Troubleshoot network security.
7 practice questions under this official exam objective (SCS-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
7 total · page 1 of 1Immediately contain a running EC2 by associating a Deny-all NACL with its (sole-occupant)
A critical EC2 instance must be contained at once while staying running, and it has active connections. A network ACL is stateless, so a Deny rule for
Troubleshoot a cross-subnet connection failure by inspecting Network ACL DENY rules
Two EC2 instances in different subnets cannot connect, though other hosts in the same subnets communicate and security groups already have valid ALLOW
Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL
A custom NACL must permit outbound TLS to an internet service on 443 and block inbound MySQL 3306. Because NACLs are stateless, the return traffic for
Restrict the RDS subnet NACL to PostgreSQL 5432 from the app subnet with ephemeral outboun
A web tier (ALB/WAF on 80/443 → EC2 on 80) fronts an RDS for PostgreSQL (5432) in dedicated private subnets, and all NACLs currently allow all traffic
Verify the security group on the server's ENI and that the instance is registered as an AL
One web server receives no inbound internet traffic while the others work, and the SG, NACL, and virtual-appliance rule sets are already confirmed cor
Add a network ACL Deny for the port and source IP to block the suspicious traffic
A single EC2 instance is getting suspicious traffic on an open TCP port from an external source, and the app must stay available to others. Security g
Deny all outbound at the NACL, isolate with a diagnostics security group, and investigate
A suspicious EC2 is connecting to malicious addresses. To immediately mitigate and preserve evidence, update the subnet NACL's outbound rules to expli