48 practice questions for Domain 3 of the AWS Certified Security - Specialty (SCS-C03) exam, which makes up 18% of its scored content. Your answers count towards one score and one timer for the whole exam.
Domain 3: Infrastructure Security
67. A public web application must be protected against SQL injection, cross-site scripting, and credential stuffing, with the rules maintained by AWS. Which solution meets these requirements?
Answer and explanation
Answer: B. WAF managed rule groups cover injection, scripting, and account takeover patterns and are updated by AWS, while rate-based rules throttle volumetric abuse. A rate-based rule alone misses low-and-slow credential stuffing. Shield Standard mitigates network and transport layer DDoS rather than application-layer exploits. A security group permits exactly the traffic the attack uses.
68. An organization must deploy and continuously enforce the same AWS WAF rules across every account from one place. Which solution meets these requirements?
Answer and explanation
Answer: A. Firewall Manager centrally creates and enforces WAF and other protection policies across an organization, remediating drift automatically. StackSets deploy resources without continuously enforcing them against local change. A service control policy restricts actions rather than requiring resources to exist. A Config rule reports without applying.
69. An Amazon CloudFront distribution must serve private content so that only authenticated application users can retrieve many objects under one path. Which solution meets these requirements?
Answer and explanation
Answer: D. Signed cookies grant time-limited access to objects matching a path pattern, which suits protecting many files without generating a URL for each. Origin Access Control stops direct origin access but does not authenticate viewers. Geographic restriction filters by country rather than by user. Forwarding a header passes it to the origin without CloudFront enforcing anything.
70. An application requires DDoS protection with access to the AWS response team and protection against attack-driven scaling charges. Which solution meets these requirements?
Answer and explanation
Answer: A. Shield Advanced adds enhanced DDoS mitigation, response team access, and cost protection against attack-driven scaling, which are the named requirements. Shield Standard is automatic but includes none of them. A rate-based WAF rule throttles requests without providing response team access or cost protection. CloudFront absorbs traffic but offers no cost protection commitment.
71. An EC2 instance must be prevented from exposing its instance profile credentials through a server-side request forgery vulnerability in the application. Which solution meets these requirements?
Answer and explanation
Answer: D. IMDSv2 requires a PUT to obtain a session token before any metadata read, which defeats the simple forged GET requests that server-side request forgery produces, and the hop limit restricts forwarding further. Disabling metadata breaks role-based credential retrieval. A security group cannot stop the application making a local metadata call. A permissions boundary limits what stolen credentials can do but does not prevent theft.
72. An organization must ensure that container images deployed to production have been scanned and originate from its own pipeline. Which combination of steps meets these requirements? (Select TWO.)
Answer and explanation
Answer: C, E. Scanning with a gate stops vulnerable images progressing, and signature verification at admission ensures only images the organization produced are deployed. Manual review does not scale. Push restrictions are useful access control but do not verify content or provenance at deployment. Runtime monitoring detects behaviour after the image is already running.
73. Engineers require shell access to EC2 instances in private subnets with full session recording and no inbound ports. Which solution meets these requirements?
Answer and explanation
Answer: A. Session Manager opens a shell through the SSM agent using IAM permissions with no inbound ports, and session logging records the full transcript. A bastion opens a port and adds an internet-facing host. An Instance Connect Endpoint avoids the bastion but does not by itself produce a session transcript. A VPN still requires SSH to be permitted and records no session.
74. A generative AI application built on Amazon Bedrock must be protected against prompt injection and disallowed content. Which solution meets these requirements?
Answer and explanation
Answer: A. Guardrails evaluate input and output at the service layer, and least-privilege tool permissions limit the damage of any injection that succeeds. A prompt instruction is part of the context an injection targets. Higher temperature adds randomness rather than a control. Restricting which model may be invoked does not filter content.
75. An organization must detect EC2 instances running software with known critical vulnerabilities, continuously and without deploying its own scanner. Which solution meets these requirements?
Answer and explanation
Answer: D. Inspector continuously assesses instances and container images for known vulnerabilities using the agent already present, with no scanning infrastructure to manage. GuardDuty detects threat activity rather than enumerating vulnerabilities. A Config rule would require the vulnerability logic to be written and maintained. Inventory lists installed software without assessing it against vulnerability data.
76. Patches must be applied to production instances only during an approved window, with per-instance compliance reporting. Which solution meets these requirements?
Answer and explanation
Answer: B. Patch Manager defines approved patches through a baseline, a maintenance window constrains when they are applied, and the service reports per-instance compliance. User data runs only at launch. A daily function ignores the approved window and reports nothing. Inspector identifies vulnerabilities without applying patches or reporting patch compliance.
