Infrastructure Security — SCS-C03 Practice Quiz

Question 1

A media company serves static video assets from an S3 bucket through a CloudFront distribution. The security team discovers that users can bypass CloudFront and download objects directly using the S3 bucket's website endpoint URLs, avoiding WAF rules and geo-restrictions applied at the edge. The team wants to ensure all access to the S3 objects is only possible through CloudFront, using the most current AWS-recommended mechanism. What should they implement?

Accepted Answer

Configure an Origin Access Control (OAC) on the CloudFront distribution and update the S3 bucket policy to allow access only from that distribution via the aws:SourceArn condition, while blocking all other principals.

Answer

Enable S3 Block Public Access on the bucket and add a bucket policy that allows the CloudFront service principal without any condition keys.

Answer

Attach a custom secret header at CloudFront and use an S3 bucket policy that validates the header value on every GetObject request.

Answer

Create a legacy Origin Access Identity (OAI), associate it with the origin, and enable the S3 static website hosting endpoint as the CloudFront origin.

Question 2

A security team operates a public web application served through Amazon CloudFront with an Application Load Balancer origin. A recent penetration test flagged that the application does not enforce HTTP Strict Transport Security (HSTS) and is missing X-Content-Type-Options and X-Frame-Options headers on responses. The development team is busy and cannot modify the application code for several sprints. The team needs a way to consistently add these security headers to all responses at the edge with minimal operational effort. Which approach best meets this requirement?

Accepted Answer

Attach a CloudFront response headers policy that includes the security headers configuration to the distribution's cache behavior.

Answer

Deploy an AWS WAF web ACL with a custom rule that injects the security headers into every HTTP response.

Answer

Configure the Application Load Balancer listener rules to add the security response headers before returning traffic to CloudFront.

Answer

Enable AWS Shield Advanced on the distribution and turn on the automatic security header enforcement feature.

Question 3

A retail company serves its web application through Amazon CloudFront with an Application Load Balancer (ALB) origin. AWS WAF is associated with the CloudFront distribution to filter malicious requests. During a security review, the team discovers that attackers are bypassing CloudFront by sending requests directly to the ALB's public DNS name, avoiding the WAF rules entirely. The ALB must remain internet-facing to support the CloudFront integration. Which combination of controls MOST effectively ensures that only CloudFront-originated traffic reaches the ALB?

Accepted Answer

Configure CloudFront to add a custom HTTP header with a secret value, and add an ALB listener rule that forwards only requests containing that header while restricting the ALB security group to the AWS-managed CloudFront prefix list.

Answer

Attach AWS WAF directly to the ALB with the same rules and remove WAF from the CloudFront distribution to consolidate inspection at the origin.

Answer

Enable AWS Shield Advanced on the ALB and create a Network ACL that denies all inbound traffic except from CloudFront edge locations.

Answer

Place the ALB in a private subnet and use a NAT gateway so CloudFront can reach it while blocking direct public access.

Question 4

A company runs a web application on EC2 instances in a private subnet behind an internet-facing Application Load Balancer. A security engineer adds an inbound rule to the subnet's network ACL allowing TCP port 443 from 0.0.0.0/0 so users can reach the application. Users report that connections still time out. The instances' security group already allows inbound 443 from the ALB security group and all outbound traffic. What is the MOST likely cause and correct fix?

Accepted Answer

Network ACLs are stateless, so the subnet's outbound (egress) NACL rules must explicitly allow the ephemeral return port range (e.g., TCP 1024-65535) to the client; add that egress rule.

Answer

Security groups are stateless, so an explicit outbound rule allowing the client ephemeral port range must be added to the instance security group.

Answer

The inbound NACL rule must reference the ALB security group ID instead of a CIDR block; change the source to the ALB security group.

Answer

NACL rules are evaluated by lowest rule number first, so the port 443 rule is being overridden by a lower-numbered deny; renumber the 443 rule to 1.

