures the instance uses the NAT gateway's Elastic IP for outbound traffic, resolving the internet access issue.

Exam trap

The trap here is that candidates mistakenly think assigning a public IP or Elastic IP to an instance in a private subnet will grant internet access, overlooking that routing decisions are made at the subnet level, not the instance level.

How to eliminate wrong answers

Option A is wrong because attaching an Elastic IP to the instance does not change the routing; the private subnet's route table still sends 0.0.0.0/0 traffic to the NAT gateway, and the Elastic IP would be ignored since the instance is behind a NAT gateway. Option B is wrong because updating the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway would expose the instance directly to the internet, defeating the purpose of a private subnet and violating security best practices. Option D is wrong because security groups are stateful and allow outbound traffic by default; the issue is routing, not firewall rules.

Practice this question →

63

Multi-Selecthard

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Select 2 answers

A.S3 Interface Endpoint in the VPC

B.VPC Peering to a shared services VPC

C.NAT Gateway in a public subnet

D.Internet Gateway attached to the VPC

E.S3 Gateway Endpoint in the VPC

AnswersC, E

Allows outbound internet to EC2 instances in private subnets.

Why this answer

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates or API calls) while blocking unsolicited inbound connections. This satisfies the requirement for outbound internet access without exposing private instances directly.

Exam trap

The trap here is that candidates often choose an Internet Gateway (Option D) thinking it can be restricted via security groups or NACLs, but an Internet Gateway itself does not filter traffic—it simply enables bidirectional routing, and blocking inbound traffic requires additional controls like a NAT Gateway or a stateful firewall, which is not the intended design for private subnets.

Practice this question →

64

MCQhard

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

A.The bucket policy overrides the IAM policy

B.The policy does not allow the s3:GetObject action

C.The source IP condition does not match the user's actual IP address

D.The user is not assuming the correct IAM role

AnswerC

The policy condition uses the aws:SourceIp global condition key and requires the request to originate from 10.0.0.0/16, a private RFC 1918 CIDR range. IAM compares this against the actual source IP recorded in the request, so if the IAM user is connecting from outside that range—for example, from a public internet address—the condition fails. When a condition fails, the Allow statement is skipped and the request is implicitly denied.

Why this answer

The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Exam trap

The trap here is that candidates may overlook the `Condition` block and assume the policy allows the action because `s3:GetObject` is listed, failing to realize that the source IP condition can override the allow even when the action is explicitly permitted.

How to eliminate wrong answers

Option A is wrong because bucket policies and IAM policies are evaluated together; an explicit deny in either will override an allow, but there is no bucket policy mentioned in the scenario, and the IAM policy itself is the likely cause of denial. Option B is wrong because the policy explicitly includes `s3:GetObject` in the `Action` list, so the action is allowed by the policy statement. Option D is wrong because the policy is directly attached to the IAM user, not requiring role assumption; the user is already operating under the attached policy.

Practice this question →

65

Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Select 2 answers

A.Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.

B.Add a route in the private subnet's route table pointing to the NAT gateway.

C.Attach an internet gateway to the private subnet's route table.

D.Create a VPC gateway endpoint for Amazon S3.

E.Deploy a NAT gateway in a public subnet.

AnswersB, E

Correct: This routes outbound internet traffic through the NAT gateway.

Why this answer

A NAT gateway, when deployed in a public subnet with an associated Elastic IP and a route to an internet gateway, allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's private IP address to forward outbound traffic through it.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an internet gateway, mistakenly thinking that adding an internet gateway to a private subnet's route table provides outbound-only access, when in fact it enables bidirectional internet connectivity and requires public IPs on the instances.

Practice this question →

66

MCQeasy

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

A.Amazon CloudWatch Logs.

B.AWS CloudTrail.

C.VPC Flow Logs.

D.AWS Config.

AnswerB

AWS CloudTrail is the service designed to record AWS API activity, and it captures every security group change as an API event such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, or DeleteSecurityGroup. Each event includes the identity of the caller, the source IP address, the request parameters, and the response elements, giving a complete audit trail of who changed what and when. This makes CloudTrail the appropriate service for auditing all changes to security group rules.