77. Sensitive computation must run in an isolated environment with no persistent storage, no interactive access, and no external networking, on an EC2 instance. Which solution meets these requirements?
Answer and explanation
Answer: B. A Nitro Enclave provides an isolated execution environment with no persistent storage, no interactive access, and no external network, which matches every element of the requirement. A container shares the instance's kernel and network. A Dedicated Host isolates hardware without isolating execution. A VPC without an internet gateway still permits interactive access and storage.
78. Several network security controls must be matched to the behaviour that distinguishes each one. (Match each control to its behaviour.)
- Security group
- Network ACL
- AWS Network Firewall
- AWS Verified Access
Answer and explanation
Answer: 1-D, 2-A, 3-C, 4-B. The stateful and stateless distinction is what determines whether return traffic must be permitted explicitly, and it is the most common source of confusion between security groups and network ACLs. Network Firewall adds signature-based inspection that neither security groups nor network ACLs perform. Verified Access operates at the application request layer rather than on packets, which is why it appears here: it is a network security control in the exam's scope but not a packet filter.
79. All outbound traffic from a VPC must be filtered by domain name so that known malicious domains are blocked before any connection is attempted. Which solution meets these requirements?
Answer and explanation
Answer: B. DNS Firewall inspects Resolver queries and blocks domains in managed or custom lists, stopping resolution before a connection is attempted. Network ACLs and security groups filter by address and port and cannot evaluate domain names. WAF inspects inbound HTTP requests to protected resources rather than outbound DNS.
80. Traffic between spoke VPCs must pass through a stateful firewall, and both directions of a flow must reach the same firewall endpoint. Which configuration is required on the Transit Gateway attachment?
Answer and explanation
Answer: D. Appliance mode keeps both directions of a flow on the same Availability Zone endpoint, which stateful inspection requires to see the whole conversation. Equal-cost multipath spreads traffic and breaks flow symmetry. DNS support governs name resolution. Automatic acceptance controls how shared attachments are approved.
81. An Amazon S3 gateway endpoint must permit access only to buckets owned by the organization, so that data cannot be written to an external bucket. Which solution meets these requirements?
Answer and explanation
Answer: D. An endpoint policy with aws:ResourceOrgID restricts which buckets can be reached through the endpoint, so a request to an external bucket is denied regardless of credentials. Bucket policies protect the organization's own buckets but say nothing about external ones. Gateway endpoints do not take security groups. Denying outbound HTTPS would break S3 access entirely.
82. A security team must identify network paths that permit unintended access between resources, without generating any traffic. Which solution meets these requirements?
Answer and explanation
Answer: C. Network Access Analyzer evaluates network configuration statically against defined scopes and reports paths permitting unintended access, with no traffic generated. Flow Logs record only traffic that was actually attempted. A port scan requires sending traffic and tests only what the scanner attempts. GuardDuty detects threat activity rather than enumerating possible paths.
83. An Application Load Balancer must require clients to present a certificate issued by the company's private certificate authority. Which solution meets these requirements?
Answer and explanation
Answer: D. Mutual TLS on the listener validates the client certificate against a configured trust store, which is certificate-based client authentication. IP allow-listing authenticates a network location rather than a client identity. A WAF header rule cannot validate a certificate. A public certificate authenticates the server to the client rather than the reverse.
84. A CloudFront distribution must ensure that its origin cannot be reached directly, bypassing the WAF rules attached to the distribution. Which approach is appropriate?
Answer and explanation
Answer: D. Origin Access Control signs requests from the distribution so the origin can reject anything else, which is the supported mechanism for S3 and supported origins. Duplicating the web ACL on the origin adds cost and still permits direct access. IP range restriction requires maintaining a changing list. A custom header is a common pattern for load balancer origins but is weaker than a signed request since the header can leak.
85. A rate-based WAF rule is blocking legitimate traffic from a shared corporate proxy whose users appear as one address. Which approach is appropriate?
Answer and explanation
Answer: B. Aggregating on a value that distinguishes individual users behind the proxy preserves protection while not penalising shared egress. Raising the limit weakens protection for every source. A blanket exemption makes the proxy an unprotected path. Removing the rule loses the control.
86. AWS Shield Advanced protection must cover an application whose traffic arrives through a Route 53 hosted zone and an Application Load Balancer. Which resources should be added as protected resources?
Answer and explanation
Answer: B. Shield Advanced protection is configured per resource, so each resource in the path that supports protection should be registered. Protecting only one leaves the other unprotected. A VPC is not a protectable resource type for Shield Advanced.
