How should I use these Infrastructure Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Infrastructure Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Infrastructure Security domain.

SCS-C02 · topic practice

Infrastructure Security practice questions

Use this page to practise Infrastructure Security questions for this certification. Focus on how the exam tests infrastructure security in scenario format — understanding the why behind each answer builds more durable knowledge than memorising options.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Infrastructure Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Infrastructure Security

Infrastructure Security questions on this certification test your ability to deploy and manage infrastructure security concepts in scenario-based situations.

Core Infrastructure Security concepts and how they apply in real-world cloud scenarios.

How to deploy infrastructure security correctly and verify the outcome.

Troubleshooting infrastructure security issues by interpreting error output and system state.

Cloud best practices and Infrastructure Security design trade-offs tested by this certification.

Watch out for

Common Infrastructure Security exam traps

▸Selecting the most expensive service when a simpler managed option meets the requirement.
▸Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
▸Choosing a global service fix when the issue is region-specific.
▸Overlooking cost implications of cross-region data transfer in architecture questions.

Practice set

Infrastructure Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Infrastructure Security explanation →

A company is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application and database tiers must be isolated. The security team requires that all traffic between tiers be encrypted and that the application tier can only be accessed by the web tier. Which architecture should be used?

Trap 1: Place all tiers in public subnets and use security groups to…

This exposes app and database tiers to the internet, which is not isolated.

Trap 2: Place the web and app tiers in public subnets and the database in a…

The app tier in a public subnet is exposed and unnecessary.

Trap 3: Place all tiers in private subnets and use a single security group…

A single security group does not provide fine-grained isolation between tiers.

Study all Infrastructure Security common traps →

A
Place all tiers in public subnets and use security groups to restrict traffic.
Why wrong: This exposes app and database tiers to the internet, which is not isolated.
B
Place the web tier in a public subnet with an internet gateway, and the app and database tiers in private subnets. Use separate security groups for each tier, allowing only necessary traffic.
This ensures isolation and encryption can be applied at the application layer.
C
Place the web and app tiers in public subnets and the database in a private subnet.
Why wrong: The app tier in a public subnet is exposed and unnecessary.
D
Place all tiers in private subnets and use a single security group to allow traffic between them.
Why wrong: A single security group does not provide fine-grained isolation between tiers.

Full breakdown with real-world context →

Question 2hardmultiple choice

Review the full subnetting walkthrough →

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Trap 1: The network ACL for the subnet is blocking outbound traffic to the…

Outbound traffic is reaching on-premises, so NACL is not blocking outbound.

Trap 2: The virtual private gateway is not attached to the VPC.

If the gateway were not attached, outbound traffic would not reach on-premises.

Trap 3: The security group does not allow inbound traffic from the…

Security groups are stateful; if outbound is allowed, return traffic is automatically allowed.

Study all Infrastructure Security common traps →

A
The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.
Without a return route, responses from on-premises are dropped.
B
The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.
Why wrong: Outbound traffic is reaching on-premises, so NACL is not blocking outbound.
C
The virtual private gateway is not attached to the VPC.
Why wrong: If the gateway were not attached, outbound traffic would not reach on-premises.
D
The security group does not allow inbound traffic from the on-premises server.
Why wrong: Security groups are stateful; if outbound is allowed, return traffic is automatically allowed.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Infrastructure Security explanation →

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all Amazon S3 buckets across the organization have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which approach should be used to enforce this policy?

Trap 1: Create an S3 bucket policy in each account to deny access to…

Bucket policies are per-bucket and do not prevent creation of new buckets without encryption.

Trap 2: Use AWS Config rules to detect buckets without encryption and send…

Config rules are detective, not preventive.

Trap 3: Create an IAM role in each account that requires encryption when…

IAM roles cannot enforce policies across all accounts centrally.