Why this answer

AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including changes to security group rules via the EC2 AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, and RevokeSecurityGroupEgress API actions. These events are captured as management events in CloudTrail, providing a complete audit trail of who made the change, when, from which IP address, and the exact parameters of the rule modification.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks resource configuration state) with CloudTrail (which tracks API activity), leading them to select AWS Config because they think 'audit changes' means monitoring the current state of rules, but the question specifically asks for recording the changes themselves, which requires API-level logging.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files from AWS resources, but it does not natively capture API-level changes to security group rules; it would require custom integration or agent-based logging. Option C is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) flowing through ENIs, not the configuration changes to security group rules themselves. Option D is wrong because AWS Config evaluates and records resource configuration changes over time, but it is not the primary service for auditing API calls; CloudTrail is the service that records the API actions that trigger those configuration changes, while AWS Config focuses on the resulting state.

Practice this question →

67

Multi-Selectmedium

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Select 3 answers

A.AWS CloudTrail event history

B.Amazon CloudWatch Logs

C.VPC Flow Logs

D.AWS CloudTrail

E.AWS Config

AnswersA, D, E

Event history provides a searchable view of the last 90 days of API calls.

Why this answer

D, and E are correct. CloudTrail logs all API calls, including who made the call. CloudTrail event history provides a view of the last 90 days.

AWS Config records configuration changes, including security group creation. Option B is wrong because CloudWatch Logs does not capture API calls unless specifically configured. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Practice this question →

68

MCQhard

A Security Engineer is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier, and the database tier only from the application tier. All tiers are in the same VPC. Which configuration meets these requirements with minimal administrative overhead?

A.Use network ACLs with inbound rules that reference the prefix list of the previous tier's subnets.

B.Use network ACLs with inbound rules that allow traffic from the previous tier's subnet CIDR.

C.Use security groups with inbound rules that allow traffic from the previous tier's public IP addresses.

D.Use security groups with inbound rules that reference the security group of the previous tier.

AnswerD

Referencing the previous tier's security group as the source in an inbound rule is the correct approach because security groups are stateful and allow logical references to other security groups, not just IP addresses. When you assign an instance to the source security group, it automatically becomes allowed to reach the target tier, even if its IP address changes or new instances are added. This eliminates the need to manage CIDR blocks or public IPs and keeps security policies tightly aligned with architectural tiers. It is the AWS-recommended pattern for multi-tier security group design.

Why this answer

Security groups are stateful and can reference other security groups as a source in inbound rules, allowing traffic from any instance associated with the referenced security group regardless of IP address changes. This creates a logical dependency chain (web SG → app SG → db SG) that enforces the required tier-to-tier access with zero maintenance when instances scale or subnets change. Option D meets the requirement with minimal administrative overhead because security group references automatically adapt to dynamic environments.

Exam trap

The trap here is that candidates confuse network ACLs with security groups, assuming stateless ACLs can use logical references like security group IDs, or they overlook the administrative overhead of managing CIDR-based rules in dynamic architectures.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and cannot reference prefix lists of subnets as a source in inbound rules; they only support CIDR blocks, IP ranges, or protocol/port numbers. Option B is wrong because network ACLs require explicit allow and return traffic rules (stateless), and using subnet CIDRs creates administrative overhead when subnets change or scale, plus they cannot dynamically follow instances that move between subnets. Option C is wrong because referencing public IP addresses is fragile (IPs can change with scaling or NAT), violates the principle of using private addressing within a VPC, and adds administrative burden to track and update IPs.

Practice this question →

69

Multi-Selecthard

Which THREE are AWS best practices for securing an Amazon EC2 instance? (Choose three.)

Select 3 answers

A.Store database credentials in instance metadata for easy retrieval.

B.Launch instances in the default VPC for easier network configuration.

C.Use security groups to control inbound and outbound traffic.

D.Disable password-based authentication and use SSH key pairs instead.

E.Regularly apply security patches using AWS Systems Manager Patch Manager.

AnswersC, D, E

Security groups are the primary mechanism for controlling network traffic to EC2 instances.

Why this answer

Security groups act as a virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level. By default, security groups are stateful and allow only explicitly permitted traffic, which is a fundamental AWS best practice for network security. Using security groups helps implement the principle of least privilege by restricting access to only necessary ports and protocols.