87. An instance using IMDSv2 still exposes credentials through a server-side request forgery vulnerability in an application that can set arbitrary headers. Which additional control is appropriate?
Answer and explanation
Answer: A. A hop limit of one prevents a request that traverses a container or proxy from reaching metadata, which closes that path even when headers can be set. Disabling metadata breaks role-based credentials. A longer token lifetime widens the window. Subnet placement does not affect a local metadata call.
88. A container image passes vulnerability scanning at build time but is found vulnerable weeks later in production. Which capability addresses this?
Answer and explanation
Answer: D. Vulnerabilities are disclosed after a build, so the stored image must be reassessed continuously against new disclosures. A stricter build-time scan cannot detect what was unknown then. Weekly rebuilds may or may not pick up a fix and do not report the exposure. Filesystem scanning of the running container is heavier and detects the same thing later.
89. An Amazon EKS workload must be prevented from running containers as the root user. Which approach is appropriate?
Answer and explanation
Answer: C. Admission enforcement rejects a non-conforming pod before it runs, which is prevention. An instruction relies on compliance. Image scanning catches a declared user but not a runtime override. Weekly audit finds root containers already running.
90. A Nitro Enclave must receive a secret only if its running code matches an approved measurement. Which mechanism provides this?
Answer and explanation
Answer: B. Attestation lets a KMS key policy condition on the enclave's measurements, so only approved code can decrypt. A parent instance role grants the parent rather than the enclave. Enclaves have no network interface for a security group to restrict. A local configuration file is under the control of whatever is running.
91. A patch must be applied to instances that are not reachable by the patch service because they lack outbound connectivity. Which approach is appropriate?
Answer and explanation
Answer: C. Interface endpoints let the agent reach Systems Manager without any internet path, which preserves the isolation. An internet gateway route makes the subnet public. A NAT gateway provides internet access the design deliberately excludes. Manual patching through a bastion does not scale and reintroduces inbound access.
92. A Bedrock guardrail must be applied to every invocation from an application, and developers hold permission to call the model directly. Which approach is appropriate?
Answer and explanation
Answer: D. An IAM condition on the guardrail identifier is enforced by the service, so an invocation without it fails regardless of the calling code. A published standard relies on compliance. A library can be bypassed by calling the API directly. Weekly review detects bypasses after output has been returned.
93. A Lambda function's execution role permits an action the function has never invoked. Which approach establishes whether the permission can be removed?
Answer and explanation
Answer: B. Unused access analysis over a representative period establishes whether the permission has been exercised. Removing and waiting for failure causes an outage when the path is exercised infrequently. Presence in a managed policy says nothing about this function's use. Similarity to other roles is not evidence about this one.
94. A stateful inspection appliance sees only one direction of a flow between two VPCs attached to a transit gateway. Which cause should be investigated first?
Answer and explanation
Answer: D. Without appliance mode the transit gateway may select a different Availability Zone endpoint for the return path, so the appliance sees only one direction. A security group would block rather than divert the return traffic. A default route affects reachability. Enhanced networking affects throughput.
95. DNS Firewall must block a domain, but clients continue resolving it successfully. Which cause should be investigated first?
Answer and explanation
Answer: D. DNS Firewall inspects queries sent to the VPC Resolver, so a client configured with an external resolver bypasses it. Rule ordering and an alert action are both plausible and worth checking, but a bypassed resolver explains complete ineffectiveness. DNS hostnames affect instance naming.
96. Traffic to an interface VPC endpoint must be restricted to a specific set of API actions. Which approach is appropriate?
Answer and explanation
Answer: B. An endpoint policy restricts which API actions and resources may be reached through the endpoint, independently of the caller's IAM policy. A security group and network ACL control network reachability rather than API actions. An IAM policy alone leaves the endpoint open to any principal permitted elsewhere.
97. Network Firewall must inspect traffic leaving a VPC for the internet, and traffic is bypassing it. Which cause should be investigated first?
Answer and explanation
Answer: C. Traffic reaches the firewall only if routing sends it there, so a route pointing directly at the gateway bypasses inspection entirely. Policy rules and ordering affect what happens to traffic that arrives. Capacity affects throughput rather than whether traffic is routed.
98. Mutual TLS on an Application Load Balancer must reject a client whose certificate has been revoked. Which configuration is required?
Answer and explanation
Answer: B. Revocation is enforced by supplying a revocation list the validation checks. A trust store holds certificate authority certificates rather than individual client certificates. Session timeout affects reuse. Rotating the server certificate does not affect client validation.
99. A WAF web ACL must block requests from countries where the organization does not operate. Which rule type is appropriate?