Question 5

A company operates a multi-VPC environment connected through an AWS Transit Gateway. Security policy requires that all traffic between VPCs (east-west) and all traffic to the internet (north-south) pass through a centralized AWS Network Firewall for stateful inspection. The security engineer creates a dedicated inspection VPC with AWS Network Firewall endpoints deployed across Availability Zones. Which routing configuration ensures traffic is correctly directed to the firewall endpoints for inspection without asymmetric routing issues?

Accepted Answer

Attach the inspection VPC to the Transit Gateway using a separate route table, configure spoke VPC routes to send traffic to the Transit Gateway, and use appliance mode on the inspection VPC attachment so return traffic uses the same Availability Zone endpoint.

Answer

Deploy the Network Firewall endpoints directly in each spoke VPC subnet and add security group rules referencing the firewall ENIs to force traffic through inspection.

Answer

Configure the Transit Gateway route table to blackhole all inter-VPC traffic and rely on VPC peering with route tables pointing to the firewall endpoints.

Answer

Enable Transit Gateway multicast and point spoke VPC default routes to the internet gateway, allowing the firewall to inspect mirrored traffic via VPC Traffic Mirroring.

Question 6

A company runs hundreds of EC2 instances across multiple private subnets in a single VPC. Security policy requires that outbound HTTPS traffic to the internet be allowed ONLY to an approved list of fully qualified domain names (for example, updates.vendor.com and api.partner.com), and all other outbound traffic must be denied and logged. The solution must be centrally managed, scale with the fleet, and inspect traffic at the application layer without deploying agents on the instances. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Network Firewall in the VPC with a stateful rule group using domain list (FQDN) filtering for the approved domains, route outbound subnet traffic through the firewall endpoints, and enable alert/flow logging.

Answer

Configure security group outbound rules referencing the approved domain names and attach them to every instance, then use VPC Flow Logs to capture denied traffic.

Answer

Create network ACL egress rules that allow HTTPS only to the resolved IP addresses of the approved domains and deny all other outbound traffic.

Answer

Deploy AWS WAF with a rule set matching the approved host headers and associate it with the internet gateway to filter outbound requests.

Question 7

A security engineer deploys AWS Network Firewall in a dedicated inspection subnet to centrally filter egress traffic from several spoke VPCs connected via a transit gateway. After deployment, users report that some outbound connections intermittently fail, while others succeed. VPC Flow Logs show that return traffic for the failing flows is bypassing the firewall endpoint and being dropped by the stateful engine as unsolicited. What is the MOST likely root cause and the correct remediation?

Accepted Answer

The route tables create asymmetric routing where forward and return packets do not both traverse the firewall endpoint; fix by ensuring the inspection subnet, transit gateway attachment, and IGW route tables all route symmetrically through the same firewall endpoint in the same Availability Zone.

Answer

The Network Firewall policy is missing a stateless default action; set the stateless default action to 'forward to stateful rules' to allow the return packets.

Answer

The security group on the firewall endpoint is dropping return traffic; add an explicit inbound allow rule for ephemeral ports since Network Firewall endpoints are not stateful.

Answer

The stateful rule group is evaluating in strict order and blocking established connections; change the rule order evaluation to 'default action order' so established flows are permitted.

Question 8

A financial services company routes all outbound traffic from a workload VPC through AWS Network Firewall for inspection. Compliance requires that EC2 instances can only reach a fixed set of external SaaS domains over HTTPS. The instances do NOT use a forward proxy, and the security team wants to avoid decrypting traffic due to certificate-handling overhead. They need the firewall to allow only the approved domains and block all other HTTPS destinations. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Create a stateful rule group with domain-list filtering that matches the TLS SNI (server name) for the approved HTTPS domains and set the default action to drop other traffic.

Answer

Configure a stateless rule group that filters on destination IP address ranges published by each SaaS provider and drops all other outbound packets.

Answer

Enable TLS inspection on the firewall, decrypt all outbound HTTPS, and use HTTP host-header rules to allow only the approved domains.

Answer

Use security group egress rules referencing the SaaS provider DNS names to permit only approved outbound connections.