Exam trap

The trap here is that candidates may think instance metadata is a secure place to store credentials because it is convenient, but AWS explicitly warns against this due to the risk of exposure through SSRF or other instance-level vulnerabilities.

Practice this question →

70

Multi-Selecthard

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Select 2 answers

A.Create an S3 Gateway Endpoint in the VPC

B.Attach a VPC Endpoint Policy to the Gateway Endpoint to restrict access to the specific bucket

C.Attach an Internet Gateway to the VPC

D.Create an S3 Interface Endpoint in the VPC

E.Use a NAT Gateway to route the traffic to the internet

AnswersA, B

Provides private connectivity to S3.

Why this answer

A VPC Gateway Endpoint (option A) allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. This is the correct foundational component because it uses prefix lists in the route table to direct S3 traffic to the endpoint, bypassing the need for an Internet Gateway or NAT Gateway.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both are equally valid for S3, but Gateway Endpoints are the correct and cost-effective choice for S3 access from private subnets, while Interface Endpoints are used for services like API Gateway or Kinesis.

Practice this question →

71

Multi-Selecthard

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Select 2 answers

A.AWS Firewall Manager

B.AWS Network Firewall

C.VPC Peering

D.AWS WAF

E.Amazon GuardDuty

AnswersA, B

Firewall Manager provides centralized management of firewall rules across accounts and resources.

Why this answer

AWS Firewall Manager (Option A) provides centralized management of firewall rules and policies across accounts in AWS Organizations, enabling consistent enforcement of network security. AWS Network Firewall (Option B) offers managed network firewall services that can be centrally deployed and managed via Firewall Manager. Option C (VPC Peering) is a network connectivity feature, not a security management service.

Option D (AWS WAF) protects web applications at the application layer, not network-level security. Option E (Amazon GuardDuty) is a threat detection service, not a network security management tool.

Practice this question →

72

MCQmedium

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The security team wants to restrict access to the ALB so that it only accepts traffic from CloudFront. Which configuration should be used?

A.Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.

B.Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.

C.Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.

D.Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.

AnswerD

This is the correct and recommended approach: AWS publishes the complete set of CloudFront IP addresses used to fetch content from origins in the ip-ranges.json file, with a specific service indicator (CLOUDFRONT_ORIGIN_FACING). By adding a security group rule that allows inbound TCP 80/443 only from those CIDR blocks, the ALB will refuse connections from any other public IP, including direct internet clients that bypass CloudFront. You can implement this effectively using a managed prefix list that AWS keeps updated, or by periodically refreshing your security group rules from the published ranges.

Why this answer

CloudFront publishes a list of its origin-facing IP address ranges, and you can restrict the ALB's security group to allow inbound traffic only from those ranges. This ensures that only CloudFront can reach the ALB directly, preventing bypass attacks. AWS provides these IP ranges in the ip-ranges.json file, which can be used to automate security group updates.

Exam trap

The trap here is that candidates often confuse CloudFront's viewer-facing IP ranges with its origin-facing IP ranges, or they assume that a custom header (like 'X-CloudFront-Origin') is a built-in CloudFront feature, when in fact AWS recommends using security group restrictions as the primary defense.

How to eliminate wrong answers

Option A is wrong because CloudFront cannot use a VPC origin with an internal ALB; CloudFront origins must be publicly accessible over the internet, and internal ALBs are not reachable from CloudFront. Option B is wrong because there is no standard 'X-CloudFront-Origin' header; while you can use a custom header like 'X-Origin-Verify' to authenticate requests, this is not a built-in CloudFront feature and relies on a shared secret, which is less secure than network-layer restriction. Option C is wrong because IAM roles are used for API-level authorization (e.g., invoking Lambda functions), not for network traffic control to an ALB; ALBs do not evaluate IAM roles for incoming HTTP requests.

Practice this question →

73

MCQhard

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to ensure that only specific IAM roles can use a particular KMS key to encrypt and decrypt data. What is the most secure way to achieve this?

A.Create an IAM policy that allows kms:Encrypt and kms:Decrypt for the roles and attach it to the roles.

B.Create a KMS key policy that grants access only to the specific IAM roles using the kms:CallerArn condition.