Study all Infrastructure Security common traps →

A
Create an S3 bucket policy in each account to deny access to unencrypted buckets.
Why wrong: Bucket policies are per-bucket and do not prevent creation of new buckets without encryption.
B
Use AWS Config rules to detect buckets without encryption and send alerts.
Why wrong: Config rules are detective, not preventive.
C
Create an IAM role in each account that requires encryption when creating buckets.
Why wrong: IAM roles cannot enforce policies across all accounts centrally.
D
Create a service control policy (SCP) that denies s3:CreateBucket if the bucket does not have encryption enabled.
SCPs allow central policy enforcement across all accounts in the organization.

Full breakdown with real-world context →

Question 4hardmulti select

Read the full Infrastructure Security explanation →

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

Trap 1: Create a security group for the database servers that allows…

Using the web security group ID as source is more dynamic and secure than IP CIDR.

Trap 2: Place the database servers in a public subnet for easier…

Databases should be in private subnets, not exposed to the internet.

Trap 3: Configure the network ACL for the database subnet to allow inbound…

NACLs are stateless and require explicit outbound rules; security groups are simpler and stateful.

Study all Infrastructure Security common traps →

A
Create a security group for the web servers that allows outbound traffic on port 3306 to the database security group.
Security groups are stateful and will allow return traffic automatically.
B
Create a security group for the database servers that allows inbound traffic on port 3306 from the web subnet CIDR.
Why wrong: Using the web security group ID as source is more dynamic and secure than IP CIDR.
C
Place the database servers in a public subnet for easier connectivity.
Why wrong: Databases should be in private subnets, not exposed to the internet.
D
Configure the network ACL for the database subnet to allow inbound traffic on port 3306 from the web subnet CIDR.
Why wrong: NACLs are stateless and require explicit outbound rules; security groups are simpler and stateful.
E
Create a security group for the database servers that allows inbound traffic on port 3306 from the web security group ID.
This ensures only instances in the web security group can connect.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Infrastructure Security explanation →

A security engineer is reviewing the SQS queue policy shown in the exhibit. The queue is subscribed to an SNS topic in the same account. The security team has a requirement that only the SNS topic should be allowed to send messages to the queue. What is the issue with this policy?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:sns:us-east-1:123456789012:MyTopic"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sqs:ReceiveMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}

Trap 1: The policy does not specify a principal, so it will not work.

Principal '*' is allowed when used with conditions.

Trap 2: The aws:SourceArn condition uses ArnLike which is deprecated.

ArnLike is valid and commonly used.

Trap 3: The aws:SourceIp condition cannot be used with SQS queue policies.

aws:SourceIp can be used with SQS.

Study all Infrastructure Security common traps →

A
The second statement allows any principal in the 10.0.0.0/8 range to receive messages from the queue.
This is overly permissive and should be scoped down.
B
The policy does not specify a principal, so it will not work.
Why wrong: Principal '*' is allowed when used with conditions.
C
The aws:SourceArn condition uses ArnLike which is deprecated.
Why wrong: ArnLike is valid and commonly used.
D
The aws:SourceIp condition cannot be used with SQS queue policies.
Why wrong: aws:SourceIp can be used with SQS.

Full breakdown with real-world context →

Question 6hardmultiple choice

Study the full AAA explanation →

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: - All EC2 instances are launched in private subnets. - The IAM roles used by EC2 instances follow the principle of least privilege. - Security groups restrict inbound and outbound traffic. - AWS Systems Manager Patch Manager is used to patch instances. - AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. - Amazon GuardDuty is enabled.

Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

Trap 1: Enable VPC Flow Logs to monitor traffic to S3.

Flow logs are detective and do not prevent data exfiltration.

Trap 2: Deploy AWS WAF in front of the S3 bucket.

AWS WAF is for web ACLs, not for restricting access from EC2.

Trap 3: Create an AWS Config rule to detect S3 access from EC2 instances.

Config rules are detective, not preventive.

Study all Infrastructure Security common traps →

A
Enable VPC Flow Logs to monitor traffic to S3.
Why wrong: Flow logs are detective and do not prevent data exfiltration.
B
Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.
This restricts S3 access to the VPC and reduces the attack surface for data exfiltration.
C
Deploy AWS WAF in front of the S3 bucket.
Why wrong: AWS WAF is for web ACLs, not for restricting access from EC2.
D
Create an AWS Config rule to detect S3 access from EC2 instances.
Why wrong: Config rules are detective, not preventive.