Question 9

A financial services company routes all outbound VPC traffic through AWS Network Firewall. The security team must inspect the payload of outbound HTTPS connections to detect data exfiltration hidden inside encrypted sessions, while allowing employees to reach approved SaaS providers. Currently, Network Firewall can only match on the SNI of the TLS handshake and cannot see inside the encrypted traffic. Which approach lets the firewall inspect the decrypted application-layer content at scale without deploying third-party proxy appliances?

Accepted Answer

Configure a TLS inspection configuration on the Network Firewall firewall policy, associating an ACM certificate so the firewall can decrypt, inspect, and re-encrypt outbound traffic.

Answer

Enable VPC Flow Logs with the full packet-capture option so the stateful engine can reconstruct and inspect the plaintext payload.

Answer

Add a Suricata rule that references the TLS session keys exported by the client operating systems to decrypt the traffic in the stateful engine.

Answer

Attach an AWS WAF web ACL to the Network Firewall endpoint to perform Layer 7 inspection of the decrypted HTTPS requests.

Question 10

A company runs a multi-account AWS environment with a centralized inspection VPC. The security team must deploy a third-party next-generation firewall appliance (from a vendor in AWS Marketplace) to inspect all north-south and east-west traffic. They require the solution to scale automatically across multiple appliance instances, preserve traffic symmetry (return traffic reaches the same appliance), and integrate transparently into the existing traffic flow without requiring source/destination changes to packets. Which AWS service should they use to insert the third-party appliances into the traffic path?

Accepted Answer

Use Gateway Load Balancer with a GENEVE-based target group of the appliance instances and Gateway Load Balancer endpoints in each spoke VPC

Answer

Deploy AWS Network Firewall in the inspection VPC and import the vendor's rule set

Answer

Place the appliances behind a Network Load Balancer and update route tables to point at the NLB

Answer

Use an Application Load Balancer with the appliances as targets and enable sticky sessions for symmetry

Question 11

A security engineer needs to permanently block a single known-malicious external IP address from reaching any resource across all subnets in a production VPC. The VPC contains dozens of subnets and hundreds of EC2 instances managed by multiple teams, and each team independently controls its own security groups. The engineer wants a solution that enforces the block centrally at the subnet boundary, cannot be overridden by individual application teams modifying security groups, and requires the least ongoing administrative effort. Which approach best meets these requirements?

Accepted Answer

Add a DENY inbound rule for the malicious IP with a lower rule number than the allow rules to the network ACLs associated with each subnet in the VPC.

Answer

Add an inbound DENY rule for the malicious IP to every security group attached to the EC2 instances in the VPC.

Answer

Create an AWS WAF IP set containing the malicious IP and associate it with all instances in the VPC.

Answer

Configure VPC route tables to send traffic destined for the malicious IP to a blackhole route.

Question 12

A financial services company runs an internal fraud-scoring API on an Amazon EC2 fleet behind a Network Load Balancer in a provider VPC. They expose it to multiple consumer VPCs (belonging to different internal business units) through an AWS PrivateLink endpoint service. The security team requires that only specific approved consumer applications can send traffic to the service, and that the provider must enforce which source addresses within a consumer VPC can reach the endpoint at the network layer. Which approach correctly enforces this control on the traffic entering the interface endpoint from consumers?

Accepted Answer

Attach a security group to the interface VPC endpoint in each consumer VPC that permits inbound traffic only from the approved application security groups or CIDR ranges within that consumer VPC.

Answer

Configure a security group on the provider's Network Load Balancer that references the consumer VPC endpoint's private IP addresses to allow only approved sources.

Answer

Add an endpoint policy to the interface endpoint that specifies IAM principals allowed to invoke the fraud-scoring API.

Answer

Create a network ACL on the provider VPC subnets that allows inbound traffic only from the consumer VPC endpoint elastic network interface IPs.

Question 13

A company runs an internal payments API on EC2 instances behind a Network Load Balancer in their 'provider' VPC (account A). Multiple partner teams in separate AWS accounts (each with overlapping CIDR ranges) must consume this API privately, without traversing the public internet and without exposing the entire provider VPC. The security team requires that consumers cannot initiate connections back into the provider VPC and that traffic never leaves the AWS network. Which solution meets these requirements with the least ongoing operational overhead?

