Task 3.1: Design, Implement, and Troubleshoot Security Controls for Network Edge Services SCS-C03 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A company wants to reduce the attack surface of its web application by hiding the origin server's IP address. Which edge security strategy directly supports this goal?

   • AUse Amazon CloudFront with an origin access control (OAC) and restrict origin access to the CloudFront distribution
   • BConfigure an AWS Network Firewall to block inbound traffic from unknown IPs
   • CEnable AWS Shield Standard on the account
   • DDeploy AWS WAF with a managed rule group for SQL injection
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A gaming company is launching a new multiplayer title globally. The application is served through Amazon CloudFront and the backend is an Application Load Balancer (ALB) in us-east-1. The security team has identified that the game's login endpoint is being targeted by credential-stuffing attacks originating from a specific set of countries where the game is not legally available. The company wants to block these requests at the edge before they reach the ALB. What should the security engineer do to meet these requirements?

   • AConfigure the ALB's security group to only allow traffic from the CloudFront distribution's IP ranges, and add a rule to the ALB to reject requests from the restricted countries.
   • BCreate an AWS WAF web ACL associated with the CloudFront distribution, add a geo-match rule to block the restricted countries, and add a rate-based rule to limit login attempts per IP.
   • CModify the CloudFront distribution to use a custom origin with a geo-restriction policy that denies requests from the restricted countries at the origin level.
   • DUse AWS Shield Advanced to create a geographic-based mitigation that automatically blocks traffic from the restricted countries before it reaches CloudFront.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A large e-commerce company is preparing for a major sales event. The security team is concerned about potential DDoS attacks targeting the application, which is served through Amazon CloudFront and an Application Load Balancer (ALB). The company wants to ensure that it has enhanced DDoS protection and can respond quickly to attacks. What should the security engineer do?

   • AEnable AWS Shield Standard on the CloudFront distribution and ALB, and configure the ALB to drop traffic during an attack.
   • BSubscribe to AWS Shield Advanced and associate the CloudFront distribution and ALB with the Shield Advanced protection.
   • CUse AWS WAF to create a rate-based rule that blocks all traffic exceeding a certain threshold, and associate it with the CloudFront distribution.
   • DConfigure the ALB to only accept traffic from CloudFront's IP ranges and use a Network ACL to block all other traffic.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security engineer wants to block requests from a specific country using AWS WAF. Which AWS WAF match type should be used?

   • AString match
   • BGeo match
   • CIP set
   • DRate-based rule
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A media streaming company uses Amazon CloudFront to serve video content from an S3 bucket. The company has a compliance requirement to prevent direct access to the S3 bucket and to ensure that all requests to the origin include a specific custom header that only CloudFront can provide. The security engineer needs to configure this without using an Origin Access Identity (OAI). What should the engineer do?

   • AUse a custom header in the CloudFront origin configuration and configure the S3 bucket policy to require the presence of that header.
   • BUse an Origin Access Control (OAC) with a custom header that CloudFront sends to the S3 origin, and update the S3 bucket policy to only allow requests that include this header.
   • CCreate a Lambda@Edge function that adds a custom header to the request before forwarding it to the S3 origin.
   • DUse AWS WAF to add a custom header to the request and attach the web ACL to the CloudFront distribution.
   Reveal Solution Discussion Select an answer first