Full breakdown with real-world context →

Question 7mediummulti select

Review the full subnetting walkthrough →

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Trap 1: Configure the private subnet's security group to allow inbound…

Incorrect: This would allow inbound internet traffic directly to instances.

Trap 2: Attach an internet gateway to the private subnet's route table.

Incorrect: This would make the private subnet public, allowing inbound traffic.

Trap 3: Create a VPC gateway endpoint for Amazon S3.

Incorrect: VPC endpoints provide access to specific AWS services, not general internet.

Study all Infrastructure Security common traps →

A
Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.
Why wrong: Incorrect: This would allow inbound internet traffic directly to instances.
B
Add a route in the private subnet's route table pointing to the NAT gateway.
Correct: This routes outbound internet traffic through the NAT gateway.
C
Attach an internet gateway to the private subnet's route table.
Why wrong: Incorrect: This would make the private subnet public, allowing inbound traffic.
D
Create a VPC gateway endpoint for Amazon S3.
Why wrong: Incorrect: VPC endpoints provide access to specific AWS services, not general internet.
E
Deploy a NAT gateway in a public subnet.
Correct: NAT gateway enables outbound internet access from private subnets.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Infrastructure Security explanation →

Refer to the exhibit. A security engineer finds the above IAM policy attached to an IAM group. The policy is intended to allow all EC2 actions only from the corporate network (10.0.0.0/8). However, users report that they can perform EC2 actions from outside the corporate network. What is the MOST likely reason?

