Infrastructure Security — SCS-C02 Practice Quiz

Question 1

A healthcare company operates a public web application behind CloudFront and an Application Load Balancer. A form collects patients' credit card numbers and Social Security numbers. Compliance requires that these specific fields remain encrypted from the moment they enter the AWS edge, so that even the application servers and downstream microservices cannot read them — only a dedicated payment processing service holding a private key may decrypt them. The rest of the request must remain readable for normal application processing. Which CloudFront capability meets this requirement with the least change to backend components?

Accepted Answer

Enable CloudFront field-level encryption with a public key configuration so the specified sensitive fields are encrypted at the edge before forwarding to the origin.

Answer

Attach an AWS WAF web ACL to the distribution with a rule that masks the sensitive form fields before they reach the origin.

Answer

Require HTTPS between the viewer and CloudFront and between CloudFront and the origin using a custom ACM certificate to protect the fields in transit.

Answer

Use a CloudFront Function on the viewer request event to hash the sensitive fields with SHA-256 before they are forwarded to the ALB.

Question 2

A media company streams licensed video content through Amazon CloudFront. Licensing agreements require that content be accessible only from viewers in Canada and the United States. Additionally, the security team wants to block a specific list of malicious IP addresses regardless of their geographic origin, and they want both controls applied at the edge with the lowest possible latency and cost. Which combination of controls should the security engineer implement?

Accepted Answer

Use CloudFront geographic restrictions (geo-blocking) to allow only Canada and the US, and associate an AWS WAF web ACL with an IP set rule to block the malicious IPs

Answer

Use AWS WAF geo-match rules to allow only Canada and the US, and configure security groups on the origin to block the malicious IP addresses

Answer

Use CloudFront geographic restrictions for both the country allow-list and the malicious IP blocking, since geo-restriction supports CIDR deny lists

Answer

Use a Lambda@Edge function to inspect the CloudFront-Viewer-Country header and the source IP, rejecting requests that do not match policy

Question 3

A company serves static content from a private S3 bucket through a CloudFront distribution. Security review reveals that the S3 objects can still be downloaded directly using their public S3 URLs, bypassing CloudFront (and its attached WAF web ACL). The team must ensure content is only reachable through CloudFront while following current AWS best practices. What should they implement?

Accepted Answer

Configure an Origin Access Control (OAC) on the CloudFront origin and update the S3 bucket policy to allow only the distribution's service principal, while keeping public access blocked.

Answer

Enable S3 Block Public Access on the bucket and rely on CloudFront's default behavior to make direct object access impossible.

Answer

Attach the WAF web ACL directly to the S3 bucket so the same Layer 7 rules are enforced regardless of access path.

Answer

Make the S3 bucket public and add a bucket policy that only allows requests originating from CloudFront edge location IP ranges.

Question 4

A media company serves video thumbnails and metadata through CloudFront backed by an Application Load Balancer in a single AWS Region. During viral traffic spikes, they observe that origin request volume overwhelms the ALB even though most objects are cacheable, because CloudFront has many regional edge caches making independent requests to the origin on cache misses. The security team also wants to minimize the origin's exposure to direct request bursts. Which CloudFront configuration change most directly reduces redundant origin fetches and consolidates requests to the origin?

Accepted Answer

Enable CloudFront Origin Shield in the Region closest to the origin so cache misses are consolidated through a single additional caching layer

Answer

Attach an AWS WAF rate-based rule to the CloudFront distribution to throttle requests before they reach the origin

Answer

Increase the default TTL to the maximum and rely on regional edge caches to independently serve traffic without contacting the origin

Answer

Replace the ALB origin with an Origin Access Control configuration to authenticate all origin requests

Question 5

A media company stores premium video files in an S3 bucket and serves them to paying subscribers through a CloudFront distribution. The security team requires that each video link works only for a specific authenticated subscriber and automatically stops working after 6 hours. Direct S3 access must remain blocked, and links must not be shareable in a way that grants indefinite access. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable CloudFront signed URLs with a time-limited expiration policy, and use Origin Access Control (OAC) so the S3 bucket only accepts requests from the distribution.

Answer

Attach an AWS WAF web ACL to the distribution with a rate-based rule that limits each subscriber to a fixed number of requests per 6 hours.

Answer

Enable S3 presigned URLs generated by the application and point subscribers directly to the S3 object URLs instead of using CloudFront.

Answer

Configure a CloudFront geo-restriction allow list and require subscribers to log in through Cognito before each playback session.

