Infrastructure Security (18%)

SCS-C03 · 54 questions

• A manufacturer runs zero-trust access from factory tablets to an analytics workload in AWS, with no VPN, a strict contractor BYOD policy, and a requirement for per-request identity and device posture checks. Tablets already use an identity provider for SSO. Which control should the architect implement to secure hybrid-to-AWS application communication?
• A fintech runs 60 Amazon ECS services from shared Docker base images and EC2 Auto Scaling groups needing CIS-hardened AMIs, vulnerability scans, and versioned pipelines. Auditors require reproducible builds, mandatory Inspector findings review, and no manual golden-image edits. Which hardened image pipeline satisfies these build controls?
• A global gaming studio launching a tournament site expects volumetric DDoS, bot account creation, and application exploits. Leadership wants a threat-informed edge plan that separates network-layer from application-layer controls before buying services. Which edge security strategy aligns controls to anticipated threats?
• A fintech startup hosts Python code in GitHub repositories and must block merges when secrets or critical vulnerabilities appear, with findings visible to developers in pull requests. Which pipeline security tool configuration should the platform engineer implement to discover vulnerabilities during code review?
• A global media site behind CloudFront and WAF faces credential stuffing from rotating IPs in two sanctioned countries, plus bots that rotate user agents but share TLS fingerprints. Which edge rule set should the engineer deploy to block geography and fingerprint bots while limiting login abuse?
• A fintech VPC hosts payment APIs that must allow HTTPS only from approved partner CIDRs, deny all other ingress, log rejected traffic, and filter outbound malicious domains. State checks show security groups alone are insufficient. Which network control design permits and prevents traffic as required?
• A travel company sends CloudFront, WAF, and third-party firewall logs to its data lake, needs normalized OCSF security telemetry for SIEM queries, and must keep edge dashboards current. Which edge-to-lake integration should the engineer configure to normalize OCSF telemetry?
• A manufacturer must connect a factory to two AWS Regions with dedicated 10-Gbps throughput, consistent low latency, and link-layer encryption for OT data. Internet-based VPN jitter is unacceptable and compliance mandates encrypted private lines. Which hybrid connectivity design provides secure connectivity as required?
• A logistics company runs delivery-route EC2 instances reading SQS and writing DynamoDB, plus ECS Fargate tasks pulling ECR and writing CloudWatch Logs. Credentials were found hardcoded in user data and task definitions. Which role assignment eliminates static keys while granting least-privilege workload access?
• A travel company launches a Bedrock chatbot that summarizes bookings and calls booking APIs, facing prompt injection and excessive agency risks from OWASP LLM Top 10. Which guardrail implementation should the security engineer apply to constrain the generative AI application behavior?
• A payment processor must isolate cardholder databases in private subnets with no internet egress, while containing lateral movement between application tiers and inspecting all inbound and outbound internet traffic. Compliance requires distinct controls for traffic entering or leaving versus tier-to-tier flows. Which design should the architect implement for network segmentation?
• A public web app on CloudFront with an ALB origin faces SQL injection, XSS, and bot scraping that bypassed basic filters. The team needs managed OWASP coverage, bot mitigation, and hardened browser headers. Which edge protection implementation best addresses these threats?
• A healthcare company must prove that production databases accept traffic only from approved application tiers and has hundreds of sprawling security groups. Auditors require evidence of unintended reachable paths before migration. Which control should the engineer use to identify unnecessary network access with reachable-path evidence?
• A SaaS company ships microservices as ECR container images and Python Lambda functions updated daily. Security requires continuous detection of known CVEs in images and function dependencies plus runtime threat detection without agents on Lambda. Which control should the security architect implement to scan compute for vulnerabilities?
• A global streaming service behind CloudFront and ALB faces credential-stuffing bursts from specific countries and rotating IPs, plus scrapers mimicking browsers. The team must block high-risk geographies, throttle login abuse, and challenge suspicious fingerprints without blocking legitimate viewers. Which edge control design meets these layered requirements?
• A SaaS company builds 40 golden AMIs and 25 container images monthly across three Regions. Images must start from CIS-hardened baselines, install CrowdStrike and CloudWatch agent, pass vulnerability scans, and distribute only approved versions. Which hardened image approach should the platform team implement to secure compute workloads?
• A three-tier VPC hosts public ALBs, private app servers, and databases. Policy requires stateful host filtering, subnet-level denial of a scanner CIDR, and centralized stateful egress URL filtering for malware domains. Which network control combination should the engineer troubleshoot and apply?
• A hospital keeps patient portals on private ALBs in AWS while clinicians work from home and branch clinics without VPN clients. Security requires identity-aware, device-posture checks before reaching apps over the internet. Which hybrid connectivity control should the network architect configure to enforce Zero Trust access to private workloads?