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
```

Trap 1: The IAM group has an additional policy that allows all EC2 actions…

Incorrect: While possible, the most likely reason is the console IP issue, not additional policies.

Trap 2: The policy allows access to all EC2 actions, but the condition only…

Incorrect: The condition does apply to the allowed actions.

Trap 3: The policy should use a NotIpAddress condition instead of IpAddress.

Incorrect: Using NotIpAddress would deny the specified range, which is not the issue.

Study all Infrastructure Security common traps →

A
The IAM group has an additional policy that allows all EC2 actions without conditions.
Why wrong: Incorrect: While possible, the most likely reason is the console IP issue, not additional policies.
B
The policy allows access to all EC2 actions, but the condition only applies to the ec2:* actions, which includes all EC2 actions.
Why wrong: Incorrect: The condition does apply to the allowed actions.
C
The aws:SourceIp condition key does not apply to API calls made through the AWS Management Console; the console uses AWS IP addresses.
Correct: Console API calls originate from AWS IPs, not the user's client IP, so the condition is ineffective.
D
The policy should use a NotIpAddress condition instead of IpAddress.
Why wrong: Incorrect: Using NotIpAddress would deny the specified range, which is not the issue.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Infrastructure Security explanation →

A company runs a web application on EC2 instances in an Auto Scaling group across two Availability Zones. The instances are behind an Application Load Balancer. The security team wants to ensure that only the ALB can send traffic to the instances. The instances are in a security group named 'app-sg'. Currently, 'app-sg' has an inbound rule allowing HTTP traffic from 0.0.0.0/0. The team wants to restrict access to only the ALB's security group. The ALB is in a security group named 'alb-sg'. Which course of action should the security engineer take to meet the requirement with minimal disruption?

Trap 1: Modify the inbound rule of 'app-sg' to allow HTTP traffic from the…

Incorrect: ALB node IPs are dynamic and managed by AWS; this approach is not scalable or reliable.

Trap 2: Modify the inbound rule of 'app-sg' to allow HTTPS traffic from…

Incorrect: This still allows traffic from anywhere, not just the ALB, and does not restrict source.

Trap 3: Modify the inbound rule of 'app-sg' to allow HTTP traffic from the…

Incorrect: ENIs are not static and referencing them is not a best practice for security group rules.

Study all Infrastructure Security common traps →

A
Modify the inbound rule of 'app-sg' to allow HTTP traffic from the private IP addresses of the ALB nodes.
Why wrong: Incorrect: ALB node IPs are dynamic and managed by AWS; this approach is not scalable or reliable.
B
Modify the inbound rule of 'app-sg' to allow HTTPS traffic from 0.0.0.0/0 and remove the HTTP rule.
Why wrong: Incorrect: This still allows traffic from anywhere, not just the ALB, and does not restrict source.
C
Modify the inbound rule of 'app-sg' to allow HTTP traffic from the ALB's elastic network interface (ENI).
Why wrong: Incorrect: ENIs are not static and referencing them is not a best practice for security group rules.
D
Modify the inbound rule of 'app-sg' to allow HTTP traffic from security group 'alb-sg'.
Correct: This restricts inbound traffic to only the ALB, as the ALB is associated with 'alb-sg'.

Full breakdown with real-world context →

Question 10mediumdrag order

Read the full Infrastructure Security explanation →

Drag and drop the steps to set up AWS Certificate Manager (ACM) for a custom domain in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediummatching

Read the full Infrastructure Security explanation →

Match each AWS Storage service encryption feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Server-side encryption with S3 managed keys

Server-side encryption with AWS KMS

Server-side encryption with customer-provided keys

Encryption at rest for EBS volumes

Encryption at rest for RDS instances

Question 12mediummultiple choice

Review the full subnetting walkthrough →

A company uses Network Load Balancer (NLB) in front of a fleet of EC2 instances in private subnets. Security team requires that the source IP addresses of clients be preserved in the access logs of the backend instances. Which configuration should the security engineer verify?

Trap 1: Configure proxy protocol v2 on the target group

Proxy protocol is not required for NLB; NLB preserves source IP by default.

Trap 2: Enable target group stickiness

Stickiness does not affect source IP preservation.

Trap 3: Enable cross-zone load balancing on the NLB

Cross-zone load balancing does not affect source IP preservation.

Study all Infrastructure Security common traps →

A
Configure proxy protocol v2 on the target group
Why wrong: Proxy protocol is not required for NLB; NLB preserves source IP by default.
B
Ensure the NLB is configured with a subnet from each Availability Zone and the targets are in the same subnets
NLB preserves source IP by default; no special configuration is needed.
C
Enable target group stickiness
Why wrong: Stickiness does not affect source IP preservation.
D
Enable cross-zone load balancing on the NLB
Why wrong: Cross-zone load balancing does not affect source IP preservation.

Full breakdown with real-world context →

Question 13hardmulti select

Read the full NAT/PAT explanation →

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Trap 1: S3 Interface Endpoint in the VPC

S3 does not support Interface Endpoints; only Gateway Endpoints are used.

Trap 2: VPC Peering to a shared services VPC

Not required for S3 access.