Question 6

A security engineer is reviewing a fleet of EC2 instances that run a web application behind an Application Load Balancer. A recent penetration test found that the application is vulnerable to server-side request forgery (SSRF), and the tester was able to retrieve temporary IAM role credentials from the instance metadata service. The engineer must harden the instances to prevent this specific class of credential theft without redeploying the application. Which action most directly mitigates the risk?

Accepted Answer

Enforce Instance Metadata Service Version 2 (IMDSv2) with a session token requirement and set the metadata hop limit to 1 on the instances.

Answer

Attach a more restrictive IAM policy to the instance role so that the exposed credentials have no usable permissions.

Answer

Add a security group rule that blocks outbound traffic to 169.254.169.254 from the instances.

Answer

Enable termination protection and rotate the instance profile credentials every hour with a scheduled Lambda function.

Question 7

A financial services company connects its on-premises data center to AWS using a 10 Gbps AWS Direct Connect dedicated connection over a private VIF. A compliance auditor mandates that all data traversing the Direct Connect link between on-premises and the VPC must be encrypted in transit at the network layer. The solution must maintain use of the existing Direct Connect connection. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Configure an AWS Site-to-Site VPN connection running over the Direct Connect connection using a public VIF, so IPsec encrypts traffic across the link.

Answer

Enable MACsec on the private VIF to provide encryption without changing the network topology.

Answer

Rely on the physical isolation of the Direct Connect connection, since dedicated connections are inherently private and do not require encryption.

Answer

Terminate the Direct Connect connection and replace it entirely with a Site-to-Site VPN over the public internet to guarantee IPsec encryption.

Question 8

A security engineer configured a custom network ACL on a public subnet hosting a web server. Inbound rules allow TCP 443 from 0.0.0.0/0, and outbound rules allow only TCP 443 to 0.0.0.0/0. Users report that HTTPS requests to the web server time out, even though the security group correctly allows inbound 443. What is the most likely cause?

Accepted Answer

The NACL outbound rules do not allow the ephemeral port range required to return response traffic to clients.

Answer

Network ACLs are stateful, so the inbound 443 rule already covers return traffic; the security group must be the problem.

Answer

The NACL is missing an inbound rule allowing ICMP, which is required to complete the TCP handshake.

Answer

Outbound TCP 443 rules must specify the client IP addresses explicitly rather than 0.0.0.0/0.

Question 9

A company runs multiple application VPCs connected through a Transit Gateway to a central egress VPC that provides internet access via NAT gateways. Security requires all outbound traffic from every application VPC to be inspected by AWS Network Firewall before reaching the internet, with a single centrally managed firewall policy. Which architecture meets this requirement most effectively?

Accepted Answer

Deploy AWS Network Firewall endpoints in a dedicated inspection VPC attached to the Transit Gateway, and use Transit Gateway route tables to route application VPC traffic through the inspection VPC before reaching the egress VPC's NAT gateways.

Answer

Deploy a separate AWS Network Firewall in each application VPC and replicate an identical firewall policy to each firewall using a CloudFormation StackSet.

Answer

Attach an AWS WAF Web ACL to each NAT gateway in the central egress VPC to inspect outbound traffic against the managed firewall policy.

Answer

Route all application VPC traffic through a single security group referencing the Network Firewall endpoint's elastic network interface in the egress VPC.

Question 10

A financial services company runs a fleet of EC2 instances in private subnets that must reach only a small, approved set of external SaaS endpoints (identified by domain name) over HTTPS. Traffic to any other external destination must be blocked and logged. The instances have no public IPs and route outbound traffic through a NAT gateway. Security groups and NACLs currently allow all outbound traffic on port 443. Which solution best enforces domain-based egress filtering with centralized inspection and logging?

Accepted Answer

Deploy AWS Network Firewall with a Suricata-compatible stateful rule group that allows only the approved TLS SNI domains and drops all other traffic, then route the private subnets' outbound traffic through the firewall endpoints.

Answer

Replace the security group rules with domain-name-based outbound rules that reference the approved SaaS FQDNs and deny all other destinations.

Answer

Attach AWS WAF to the NAT gateway with a rule that inspects the Host header and blocks requests to unapproved domains.

Answer

Create NACL entries on the private subnets that permit outbound traffic only to the resolved IP addresses of the approved SaaS domains and deny the rest.

