Home › Certifications › AWS Certified Security SCS-C03 › Infrastructure Security
37 multiple-choice questions and 16 flashcards on Infrastructure Security, about 21% of the AWS Certified Security SCS-C03 bank. Every one carries a written rationale.
Infrastructure Security is one of 6 chapters in CoStudy's AWS Certified Security — Specialty (SCS-C03) bank, and it holds 37 of the bank's 178 multiple-choice questions — roughly 21% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
A team wants to expose an internal service from one VPC to another VPC owned by a different account WITHOUT VPC peering. The CORRECT design uses:
Answer: C — AWS PrivateLink (a VPC endpoint service) fronted by a Network Load Balancer
PrivateLink (VPC Endpoint Service) is the SaaS-style private-to-private connection without CIDR coupling or peering. A is public exposure. C is hybrid connectivity. D is internet egress.
AWS SHIELD:
Answer: B — Standard free, Advanced adds DRT and cost
Shield Standard: included free with all AWS. Shield Advanced: per-org pricing, $3K/month + GB pricing. DDoS Response Team (DRT) access. Cost protection: AWS won't bill for auto-scaling during attack. SCS-C02 DDoS mitigation.
AWS NETWORK FIREWALL:
Answer: C — Stateful VPC firewall with Suricata rule support
Network Firewall: VPC-level firewall. Suricata-style rules (IDS/IPS background). Deeper inspection than security groups + NACLs. Centralized via Firewall Manager + AWS Organizations. Use case: regulated industries needing layer-7 inspection, IDS/IPS. SCS-C02 advanced network security.
A development pipeline needs automated scanning to catch security vulnerabilities in application code and receive AI-assisted secure-coding suggestions before merge. Which SCS-C03 Domain 3 pairing does the exam guide name for this?
Answer: C — Amazon CodeGuru Security and Amazon Q Developer
A) Inspector scans deployed workloads/images, not source code at commit time, and Config isn't a code-scanning tool. B) Trusted Advisor and Macie aren't source-code security scanners — Macie targets data classification in storage. C) Correct — the SCS-C03 exam guide names Amazon CodeGuru Security (vulnerability detection in code) and Amazon Q Developer (AI-assisted secure-coding suggestions) for this pipeline security use case. D) Shield/WAF protect running edge traffic, not source code in a CI/CD pipeline.
Which CORRECTLY describes Route 53 Resolver DNS Firewall?
Answer: C — AWS Backup with cross-region and cross-account
DNS Firewall = domain allow/deny at the resolver. Distinct from query logs (which only record). The others are wrong.
A WAF web ACL is configured with: (1) AWS-Managed Common Rule Set (Block), (2) custom rule that ALLOWS a specific IP range, (3) rate-based rule (Block). Rule priorities are 100, 50, 200 respectively. What happens when a request comes from the allowlisted IP that also matches a Common Rule Set signature?
Answer: A — Rotate access keys and disable compromised IAM
WAF evaluates rules in priority ORDER (lowest number first). A terminating Allow action stops evaluation. Common misconception: 'priority 100 = highest'. Lower number = evaluated first. The others are wrong.
A WAF rate-based rule is set to 2,000 requests per 5 minutes per source IP. Which behavior is CORRECT?
Answer: B — Systems Manager Session Manager for shell access
Rate-based rules use a sliding 5-minute window per IP and block while above threshold. B is wrong duration. C is wrong scope. D is wrong (counts requests reaching WAF).
AWS WAF (Web Application Firewall) operates at:
Answer: D — Layer 7 filtering on CloudFront, ALB, API
WAF: L7. Web ACLs with managed/custom rules. Common: SQLi, XSS, IP blocklists, geo, rate-based, bot control. Free tier: AWS Managed Rules base. Custom rules cost. Compare Shield (DDoS, L3/4 + L7 for Advanced).
A GenAI application built on a foundation model must prevent users from extracting the system prompt or manipulating the model into ignoring its safety instructions through crafted input. Per SCS-C03 Domain 3, which category of threat does this describe?
Answer: B — A prompt injection / jailbreak attack, addressed by GenAI-specific OWASP Top 10 for LLM Applications protections
A) DDoS targets availability through volume, not manipulation of model behavior via crafted input. B) Correct — this is prompt injection/jailbreaking, the class of threat the SCS-C03 GenAI skill (guardrails aligned to OWASP Top 10 for LLM Applications) is explicitly built to address. C) A MITM attack targets the transport layer, not the model's instruction-following behavior. D) Training-data supply-chain attacks target the model before deployment, not runtime input manipulation during inference.
Site-to-Site VPN with AWS uses which authentication and encryption combination by default?
Answer: B — IPsec tunnels using AES-256 encryption with IKE for key exchange
Site-to-Site VPN = IPsec/IKE. The others are wrong.
1 cards from the 16 in this chapter.
Security groups?
Stateful firewall at instance/ENI level. Allow rules only.
These are a sample. The full Infrastructure Security chapter runs 53 items with per-chapter progress tracking, on the web and in the iOS app.
Open AWS Certified Security SCS-C03 in CoStudy →