Trap 3: Internet Gateway attached to the VPC

Would allow inbound from internet, which is not desired.

Study all Infrastructure Security common traps →

A
S3 Interface Endpoint in the VPC
Why wrong: S3 does not support Interface Endpoints; only Gateway Endpoints are used.
B
VPC Peering to a shared services VPC
Why wrong: Not required for S3 access.
C
NAT Gateway in a public subnet
Allows outbound internet to EC2 instances in private subnets.
D
Internet Gateway attached to the VPC
Why wrong: Would allow inbound from internet, which is not desired.
E
S3 Gateway Endpoint in the VPC
Provides private connectivity to S3 without internet.

Full breakdown with real-world context →

Question 14easymultiple choice

Read the full Infrastructure Security explanation →

A company is using AWS WAF to protect its Application Load Balancer (ALB). The security team wants to block requests that do not contain a valid API key in the HTTP header 'X-API-Key'. Which WAF rule type should be used?

Trap 1: String match condition

Does not support regex patterns.

Trap 2: Rate-based rule

Used for rate limiting requests.

Trap 3: IP set

Used for IP-based allow/block lists.

Study all Infrastructure Security common traps →

A
String match condition
Why wrong: Does not support regex patterns.
B
Regex pattern set
Can define a pattern for valid API keys and block invalid ones.
C
Rate-based rule
Why wrong: Used for rate limiting requests.
D
IP set
Why wrong: Used for IP-based allow/block lists.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full NAT/PAT explanation →

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

Trap 1: The network ACL for the private subnet is blocking outbound traffic

Default NACL allows all outbound; custom NACL would need explicit allow.

Trap 2: The private subnet route table does not have a route to the NAT…

It has a default route to the NAT Gateway.

Trap 3: The security group attached to the EC2 instance is blocking inbound…

Security group is stateful; outbound rule allows return traffic.

Study all Infrastructure Security common traps →

A
The network ACL for the private subnet is blocking outbound traffic
Why wrong: Default NACL allows all outbound; custom NACL would need explicit allow.
B
The NAT Gateway's security group is blocking outbound traffic to the internet
NAT Gateway's security group must allow outbound HTTPS to 0.0.0.0/0.
C
The private subnet route table does not have a route to the NAT Gateway
Why wrong: It has a default route to the NAT Gateway.
D
The security group attached to the EC2 instance is blocking inbound traffic
Why wrong: Security group is stateful; outbound rule allows return traffic.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full Infrastructure Security explanation →

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The connection is set up with a private VIF to a VPC using a virtual private gateway. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be implemented?

Trap 1: Configure TLS on the applications

Provides encryption at application layer, not network layer for all traffic.

Trap 2: Use a site-to-site VPN over the internet instead of Direct Connect

Does not leverage Direct Connect; uses internet which may be less secure.

Trap 3: Enable encryption on the Direct Connect private VIF

Direct Connect does not support native encryption on private VIF.

Study all Infrastructure Security common traps →

A
Configure TLS on the applications
Why wrong: Provides encryption at application layer, not network layer for all traffic.
B
Set up an IPsec VPN over the Direct Connect private VIF
Creates an encrypted tunnel over the private connection.
C
Use a site-to-site VPN over the internet instead of Direct Connect
Why wrong: Does not leverage Direct Connect; uses internet which may be less secure.
D
Enable encryption on the Direct Connect private VIF
Why wrong: Direct Connect does not support native encryption on private VIF.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Infrastructure Security explanation →

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which S3 bucket policy condition key should be used?

Trap 1: aws:VpcSourceIp

Not a valid condition key.

Trap 2: aws:SourceVpc

Used to restrict to a VPC, not a specific endpoint.

Trap 3: aws:SourceIp

Used to restrict by client IP address.

Study all Infrastructure Security common traps →

A
aws:VpcSourceIp
Why wrong: Not a valid condition key.
B
aws:SourceVpc
Why wrong: Used to restrict to a VPC, not a specific endpoint.
C
aws:SourceVpce
Restricts access to a specific VPC endpoint.
D
aws:SourceIp
Why wrong: Used to restrict by client IP address.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full NAT/PAT explanation →

A company is using AWS CloudFormation to deploy a multi-tier application. The security team requires that the database tier (RDS) be deployed in private subnets that are not directly routable from the application tier (EC2). The application tier must communicate with the database using an internal network path. Which solution meets these requirements?

Trap 1: Place the RDS instance in the same subnet as the application tier…

Does not meet the requirement of not being directly routable.

Trap 2: Use ClassicLink to connect the application tier to the RDS instance

ClassicLink is for EC2-Classic, not relevant.

Trap 3: Use a NAT Gateway in the application subnet to route traffic to the…

NAT is for outbound internet, not internal database access.

Study all Infrastructure Security common traps →

A
Place the RDS instance in the same subnet as the application tier and use security groups
Why wrong: Does not meet the requirement of not being directly routable.
B
Use ClassicLink to connect the application tier to the RDS instance