Question 11

A financial services company routes all outbound VPC traffic through AWS Network Firewall. Their security team wants to inspect the contents of encrypted HTTPS connections leaving the VPC to detect data exfiltration in payloads, not just filter on SNI or domain names. They need this to work without deploying and managing third-party proxy appliances. Which approach meets this requirement?

Accepted Answer

Enable TLS inspection on the Network Firewall firewall policy using a certificate managed in AWS Certificate Manager, and configure a TLS inspection configuration referencing that certificate.

Answer

Add a Suricata stateful rule that matches on the TLS SNI field to inspect the encrypted payload contents.

Answer

Enable VPC Flow Logs with the custom format including the TLS version field to capture and analyze the decrypted payload.

Answer

Configure a domain-list stateful rule group with an allow list, which automatically decrypts and scans matching HTTPS traffic.

Question 12

A security team must inspect all north-south internet traffic for a fleet of VPCs using a specialized third-party intrusion prevention system (IPS) appliance that the company already licenses. The appliance must be deployed horizontally scalable behind a load balancer, with traffic transparently redirected to it for deep packet inspection before reaching the internet, while preserving the original source and destination IP addresses. Which AWS service should the team use to integrate this third-party appliance into the traffic path?

Accepted Answer

Deploy the appliances behind a Gateway Load Balancer and use GWLB endpoints with route table redirection to send traffic through the appliances using GENEVE encapsulation

Answer

Deploy AWS Network Firewall in a central inspection VPC and configure stateful rule groups to forward matched traffic to the third-party appliance

Answer

Place the appliances behind a Network Load Balancer and use security group references to force all VPC traffic through the appliance ENIs

Answer

Deploy the appliances behind an Application Load Balancer and use AWS WAF to route inspected Layer 7 traffic to the appliance target group

Question 13

A company runs a three-tier application in a VPC with public and private subnets across two Availability Zones. The security team wants centralized, stateful inspection of all north-south traffic (internet-bound and inbound) with the ability to apply Suricata-compatible intrusion prevention signatures. They also require that the inspection layer be highly available and managed by AWS rather than self-managed EC2 appliances. Which deployment approach meets these requirements?

Accepted Answer

Deploy AWS Network Firewall with firewall endpoints in dedicated inspection subnets in each AZ, and update route tables so traffic between the internet gateway and workload subnets is routed through the firewall endpoints.

Answer

Configure stateful network ACLs on the workload subnets with rules that reference the Suricata rule groups, and attach them to each subnet in both AZs.

Answer

Attach security groups with intrusion-prevention rule sets to the EC2 instances in each tier and enable stateful packet inspection at the ENI level.

Answer

Deploy a fleet of self-managed IDS/IPS EC2 instances behind a Gateway Load Balancer in each AZ and route traffic through them using a GWLB endpoint.

Question 14

A financial services company runs a proprietary risk-scoring API on EC2 instances behind a Network Load Balancer in a producer VPC. Several partner organizations in separate AWS accounts must consume this API. Security requirements state that the traffic must never traverse the public internet, partners must not be able to reach any other resources in the producer VPC, and the producer must explicitly approve each partner before access is granted. Which solution meets all of these requirements?

Accepted Answer

Create an AWS PrivateLink endpoint service backed by the NLB, disable auto-acceptance of endpoint connections, and have each partner create an interface VPC endpoint to the service.

Answer

Create a VPC peering connection between the producer VPC and each partner VPC, and use security group references to restrict access to the NLB.

Answer

Publish the API through Amazon API Gateway with an AWS WAF web ACL and share the invoke URL with partners, restricting access with resource policies.

Answer

Attach all accounts to a Transit Gateway and use route tables to allow partner VPCs to reach only the NLB subnet in the producer VPC.

Question 15

A financial services company runs an application on EC2 instances in a private subnet with no internet access and no NAT gateway. The application must call the Amazon DynamoDB and Amazon Kinesis APIs, and the security team mandates that all traffic to these services stay entirely within the AWS network and never traverse the public internet. What is the MOST appropriate way to enable this connectivity?

Accepted Answer

Create a gateway VPC endpoint for DynamoDB and an interface VPC endpoint (AWS PrivateLink) for Kinesis, then update route tables and security groups accordingly.

Answer

Deploy a NAT gateway in a public subnet and add a default route from the private subnet so the instances can reach the service public endpoints.

Answer

Create interface VPC endpoints for both DynamoDB and Kinesis and disable private DNS to force traffic through the endpoints.

Answer

Attach an internet gateway to the VPC and restrict outbound access using a network ACL that only allows the DynamoDB and Kinesis CIDR ranges.