• A logistics firm runs EC2 workers that must read from S3 and pull from ECR, plus ECS Fargate tasks that must read Secrets Manager and write to DynamoDB. Credentials must never be stored on hosts, and each workload must receive only its own permissions. Which role design should the architect implement to authorize compute workloads?
• A global ticket retailer faces Layer 3 floods, Layer 7 SQL injection, and scalper bots during on-sales that crashed checkout last season. The board requires edge protection that absorbs floods with 24/7 DDoS response team access and DDoS cost protection, filters exploits, and manages bots close to users. Which edge security strategy should the architect select to counter DDoS, injection, and bots?
• A manufacturer must link a factory to AWS production VPCs and to analytics running in Google Cloud. Factory control traffic needs consistent private throughput to AWS, link-layer encryption on dedicated circuits, dynamic routing with failover, plus encrypted connectivity to Google Cloud without leased lines. Which secure connectivity architecture should the network security engineer design for hybrid and multi-cloud links?
• A healthcare provider runs Amazon EC2 fleets and container hosts across prod and staging. Compliance requires timely OS patches with maintenance windows, staged rollouts, and proof that hosts remain vulnerability-free. Which solution should the platform team deploy to patch compute and maintain continuous compliance?
• A media company runs CloudFront with AWS WAF and uses a third-party SIEM that only parses OCSF. The security team must centralize WAF findings for the SIEM without custom parsing, retain raw logs for 90 days, and keep query costs low. Which integration should the engineer configure to meet the OCSF ingestion requirement?
• A healthcare SaaS runs a 3-tier app in one VPC and must keep PHI databases offline, inspect app-tier east/west traffic, and filter north/south internet traffic centrally. Which segmentation design provides the required north/south and east/west protections with isolated subnets?
• A manufacturing firm connects factory tablets over the internet to private apps in AWS without VPN clients, requiring identity-aware access, device posture checks, and no inbound hybrid firewall openings. Headquarters uses Direct Connect for office traffic. Which hybrid access design meets the tablet workload communication requirements?
• A media site on CloudFront and ALB origin faces SQL injection, XSS, and bot-driven credential stuffing during launches, with legitimate global traffic spikes. The team must filter OWASP Top 10 threats at the edge without building custom proxies. Which network edge protection control blocks these application-layer attacks?
• A SaaS team ships ECR container images weekly and runs Python Lambda functions processing payments. Leadership requires continuous known-vulnerability scanning for images and function code plus runtime threat detection for containers and functions, with AWS managing any agents. Which scanning control should the team implement for container and serverless compute security?
• A bank audit found 400 security group rules with 0.0.0.0/0 SSH and unused cross-VPC paths that must be removed without breaking approved Verified Access connections. Which method best identifies unnecessary network access for safe removal?
• A bank prohibits SSH keys and bastion hosts for 200 Linux EC2 instances in private subnets, requires MFA-backed audited shell access, and must log every command centrally. Which administrative access design meets strict no-inbound access requirements?
• A bank must produce CIS-hardened EC2 AMIs and EKS container images monthly, embed CrowdStrike and CloudWatch agents, scan for CVEs before distribution, and share only approved images to 20 workload accounts. Which pipeline should the engineer implement to secure compute workloads?
• An online gaming platform runs web front ends, game logic, and player databases in one flat VPC, with lateral movement risk between tiers and internet exposure of databases. Compliance requires isolated subnets and controlled east-west traffic with north-south filtering. Which network segmentation design meets these security requirements?
• A multiplayer game studio launches a global leaderboard API on an ALB with login and matchmaking. Threat modeling anticipates UDP volumetric floods, Layer 7 fake-client bots inflating scores, and SQL injection on login. Investors require always-on mitigation with low latency and automatic burst scaling at the edge. Which edge security strategy should the architect select to counter the anticipated volumetric, bot, and injection threats?
• A company runs 500 Amazon EC2 instances and container hosts across production that miss patches, causing audit failures. Maintenance cannot cause downtime and must validate fixes continuously. Which patch deployment approach should the team implement to automate updates with continuous validation across compute?
• A data platform runs ETL jobs on EC2, nightly Glue transforms scheduled by EventBridge, and ECS Fargate tasks pulling from ECR and S3. Each workload overuses one shared IAM role and auditors demand scoped credentials with automatic rotation. Which role assignment should the engineer apply to authorize compute workloads?
• A fintech startup builds a Java microservice with AWS CodePipeline and CodeBuild from GitHub pull requests. Auditors require SAST for code vulnerabilities and hardcoded secrets on every pull request, with developer-friendly fix guidance before merge. Builds already scan container images. Which pipeline scan configuration discovers and remediates code vulnerabilities earliest?
• A global ticket retailer faces bot-driven credential stuffing from specific countries during on-sales, with attackers rotating IPs and JA3 fingerprints to evade simple blocks. The app runs behind CloudFront and must allow legitimate fans worldwide while throttling bots. Which edge control design should the architect implement to enforce geolocation and fingerprint-aware throttling?