Why wrong: ClassicLink is for EC2-Classic, not relevant.
C
Use a NAT Gateway in the application subnet to route traffic to the RDS instance
Why wrong: NAT is for outbound internet, not internal database access.
D
Deploy the RDS instance in private subnets and use an RDS VPC Endpoint (Interface) in the application subnets
Allows private connectivity without direct routing.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Infrastructure Security explanation →

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

Trap 1: AWS Network Firewall

Provides network layer filtering, not application layer DDoS.

Trap 2: Amazon GuardDuty

Threat detection service, not mitigation.

Trap 3: AWS Firewall Manager

Used to centrally manage firewall rules, not mitigation.

Study all Infrastructure Security common traps →

A
AWS Network Firewall
Why wrong: Provides network layer filtering, not application layer DDoS.
B
Amazon GuardDuty
Why wrong: Threat detection service, not mitigation.
C
AWS Firewall Manager
Why wrong: Used to centrally manage firewall rules, not mitigation.
D
AWS WAF
Integrates with Shield Advanced for application layer DDoS mitigation.

Full breakdown with real-world context →

Question 20hardmulti select

Review the full subnetting walkthrough →

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Trap 1: Attach an Internet Gateway to the VPC

Would route to internet.

Trap 2: Create an S3 Interface Endpoint in the VPC

S3 does not support Interface Endpoints.

Trap 3: Use a NAT Gateway to route the traffic to the internet

Would use internet, not private.

Study all Infrastructure Security common traps →

A
Create an S3 Gateway Endpoint in the VPC
Provides private connectivity to S3.
B
Attach a VPC Endpoint Policy to the Gateway Endpoint to restrict access to the specific bucket
Controls access to the S3 bucket.
C
Attach an Internet Gateway to the VPC
Why wrong: Would route to internet.
D
Create an S3 Interface Endpoint in the VPC
Why wrong: S3 does not support Interface Endpoints.
E
Use a NAT Gateway to route the traffic to the internet
Why wrong: Would use internet, not private.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Infrastructure Security sessions

Start a Infrastructure Security only practice session

Every question in these sessions is drawn from the Infrastructure Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Infrastructure Security questions →Mixed SCS-C02 session

Frequently asked questions

What does the SCS-C02 exam test about Infrastructure Security?: Infrastructure Security questions on this certification test your ability to deploy and manage infrastructure security concepts in scenario-based situations.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Infrastructure Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Infrastructure Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SCS-C02 topics?: Use the topic links above to move to related areas, or go back to the SCS-C02 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SCS-C02 exam covers. They are not copied from any real exam or dump site.

Infrastructure Security only

10 questions 20 questions 30 questions 50 questions

Mixed SCS-C02 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SCS-C02 questions Infrastructure Security domain overview SCS-C02 exam guide

Exam traps to avoid

▸Selecting the most expensive service when a simpler managed option meets the requirement.
▸Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
▸Choosing a global service fix when the issue is region-specific.
▸Overlooking cost implications of cross-region data transfer in architecture questions.

Infrastructure Security practice questions

What to know about Infrastructure Security

Common Infrastructure Security exam traps

Infrastructure Security questions

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all Amazon S3 buckets across the organization have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which approach should be used to enforce this policy?

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

A security engineer is reviewing the SQS queue policy shown in the exhibit. The queue is subscribed to an SNS topic in the same account. The security team has a requirement that only the SNS topic should be allowed to send messages to the queue. What is the issue with this policy?

Exhibit

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Exhibit

Drag and drop the steps to set up AWS Certificate Manager (ACM) for a custom domain in the correct order.

Match each AWS Storage service encryption feature to its description.

A company uses Network Load Balancer (NLB) in front of a fleet of EC2 instances in private subnets. Security team requires that the source IP addresses of clients be preserved in the access logs of the backend instances. Which configuration should the security engineer verify?

A company is using AWS WAF to protect its Application Load Balancer (ALB). The security team wants to block requests that do not contain a valid API key in the HTTP header 'X-API-Key'. Which WAF rule type should be used?

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The connection is set up with a private VIF to a VPC using a virtual private gateway. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be implemented?

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which S3 bucket policy condition key should be used?

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Track your progress over time

Start a Infrastructure Security only practice session

Related SCS-C02 topic practice pages

Threat Detection and Incident Response practice questions

Security Logging and Monitoring practice questions

Identity and Access Management practice questions

Management and Security Governance practice questions