Task 3.3: Design and Troubleshoot Network Security Controls SCS-C03 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company uses Amazon Inspector to scan its EC2 instances. The security engineer receives a network reachability finding that indicates an instance in a private subnet is reachable from the internet. The instance's security group allows inbound traffic on port 443 from 0.0.0.0/0. The private subnet's network ACL allows all traffic. What is the most likely cause of the finding?

   • AThe instance is in a private subnet, so it cannot be reachable from the internet.
   • BThe network ACL allows all traffic.
   • CThe instance has a public IP address assigned.
   • DThe security group allows inbound traffic on port 443 from 0.0.0.0/0.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which AWS service provides network reachability findings that identify unnecessary open ports?

   • AAWS Security Hub
   • BAmazon Inspector
   • CAWS Config
   • DAWS Trusted Advisor
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company uses Amazon Inspector to scan its EC2 instances for network reachability issues. The security engineer receives a finding that indicates an instance has an open port that is accessible from the internet. The instance is in a public subnet and has a security group that allows inbound traffic on port 22 from 0.0.0.0/0. What should the engineer do to remediate the finding?

   • ADisable the Amazon Inspector network reachability scan.
   • BMove the instance to a private subnet.
   • CRemove the security group rule that allows inbound traffic on port 22.
   • DRestrict the security group rule to allow inbound traffic on port 22 only from the company's IP address range.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses AWS Direct Connect to connect its on-premises data center to AWS. The security team requires encryption of data in transit at the link layer to protect against physical tampering of the fiber connection. What should the company configure?

   • AEnable MACsec on the Direct Connect connection.
   • BEnable IPsec on the Direct Connect connection.
   • CEnable TLS on the Direct Connect connection.
   • DEnable SSL on the Direct Connect connection.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a VPC with multiple subnets and uses security groups to segment traffic between application tiers. The security team wants to validate that there are no unintended network access paths between the subnets. The team has already reviewed the security group rules and route tables. What should the engineer use to identify unintended access paths?

   • AAWS Config
   • BAWS Network Access Analyzer
   • CAWS Inspector
   • DAWS Trusted Advisor
   Reveal Solution Discussion Select an answer first