Answer and explanation
Answer: A. A geographic match rule evaluates the request's country. A rate-based rule throttles by volume. An IP set of entire countries is unmaintainable. Bot control addresses automated traffic rather than origin.
100. A WAF rule must be evaluated without blocking traffic so its effect can be measured first. Which configuration is appropriate?
Answer and explanation
Answer: B. Count mode records matches without blocking, which measures the rule's effect safely. Block mode affects traffic immediately. The default action governs unmatched requests. Disabling produces no data.
101. CloudFront must serve content only to viewers presenting a valid signed request. Which combination of steps meets these requirements? (Select TWO.)
Answer and explanation
Answer: A, E. A trusted key group and restricted viewer access together require signed requests. Origin Access Control protects the origin from direct access rather than authenticating viewers. Geographic restriction filters by country. Field-level encryption protects specific form fields.
102. Shield Advanced must provide cost protection against scaling triggered by a DDoS attack. Which prerequisite applies?
Answer and explanation
Answer: A. Cost protection applies to registered protected resources. Shield Standard is always active and is not disabled. Zone placement is irrelevant. Shield Advanced includes its own response team access rather than depending on a support tier.
103. An Application Load Balancer must drop requests with malformed HTTP headers before they reach targets. Which configuration is appropriate?
Answer and explanation
Answer: A. The load balancer has an attribute that removes invalid header fields before forwarding. A WAF rule can inspect headers but the built-in attribute addresses malformed fields directly. Idle timeout governs connection duration. Access logging records requests.
104. An EC2 instance must be prevented from being launched without IMDSv2 required. Which approach is appropriate?
Answer and explanation
Answer: C. An IAM condition on the launch request prevents non-conforming instances existing. Post-launch configuration leaves a window. A Config rule reports after the fact. Disabling metadata breaks role credentials.
105. A container running on Amazon ECS must obtain credentials scoped to the application rather than the host. Which configuration is appropriate?
Answer and explanation
Answer: C. A task role scopes credentials to the task. The instance role grants every container on the host the same permissions. Image-embedded and environment credentials are long-term secrets.
106. An EKS pod must assume an IAM role without the node's role being over-permissioned. Which mechanism is appropriate?
Answer and explanation
Answer: D. Service account to role association gives pods their own credentials without over-permissioning nodes. Node role permissions apply to every pod. A stored secret is a long-term credential. Host networking is unrelated to identity.
107. A Lambda function must be prevented from reaching the internet while still calling AWS services. Which configuration is appropriate?
Answer and explanation
Answer: B. Private subnets without a NAT route and endpoints for required services remove internet access while preserving service calls. Public subnets and a NAT route both provide internet access. Outside a VPC the function has default internet access.
108. An organization must confirm that no EC2 instance is running an unapproved machine image. Which approach is appropriate?
Answer and explanation
Answer: B. A Config rule evaluates running instances continuously against the approved list. Launch restrictions control who rather than what. Quarterly review and operator checks are periodic and manual.
109. A build pipeline must sign container images so their origin can be verified at deployment. Which approach is appropriate?
Answer and explanation
Answer: A. Signing and verification establishes provenance cryptographically. A digest identifies content without proving who produced it. Push restrictions control one registry. Scanning assesses content rather than origin.
110. A Bedrock application's model invocations must be restricted to a specific model and Region. Which approach is appropriate?
Answer and explanation
Answer: D. An IAM policy scoped to the model ARN enforces the restriction at the service. Application configuration can be changed or bypassed. A guardrail filters content. Logging records invocations.
111. Network Firewall must block outbound traffic to domains outside an approved list. Which rule type is appropriate?
Answer and explanation
Answer: D. Stateful domain list rules evaluate the requested domain. Stateless rules, security groups, and network ACLs all filter by address and cannot evaluate domain names.
112. An organization must prevent a VPC endpoint from being used to reach resources outside the organization. Which approach is appropriate?
Answer and explanation
Answer: C. An endpoint policy with an organization condition restricts which resources can be reached. Security groups and network ACLs filter by network address rather than resource ownership. Route tables govern reachability of the endpoint itself.
113. A private subnet's instances must resolve public DNS names without any internet route. Which approach is appropriate?
Answer and explanation
Answer: C. The VPC Resolver answers public name queries from within the VPC without internet access. A NAT gateway, public addresses, and external DNS servers all introduce or require internet paths.
114. An organization must detect a security group rule that permits unrestricted inbound access as soon as it is created. Which approach is appropriate?
Answer and explanation
Answer: D. Event matching or a Config rule detects the change as it happens. Weekly review, flow log analysis, and monthly scanning all detect after exposure has begun.