3.0 Infrastructure Security SCS-C03 Practice Quiz
108 exam-style questions covering 18% of the SCS-C03 exam. Instant feedback on every answer, progress tracking, no signup required.
This domain is part of the AWS Certified Security Specialty practice test. Each question is tagged by exam objective and difficulty so you can drill exactly the areas you need.
Sample Questions
A retail site expects credential stuffing against its login endpoint during a sale. Which edge strategy should the security architect select?
- A. Use AWS WAF rate-based and bot-control protections at CloudFront with authentication failure monitoring
- B. Increase the origin database storage class only
- C. Use VPC network ACLs as the only login protection
- D. Disable access logging during the sale
Credential stuffing is a layer 7 abuse pattern, so edge filtering and rate controls near CloudFront can reduce malicious login attempts before they reach the origin.
A globally distributed API must block requests from embargoed countries and known malicious IP ranges. Which edge strategy fits?
- A. Use CloudFront geographic restrictions and AWS WAF IP sets with logging
- B. Use only a private subnet route table on the origin
- C. Use only Lambda execution role permissions
- D. Use only EBS encryption on origin instances
Geographic and IP-based edge controls can enforce location and source restrictions before requests reach the application.
An API is targeted by SQL injection and path traversal probes. Which edge security strategy aligns with the anticipated attack?
- A. Use only Shield Advanced without any web-layer rules
- B. Apply AWS WAF managed rule groups for common web exploits and tune exceptions with logs
- C. Rely only on security groups for query-string inspection
- D. Move all application logs into a private subnet
Managed web exploit rules can block OWASP-style attacks while logs support safe tuning for legitimate traffic.
An IoT platform needs to prevent devices with invalid policies from publishing to sensitive topics. Which edge-adjacent strategy applies?
- A. Use CloudFront cache behaviors for MQTT authorization
- B. Use AWS IoT policies that scope device principals to approved MQTT topics and actions
- C. Use S3 Object Lock on device messages as the only control
- D. Use network ACLs to inspect MQTT topic names
AWS IoT policies authorize device communication at the IoT service edge and limit topic access.
An S3-backed web application allows browser uploads only from https://app.example.com. Which protection should be configured?
- A. Wildcard CORS origins and methods for ease of integration
- B. Restrictive S3 CORS rules for the approved origin, methods, and headers
- C. A security group attached to the S3 bucket
- D. A Lambda execution role with no bucket policy review
CORS rules should allow only the required browser origin and operations for the application.
A media company expects volumetric HTTP floods against a public origin. Which edge strategy provides the strongest first line of defense?
- A. Expose the origin directly and scale only the database
- B. Use IAM permission boundaries to filter HTTP floods
- C. Front the origin with CloudFront, AWS WAF, and Shield Advanced protections
- D. Disable all caching to force requests to the origin
CloudFront and AWS WAF reduce origin exposure, while Shield Advanced adds DDoS response capabilities for protected resources.
A public API uses third-party clients with highly variable request rates. The team needs protection without blocking legitimate bursts from trusted partners. Which strategy should be selected?
- A. Set one very low global rate limit for all clients
- B. Remove WAF protections to avoid false positives
- C. Combine AWS WAF rate limiting, partner-specific allow rules, and monitoring to tune thresholds
- D. Move the API to a single private EC2 instance with no edge controls
A blended edge strategy can limit abusive rates while making explicit allowance for known trusted client patterns.
A company hosts public static content in S3 and wants controlled browser access from a specific application domain. Which threat should guide the edge strategy?
- A. EC2 instance metadata abuse from the browser
- B. KMS grant sprawl on unrelated databases
- C. Patch drift on container hosts
- D. Misconfigured CORS allowing unintended origins to access objects
S3 CORS controls browser cross-origin behavior, so the strategy must limit origins and methods to the intended application.
Key Terms in This Domain
- AWS Firewall Manager: Centrally configure WAF, Shield Advanced, security groups, Network Firewall across accounts
- Network Access Analyzer: Identifies unintended network paths to or from resources
- S3 Access Points: Named network endpoints with their own permissions for shared buckets
- AWS Resource Access Manager: Securely shares AWS resources across accounts and OUs
- AWS Security Hub: Aggregates and prioritizes findings across AWS security services
- Amazon Security Lake: Centralizes security data from AWS and third-party sources in OCSF format
- Amazon Inspector: Continuous vulnerability scanning for EC2, ECR, and Lambda
- Amazon Detective: Investigates security findings with linked behavioral graphs
- CloudWatch Logs data protection: Data identifiers and policies that mask sensitive log fields
- Amazon EventBridge: Event bus that routes events to targets for security automation
Link to this quiz
Studying with a group or teaching a class? Send this address or paste the link into your notes, wiki, or course page:
https://quizbuffet.com/aws-security-specialty/infrastructure-security/
<a href="https://quizbuffet.com/aws-security-specialty/infrastructure-security/">AWS Security Specialty Infrastructure Security practice quiz on QuizBuffet</a>
Other SCS-C03 Domains
- 1.0 Detection
- 2.0 Incident Response
- 4.0 Identity and Access Management
- 5.0 Data Protection
- 6.0 Security Foundations and Governance
← Back to SCS-C03 practice test overview
Questions are written against the published SCS-C03 objectives and checked for accuracy and balance before they go live. How QuizBuffet writes and reviews its questions.