Design and implement security controls for edge services.
9 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
9 total · page 1 of 1Build a cost-effective DDoS-resilient architecture with Auto Scaling, ELB, and CloudFront+
A web app on EC2 serving static content from S3 needs a DDoS-resilient architecture at the lowest cost. Placing the EC2 fleet in an Auto Scaling group
Mitigate credential stuffing with the WAF ATP rule and a password-reset redirect for affec
A WAF with the CRS already fronts the login ALB; the company needs to cut credential-stuffing success and avoid penalizing legitimate users. Adding th
Protect HLS CloudFront streams with signed cookies instead of per-chunk signed URLs
An HLS live stream served through CloudFront is split into thousands of chunks, and only authenticated subscribers should fetch them. Because a single
Block fraudulent foreign sign-ups with a pre-sign-up Lambda trigger and a Cognito WAF geo
A France-only app sees fraudulent sign-ups from outside France and needs custom accept/deny validation at registration. A pre sign-up AWS Lambda trigg
Attach a security group to the ALB that allows only inbound port 443
To guarantee an ALB accepts only HTTPS (443) even if someone adds an HTTP (80) listener, associate a security group whose only inbound rule allows 443
Request an ACM certificate, validate via DNS CNAMEs, and attach it to a CloudFront distrib
For managed distribution/caching with auto-renewing public certs on non-Route 53 domains, request an ACM certificate (for CloudFront it must be in us-
Use CloudFront OAC plus a bucket policy that allows only the OAC, and a WAF IP-set ACL
To serve an S3 static site only to specified IPs and block direct S3-URL access, create a CloudFront Origin Access Control (OAC) and set the bucket po
Use an ALB HTTPS listener security policy with a PFS cipher suite
TLS terminates at an ALB and must remain secure even if the certificate's private key is compromised. A listener security policy that enforces a Perfe
How to enforce a third-party WAF managed rule group across all accounts and Regions?
AWS WAF third-party managed rule groups can be enforced organization-wide through an AWS Firewall Manager WAF policy scoped to all accounts and Region