C.Create a KMS key policy that grants access to the account and use IAM policies to restrict the roles.

D.Create a KMS key policy with Principal "*" and a condition that the request originates from the roles.

AnswerB

This restricts key usage to the specified roles.

Why this answer

Using a key policy with a condition for the kms:CallerArn attribute restricts usage to the specified roles. Option A is wrong because IAM policies alone cannot restrict KMS key usage if the key policy allows all principals. Option C is wrong because key policy with Principal "*" grants access to all, even with a condition.

Option D is wrong because a condition for the IAM role's ARN is not a standard KMS condition key.

Practice this question →

74

MCQmedium

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

A.The IAM role is not attached to the EC2 instance profile.

B.The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.

C.The PublicAccessBlockConfiguration is blocking the bucket policy.

D.The role does not have s3:ListBucket permission.

AnswerC

The settings BlockPublicPolicy and RestrictPublicBuckets can prevent the policy from granting access even to specific roles.

Why this answer

The PublicAccessBlockConfiguration at the account or bucket level overrides any bucket policy that grants public or cross-account access. Even though the bucket policy may allow the DataAccessRole to read objects, the PublicAccessBlockConfiguration blocks all public or cross-account access, causing AccessDenied errors. This is the most likely cause because the bucket policy is effectively ignored when public access blocks are enabled.

Exam trap

The SCS-C02 exam often tests the misconception that a bucket policy alone is sufficient to grant cross-account access, without considering that PublicAccessBlockConfiguration can silently override it, leading candidates to overlook this setting.

How to eliminate wrong answers

Option A is wrong because the IAM role is not attached to an EC2 instance profile; the role is assumed directly by users, not by an EC2 instance, so an instance profile is irrelevant. Option B is wrong because there is no mention of SSE-KMS encryption in the exhibit, and the error is AccessDenied, not a KMS-related permission error (which would typically be a different error message). Option D is wrong because the s3:ListBucket permission is required for listing objects, not for reading individual objects; the error occurs when trying to read objects, which requires s3:GetObject, not s3:ListBucket.

Practice this question →

75

MCQmedium

Refer to the exhibit. A security engineer creates the S3 bucket policy above to allow an IAM role to upload objects only from the corporate network IP range (10.0.0.0/16). However, users report that they can still upload objects from outside the range when assuming the role. What is the most likely cause?

A.The condition key aws:SourceIp does not support the IP range 10.0.0.0/16 because it is a private IP range.

B.The bucket policy uses Allow instead of Deny; an explicit Deny is needed to block requests that do not meet the condition.

C.The IAM role's trust policy does not restrict who can assume the role.

D.The resource ARN should not include the trailing /*.

AnswerB

Because the IAM role already has an Allow, an Allow with condition does not restrict; a Deny is required.

Why this answer

An S3 bucket policy with an Allow effect grants access to anyone who meets the condition, but it does not explicitly deny requests that do not meet the condition. In IAM and resource-based policies, an Allow that includes a condition only applies when the condition is true; if the condition is false, the Allow is not evaluated, but other policies (like the IAM role's permissions) may still grant access. To block uploads from outside the corporate IP range, an explicit Deny with the same condition (or a NotIpAddress condition) is required to override any other Allow that might apply.

Exam trap

The trap here is that candidates assume an Allow with a condition implicitly denies all other requests, but AWS policy evaluation requires an explicit Deny to block access that does not meet the condition.

How to eliminate wrong answers

Option A is wrong because the aws:SourceIp condition key supports private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) when the request originates from within a VPC or corporate network; the limitation is that aws:SourceIp cannot be used for requests that come through a VPC endpoint (where aws:VpcSourceIp should be used instead), but private IP ranges are otherwise valid. Option C is wrong because the IAM role's trust policy controls who can assume the role, not the network source of the request; even if the trust policy is restrictive, the bucket policy's Allow condition is still insufficient to block uploads from outside the IP range. Option D is wrong because the resource ARN with a trailing /* is correct for granting access to all objects within the bucket; omitting the /* would restrict the policy to the bucket itself (e.g., s3:ListBucket), not to object-level actions like s3:PutObject.

Practice this question →

Page 1 of 2 · 76 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Infrastructure Security questions.

Start 20-question session