Design and implement network security controls.
13 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
13 total · page 1 of 1Add an S3 gateway endpoint and a KMS interface endpoint with private DNS in Account B's VP
Account B's EC2 fleet reads/writes an Account A S3 bucket (KMS-encrypted) and must make no AWS API calls over the internet, with no code change. Creat
Use S3 Object Lock compliance mode with replication to block admin deletion in the DR Regi
Critical S3 data must be protected from permanent deletion and replicated to a secondary Region, and even administrators must not be able to delete it
Verify that the VPC endpoint policy allows access to Amazon S3
All the usual layers check out (instance-profile IAM, S3 bucket policy, SG, NACL), yet the GetObject via the gateway endpoint still fails. The missing
Block public access on the bucket and use an SCP to deny disabling Public Access Block
An S3 bucket is publicly accessible and must be made private and kept private. Enabling S3 Block Public Access on the bucket stops all public access p
Write to a cross-account S3 bucket privately using a gateway VPC endpoint
An app in Account A's VPC must write to an S3 bucket in Account B in the same Region without using the public internet. The bucket policy already gran
Restore S3 GetObject access by fixing ListBucket, KMS Decrypt, and the gateway-endpoint bu
An EC2 app reaches S3 only through a gateway VPC endpoint, and objects are KMS-CMK encrypted. Three things can block GetObject: the instance profile l
Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL
A custom NACL must permit outbound TLS to an internet service on 443 and block inbound MySQL 3306. Because NACLs are stateless, the return traffic for
Restrict the RDS subnet NACL to PostgreSQL 5432 from the app subnet with ephemeral outboun
A web tier (ALB/WAF on 80/443 → EC2 on 80) fronts an RDS for PostgreSQL (5432) in dedicated private subnets, and all NACLs currently allow all traffic
How to Provide Keyless SSH Access to EC2 and On-Premises Servers?
AWS Systems Manager Session Manager provides keyless, temporary shell access to EC2 instances and on-premises servers without opening inbound SSH port
Deploy the Lambda functions to a private subnet and access S3 through an S3 gateway VPC en
Incident-response Lambda functions in a VPC must read/write an S3 bucket entirely on the AWS network. Deploy them in a private subnet and create an S3
Add an interface VPC endpoint for Secrets Manager
In a VPC with no internet, a Secrets Manager rotation Lambda in the VPC cannot reach the Secrets Manager endpoint. The most secure fix is an interface
Configure VPC Traffic Mirroring to copy packets to an IDS monitoring instance
A regulatory rule requires whole-packet inspection (promiscuous/IDS) of traffic to and from an EC2 workload. VPC Traffic Mirroring copies (mirrors) th
Which Network ACL Rule Set Allows TLS 443 and Denies MySQL 3306?
This SCS-C03 network ACL question tests stateless return traffic for outbound TLS 443 and an explicit inbound MySQL 3306 deny. The page establishes th