SCS-C02 Infrastructure Security Practice Question
Which THREE are AWS best practices for securing an Amazon EC2 instance? (Choose three.)
⚠ Common exam trap
Test-takers frequently think instance metadata is a secure place to store credentials because it is convenient, but AWS explicitly warns against this due to the risk of exposure through SSRF or other instance-level vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use security groups to control inbound and outbound traffic.
Security groups act as a virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level. By default, security groups are stateful and allow only explicitly permitted traffic, which is a fundamental AWS best practice for network security. Using security groups helps implement the principle of least privilege by restricting access to only necessary ports and protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store database credentials in instance metadata for easy retrieval.
Why it's wrong here
Instance metadata is not secure; use AWS Secrets Manager or Parameter Store.
- ✗
Launch instances in the default VPC for easier network configuration.
Why it's wrong here
The default VPC has permissive rules; it is better to create a custom VPC with controlled access.
- ✓
Use security groups to control inbound and outbound traffic.
Why this is correct
Security groups are the primary mechanism for controlling network traffic to EC2 instances.
- ✓
Disable password-based authentication and use SSH key pairs instead.
Why this is correct
Key pairs provide stronger authentication than passwords.
- ✓
Regularly apply security patches using AWS Systems Manager Patch Manager.
Why this is correct
Patch Manager automates the process of patching instances.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.