• A startup runs 80 EC2 instances in private subnets with open SSH security groups and shared key pairs for vendor support. Auditors demand no inbound SSH, no long-lived credentials, and full session auditing. Developers still need on-demand shell access. Which administrative access design satisfies all constraints?
• A media company serves a global news portal via CloudFront to an ALB origin, facing SQL injection, XSS, and credential-stuffing bursts that bypass security groups. It needs OWASP Top 10 filtering, bot throttling, and hardened response headers. Which edge protection configuration blocks these application threats?
• A healthcare startup launches a Bedrock-powered triage chatbot that summarizes patient messages and calls Lambda tools. Pen tests show prompt injection can override safety instructions and elicit disallowed medical advice, plus sensitive data leaks into outputs. The app already uses IAM and KMS encryption. Which generative AI guardrail addresses OWASP LLM prompt injection and sensitive-data disclosure?
• A media company behind CloudFront and WAF sends logs to a partner SIEM that requires normalized Open Cybersecurity Schema Framework events and must correlate edge blocks with origin ALB latency without custom parsers. Ingest delays must stay low during live streams. Which integration approach should the engineer configure to streamline edge and third-party analytics?
• A bank's VPC has 300 security groups after rapid migration, with auditors flagging overly permissive SSH and database paths that bypass the jump host and Verified Access design. The team needs proof of reachable ports from the internet and unused rules. Which control best identifies unnecessary network access for remediation?
• A retail platform deploys 80 Lambda functions and ECS Fargate containers from ECR with weekly releases, and security must continuously detect OS and code CVEs in images and function packages plus flag anomalous runtime behavior without installing or managing agents themselves. Which scanning and monitoring pairing finds image flaws and runtime threats with no agent management?
• A fintech runs web, app, and database tiers in private subnets across two AZs, must allow outbound HTTPS only to approved payment APIs by domain, block all other egress, and log flow decisions centrally. Security groups cannot filter by domain and NACLs are stateless. Which network control provides stateful domain-based egress filtering for the workloads?
• A fintech startup deploys Python microservices through CodePipeline to Lambda and ECR. Audits found hardcoded secrets and injection flaws reaching production, and the team needs automated code findings with severity gating before deploy. Which pipeline vulnerability scanning control discovers code flaws before deployment?
• A global ticket marketplace faces credential stuffing bursts, Layer 7 DDoS during on-sales, and scraper bots copying prices, needs low latency in 20 countries, and must keep origin costs stable. Which edge security strategy should the architect select to counter volumetric and bot-driven application threats?
• A SaaS provider operates 120 Amazon Linux and Windows EC2 instances in Auto Scaling groups across two Regions. Leadership requires automated patch installation without disrupting releases, standardized patch approvals, and continuous validation for SOC 2 reporting. Which automated patching design should the engineer deploy to maintain compliant compute images with continuous validation?
• A global ticket marketplace behind CloudFront and WAF faces bot scalpers from two sanctioned countries using rotating IPs and spoofed headers that pass simple IP-based rate limits. Which edge control design blocks sanctioned geographies while throttling sophisticated bots?
• A healthcare startup builds Docker apps on EC2 and ECS from manually patched images, causing inconsistent CIS benchmarks and vulnerable packages in production. Builds must be repeatable, tested, and patched automatically. Which hardened image approach should the platform team implement to embed security controls consistently?
• A media company fronts APIs with CloudFront and WAF and must stream WAF detections to its third-party SIEM in a normalized vendor-neutral schema for unified correlation with other clouds. Which edge integration delivers normalized detections to the SIEM?
• A bank operates isolated EC2 instances in private subnets with no internet, where developers currently share SSH keys via bastion hosts violating audit. They need audited shell access without opening inbound ports or managing keys. Which administrative access method should the architect configure for secure compute?
• A travel company launches a Bedrock chatbot that summarizes bookings and calls tools to refund tickets. Testers bypassed safety prompts with jailbreaks, leaked PII in outputs, and triggered disallowed refund actions. Which generative AI guardrail control mitigates prompt injection and unsafe tool use?
• A logistics firm runs shipment APIs on EC2, order workers on ECS Fargate, and image builds with CodeBuild, and developers confused task roles with execution roles causing S3 denials and over-permissive keys. Which role mapping should the architect enforce to authorize each compute workload with least privilege?
• A media streaming site on CloudFront and ALB suffers SQL injection probes, XSS in comments, and bot scraping of video metadata, must stay online during flash sales, and needs managed patching of attack signatures. Which network edge protection should the engineer implement to block OWASP Top 10 and bot threats?
• A bank must connect its on-premises data center to two AWS Regions with consistent private connectivity, encrypted traffic over dedicated links, sub-second failover, and BGP routing. Internet-based tunnels alone violate policy. Which hybrid connectivity design meets the encrypted dedicated-link requirements for the bank?