A security engineer needs to block a specific IP address from reaching all instances in a subnet. Which AWS network security control should be used for this purpose?

An AWS WAF rule attached to the subnet

A route table entry that blackholes traffic from the IP address

A network ACL rule that denies traffic from the IP address

A security group rule that denies traffic from the IP address

A company uses AWS Network Access Analyzer to validate network segmentation. The engineer runs an analysis and finds an access path from a development subnet to a production subnet. The development subnet should not have access to the production subnet. The engineer reviews the security group rules and finds that the production security group allows inbound traffic from the development security group on port 22. What should the engineer do to remediate the access path?

Change the production security group to allow traffic from the development subnet's CIDR block.

Remove the inbound rule on the production security group that allows traffic from the development security group.

Add an outbound rule on the development security group to deny traffic to the production security group.

Add a network ACL rule on the production subnet to deny traffic from the development subnet.

A security engineer wants to encrypt traffic at the link layer on a dedicated Direct Connect connection. Which technology should be used?

IPsec VPN over the Direct Connect connection

AWSCertified Security - Specialty

Domain 3Objective 3

Task 3.3: Design and Troubleshoot Network Security Controls SCS-C03 Practice Questions (Page 2)

Part of the Content Domain 3: Infrastructure Security domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

18%of the exam

Questions 6–10

6foundation · easy
A company wants to provide secure access to an internal application without requiring users to connect to a VPN. Which AWS service can be used for this purpose?
Select an answer first
7foundation · easy
A company needs a dedicated, private, high-bandwidth connection from its on-premises data center to AWS. Which service should be used?
Select an answer first
8foundation · easy
A security engineer needs to block a specific IP address from reaching all instances in a subnet. Which AWS network security control should be used for this purpose?
Select an answer first
9expert · hard
A company uses AWS Network Access Analyzer to validate network segmentation. The engineer runs an analysis and finds an access path from a development subnet to a production subnet. The development subnet should not have access to the production subnet. The engineer reviews the security group rules and finds that the production security group allows inbound traffic from the development security group on port 22. What should the engineer do to remediate the access path?
Select an answer first
10foundation · easy
A security engineer wants to encrypt traffic at the link layer on a dedicated Direct Connect connection. Which technology should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 3.3: Design and Troubleshoot Network Security Controls SCS-C03 Practice Questions (Page 2)

Questions 6–10

A company wants to provide secure access to an internal application without requiring users to connect to a VPN. Which AWS service can be used for this purpose?

A company needs a dedicated, private, high-bandwidth connection from its on-premises data center to AWS. Which service should be used?

A security engineer needs to block a specific IP address from reaching all instances in a subnet. Which AWS network security control should be used for this purpose?

A security engineer wants to encrypt traffic at the link layer on a dedicated Direct Connect connection. Which technology should be used?

Keep studying — Content Domain 3: Infrastructure Security