Accepted Answer

Create an AWS PrivateLink VPC endpoint service backed by the Network Load Balancer in account A, and have each partner account create interface VPC endpoints to consume the service.

Answer

Establish VPC peering connections between the provider VPC and each partner VPC, then update route tables and security groups to allow access to the NLB.

Answer

Deploy an AWS Transit Gateway, attach all VPCs, and configure route tables to allow partner accounts to reach the NLB in the provider VPC.

Answer

Publish the payments API through a public Application Load Balancer protected by AWS WAF and restrict access using security group references to partner account IPs.

Question 14

A company runs a fleet of EC2 instances in a private subnet that must only initiate outbound HTTPS connections to a specific partner's API at the IP range 203.0.113.0/24. A security review reveals the instances' security group currently allows all outbound traffic (0.0.0.0/0 on all ports). The security engineer must enforce least-privilege egress while ensuring return traffic from the partner API is still permitted. Which change satisfies these requirements with the least operational overhead?

Accepted Answer

Replace the default outbound rule with a single egress rule allowing TCP port 443 to destination 203.0.113.0/24, and rely on the security group's stateful behavior to permit return traffic.

Answer

Keep the outbound rule as 0.0.0.0/0 but add an inbound rule allowing only TCP port 443 from 203.0.113.0/24 so return traffic is explicitly matched.

Answer

Add a network ACL entry allowing outbound TCP 443 to 203.0.113.0/24 and an inbound ephemeral port range rule, leaving the security group unchanged.

Answer

Replace the outbound rule with TCP port 443 to 203.0.113.0/24 and also add an outbound rule for ephemeral ports 1024-65535 to 203.0.113.0/24 to allow responses back.

Question 15

A company runs a three-tier application in a single VPC. The web tier is an Auto Scaling group behind an internet-facing ALB, the application tier is an Auto Scaling group of EC2 instances, and the database tier is Amazon RDS. Instances scale frequently, so their private IP addresses change constantly. The security team wants the application tier to accept traffic only from the web tier, and the database tier to accept traffic only from the application tier, without maintaining CIDR-based rules that break when instances are replaced. What is the MOST maintainable way to configure the security groups?

Accepted Answer

In the application tier security group, add an inbound rule that references the web tier security group as the source, and in the database tier security group, add an inbound rule that references the application tier security group as the source.

Answer

Configure network ACLs on each tier's subnet to allow inbound traffic from the CIDR range of the tier above it, and update the ranges whenever the subnets change.

Answer

Create a shared security group attached to all three tiers that allows all internal VPC traffic, and rely on host-based firewalls to segment the tiers.

Answer

Assign Elastic IP addresses to every instance and reference those specific IPs as sources in each tier's inbound security group rules.

Question 16

A company runs a global web application behind an Application Load Balancer that is protected by AWS Shield Advanced. During a recent volumetric attack, the Shield Response Team (SRT) reported that Shield's automatic mitigations were sometimes triggered late, occasionally causing brief availability impact before mitigation engaged. The security team wants Shield Advanced to react faster and more accurately by incorporating the actual health of the protected application into its detection and mitigation decisions. Which action best achieves this?

Accepted Answer

Associate a Route 53 health check with the protected resource and enable health-based detection in Shield Advanced.

Answer

Enable AWS WAF rate-based rules on the ALB so that Shield Advanced can use the rule counters to trigger mitigations sooner.

Answer

Configure a CloudWatch alarm on ALB request count and grant Shield Advanced permission to read it for detection tuning.

Answer

Move the application behind CloudFront so Shield Advanced can apply mitigations at the edge instead of at the ALB.

Question 17

A financial services company runs a public web application behind an Application Load Balancer (ALB) fronted by CloudFront. During a recent event, the application experienced a large volume of HTTP GET floods that mimicked legitimate user traffic, causing backend exhaustion. The security team has already subscribed to AWS Shield Advanced. They want automatic layer 7 DDoS mitigation with the ability to have the AWS Shield Response Team (SRT) actively engage during attacks, and they want to minimize false positives against real users. Which configuration best meets these requirements?

