SCS-C02 exam dumps: questions 201 to 300 of 503

Correct answers: A, B, D, E

• A. Correct.

  Deploying the frontend in an Amazon S3 bucket with CloudFront ensures a secure and scalable delivery mechanism, while restricting direct access to the S3 bucket reduces exposure to attacks. This is a best practice for static content hosting.

• B. Correct.

  Placing the backend API behind an ALB and securing it with AWS WAF helps to filter and block malicious traffic such as SQL injection or cross-site scripting (XSS), improving overall application security.

• C. Incorrect.

  Hosting the database in a public subnet with open access is a poor security practice as it exposes the database to potential attacks from the internet. Databases should always be in private subnets with restricted access.

• D. Correct.

  Using Amazon RDS with private subnets and enabling encryption ensures that the database is not directly accessible from the internet and that data is encrypted both at rest and in transit, following security best practices.

• E. Correct.

  Implementing security group rules to allow traffic only from specific allowed sources minimizes the attack surface between application layers, ensuring that traffic is controlled and restricted to what is necessary.

Correct answers: B, C, E

• A. Incorrect.

  While restricting access to the application servers via security groups is a good practice, placing the web servers in a public subnet with direct internet access increases the attack surface. Instead, web traffic should be routed through a load balancer.

• B. Correct.

  Using an Application Load Balancer (ALB) to handle incoming traffic and terminate SSL/TLS connections improves security by offloading encryption and ensuring secure communication with clients.

• C. Correct.

  Deploying application servers in a private subnet and restricting access to them from only the web servers via security groups ensures that they are not directly accessible from the internet, reducing the attack surface.

• D. Incorrect.

  Allowing database servers to accept direct connections from the internet is a major security risk. Database servers should always be isolated in private subnets with controlled access.

• E. Correct.

  Using network ACLs and security groups together to restrict access to the database servers only from the application servers implements defense-in-depth and minimizes potential attack vectors.

Correct answers: A, B, D

• A. Correct.

  Configuring the Application Load Balancer to accept requests only from the Amazon CloudFront distribution ensures that traffic is filtered through CloudFront, which acts as a layer of protection and caching. This limits exposure to direct internet traffic.

• B. Correct.

  Using AWS WAF to block common web exploits, such as SQL injection or cross-site scripting (XSS), adds a strong layer of protection to the application by preventing malicious traffic from reaching the application layer.

• C. Incorrect.

  While monitoring traffic with VPC Flow Logs can help with auditing and troubleshooting, it does not directly improve security at the application layer or against external attacks.

• D. Correct.

  Restricting the security group of the Amazon EC2 instances to only allow traffic from the Application Load Balancer ensures that the application layer only receives traffic that has been validated and routed through the ALB.

• E. Incorrect.

  While enabling encryption in transit between CloudFront and the ALB is a good practice for protecting data, it does not directly address the recommendation to enhance defense-in-depth or restrict access to the application layer.

Correct answers: A, C, D

• A. Correct.

  Correct. The security group for the ALB ensures that only traffic from the internet on ports 80 (HTTP) and 443 (HTTPS) is allowed, aligning with the requirement to restrict access to the web tier.

• B. Incorrect.

  Incorrect. Network ACLs are stateless and less granular compared to security groups. Security groups are more appropriate for restricting communication between tiers in this scenario.

• C. Correct.

  Correct. By configuring the application servers' security group to accept traffic only from the ALB's security group on port 443, you ensure secure communication between the web and application tiers.

• D. Correct.

  Correct. Applying a security group to the database tier that allows traffic only from the application servers' security group on the specific database port ensures secure and restricted communication between the application and database tiers.

• E. Incorrect.

  Incorrect. While using an Elastic IP and whitelisting the organization's IP range might restrict access, it is not part of the requirements to restrict access to the web tier based on IP. The ALB's security group fulfills this purpose.

Correct answers: A, B

• A. Correct.

  Correct. Security groups can reference other security groups. By configuring the backend instances' security group to allow traffic only from the ALB's security group, you ensure that only traffic originating from the ALB can reach the backend instances.

• B. Correct.

  Correct. Network ACLs operate at the subnet level and can be used to allow or deny traffic based on IP ranges. By allowing traffic only from the ALB's IP address range, you can restrict access to the backend instances.

• C. Incorrect.

  Incorrect. AWS WAF is designed to filter traffic at the ALB layer based on rules, but it cannot restrict traffic directly to the backend instances.

• D. Incorrect.

  Incorrect. While VPC Flow Logs help monitor traffic, they do not actively restrict or control traffic.

• E. Incorrect.

  Incorrect. Modifying the ALB's security group will not control traffic to the backend instances. Security group rules for the ALB govern inbound traffic to the ALB, not the backend instances.