Question 16

A company runs an internal microservice behind a Network Load Balancer and exposes it as a PrivateLink endpoint service. A consumer account creates an interface VPC endpoint to reach the service. The consumer's application, running on EC2 instances in a private subnet, receives connection timeouts when calling the endpoint's DNS name. Traffic never appears in the provider's target logs. Which action is most likely required to resolve the connectivity issue?

Accepted Answer

Attach a security group to the interface endpoint's elastic network interfaces that allows inbound traffic on the service port from the consumer application's security group or subnet CIDR.

Answer

Add an inbound rule to the provider's Network Load Balancer security group permitting the consumer VPC CIDR.

Answer

Enable cross-zone load balancing on the provider's Network Load Balancer so the endpoint can reach targets in all Availability Zones.

Answer

Modify the endpoint service acceptance settings to auto-accept the consumer's connection request.

Question 17

A company runs a fleet of EC2 instances across several private subnets in a VPC. The security team discovers that a compromised host attempted to exfiltrate data by resolving and connecting to a series of dynamically generated command-and-control (C2) domains. The team wants a managed AWS control that inspects outbound DNS queries at the VPC level and blocks queries to known-malicious and custom-defined domains, without deploying agents on each instance. Which solution best meets this requirement?

Accepted Answer

Associate a Route 53 Resolver DNS Firewall rule group with the VPC, using AWS Managed Domain Lists and a custom domain list to block malicious domain resolution.

Answer

Configure a network ACL on each private subnet to deny outbound UDP and TCP port 53 traffic to unknown destinations.

Answer

Enable AWS Network Firewall with a stateless rule group that drops packets destined for the C2 IP addresses.

Answer

Deploy AWS WAF with a rate-based rule to block the DNS queries originating from the compromised instances.

Question 18

A company runs a three-tier application in a single VPC. The web tier (behind an internet-facing ALB) must reach the app tier on TCP 8080, and the app tier must reach the database tier on TCP 5432. Instances scale in and out frequently via Auto Scaling, so their IP addresses change constantly. The security team wants the tightest possible network controls that do not require manual updates as instances are added or removed. How should the security groups be configured?

Accepted Answer

In the app-tier security group, allow inbound TCP 8080 from the web-tier security group ID; in the database-tier security group, allow inbound TCP 5432 from the app-tier security group ID.

Answer

Allow inbound TCP 8080 and 5432 from the VPC CIDR block in each tier's security group so all instances can communicate regardless of scaling.

Answer

Use NACLs on each subnet to allow the specific ports and dynamically update the NACL rules with a Lambda function whenever Auto Scaling launches an instance.

Answer

Allow inbound TCP 8080 and 5432 from a maintained list of current instance private IP addresses, refreshed by a scheduled automation job.

Question 19

A company runs a three-tier application in a VPC. The database tier EC2 instances are in private subnets, and the application tier must connect to them on TCP 5432. A security engineer configures the database instances' security group to allow inbound TCP 5432 only from the application tier's security group. However, the engineer forgets to add any outbound rule allowing return traffic to the application tier. During testing, application-to-database connections succeed normally. Why do the connections still work despite the missing explicit outbound allow rule?

Accepted Answer

Security groups are stateful, so return traffic for an allowed inbound connection is automatically permitted regardless of outbound rules.

Answer

The default network ACL on the subnet allows all outbound traffic, which overrides the security group's missing rule.

Answer

Security groups implicitly allow all outbound traffic because the default outbound rule permits all traffic, which was left in place.

Answer

The application tier security group's outbound rule to the database opens the return path automatically.

Question 20

A company runs a fleet of Linux EC2 instances in private subnets with no route to the internet and no public IP addresses. Security policy prohibits any inbound SSH access and forbids deploying bastion hosts. Administrators still need interactive shell access for troubleshooting, and all sessions must be logged for audit. Which approach meets these requirements with the least additional attack surface?

Accepted Answer

Use AWS Systems Manager Session Manager with the SSM Agent, VPC interface endpoints for ssm, ssmmessages, and ec2messages, and an instance profile granting the required SSM permissions; log session output to S3/CloudWatch Logs.

Answer

Deploy a NAT gateway so the instances can reach the SSM public endpoints over the internet, then connect via Session Manager.

Answer

Open TCP 22 in the security group only to the corporate CIDR range and connect over the Direct Connect link.

Answer

Create an EC2 Instance Connect Endpoint and allow inbound SSH from the endpoint's security group to the instances.

More SCS-C02 practice