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution, enable Shield Advanced automatic application layer DDoS mitigation on the protected resource, and configure the SRT engagement (proactive engagement) with contact details.

Answer

Rely on AWS Shield Standard's automatic layer 3/4 protections and add network ACL rules on the ALB subnets to rate-limit HTTP requests from suspicious source ranges.

Answer

Enable Shield Advanced on the ALB only, and create security group rules that drop connections exceeding a defined connections-per-second threshold at the instance level.

Answer

Configure AWS Network Firewall in front of the ALB with a stateful rule group that inspects HTTP payloads and drops GET floods, then grant the SRT read access to the firewall logs.

Question 18

A company runs an EC2-based application in private subnets that must read from and write to a specific S3 bucket named 'corp-finance-reports'. Security requirements state that traffic to S3 must not traverse the public internet, and the instances must be prevented from accessing any other S3 bucket, even if application credentials are compromised. A gateway VPC endpoint for S3 has already been created. Which additional configuration BEST enforces these requirements?

Accepted Answer

Attach a VPC endpoint policy to the S3 gateway endpoint that allows S3 actions only on the 'corp-finance-reports' bucket ARN and its objects, denying all other buckets.

Answer

Add an outbound security group rule on the instances allowing HTTPS only to the S3 prefix list, and rely on IAM instance role permissions for bucket scoping.

Answer

Enable S3 Block Public Access on the 'corp-finance-reports' bucket and add a bucket policy requiring the aws:SourceVpc condition.

Answer

Create an interface VPC endpoint for S3 in each private subnet and disable the gateway endpoint so all S3 calls resolve to private IP addresses.

Question 19

A company runs applications on-premises connected to an AWS VPC via an AWS Direct Connect connection. The security team wants on-premises servers to access Amazon Kinesis Data Streams privately, without traffic traversing the public internet, by using an interface VPC endpoint (powered by AWS PrivateLink). After creating the interface endpoint in the VPC, on-premises applications still cannot resolve the Kinesis endpoint DNS name to the private endpoint IP addresses. What is the recommended way to enable correct private DNS resolution for the on-premises hosts?

Accepted Answer

Create an Amazon Route 53 Resolver inbound endpoint in the VPC and configure on-premises DNS servers to forward queries for the AWS service domain to the inbound endpoint IP addresses.

Answer

Enable the 'Private DNS name' option on the interface endpoint and rely on it directly; on-premises resolvers will automatically use the private hosted zone.

Answer

Add the interface endpoint's private IP addresses to a public Route 53 hosted zone so on-premises hosts can resolve them over the internet.

Answer

Attach an internet gateway to the VPC and route on-premises DNS queries through a NAT gateway to reach the AWS service's public DNS.

Question 20

A company operates three VPCs: a Shared Services VPC (containing DNS resolvers and a centralized logging endpoint), a Production VPC, and a Development VPC. Security policy requires that both Production and Development can reach the Shared Services VPC, but Production and Development must NOT be able to communicate with each other under any circumstance. All three VPCs are connected through a single AWS Transit Gateway. A security engineer must enforce this isolation with the least operational overhead while keeping all traffic on the Transit Gateway. What is the MOST appropriate configuration?

Accepted Answer

Create two Transit Gateway route tables: associate the Production and Development attachments with a route table that only propagates the Shared Services route, and associate the Shared Services attachment with a route table that propagates both Production and Development routes.

Answer

Associate all three VPC attachments with a single Transit Gateway route table and rely on security groups in each VPC to block Production-to-Development traffic.

Answer

Replace the Transit Gateway with VPC peering connections between Shared Services and each spoke VPC, and add deny-all NACLs in Production and Development.

Answer

Enable appliance mode on the Transit Gateway and route all inter-VPC traffic through a firewall in the Shared Services VPC to inspect and drop Production-to-Development flows.

More SCS-C03 practice