Domain 3: Infrastructure Security

Secure AWS network and compute infrastructure.

5 minutes 5 Questions

Domain 3: Infrastructure Security is a critical component of the AWS Certified Security – Specialty (SCS-C02) exam, typically accounting for approximately 26% of the total exam content. This domain focuses on designing, implementing, and troubleshooting security controls for edge services, networks…

Concepts covered
VPC Security (Security Groups, NACLs)AWS Systems ManagerAWS Network FirewallAmazon InspectorAWS Certificate Manager (ACM)CloudFront Security
Test mode:
Start practice test

AWS SCS-C02 - Domain 3: Infrastructure Security Example Questions

Test your knowledge of Domain 3: Infrastructure Security

Question 1

What specific IAM permission enables an administrator to register an AWS Systems Manager Maintenance Window task utilizing a custom IAM service role?

Correct Answer: The iam:PassRole permission scoped to the specific IAM service role designated for the maintenance window task execution.

The iam:PassRole permission allows an administrator to securely pass a custom IAM service role to an AWS service, which is required when registering a Systems Manager Maintenance Window task so the service can use it during execution.
sts:AssumeRole is utilized by the AWS service itself to assume the designated role rather than by the administrator registering the task. ssm:CreateServiceLinkedRole is strictly for creating standard predefined service-linked roles instead of assigning custom ones. iam:CreateServiceSpecificCredential is used to generate distinct application credentials for services like CodeCommit and is entirely unrelated to Systems Manager.
The key concept tested is securely passing custom IAM roles to AWS services.

Question 2

A company stores database credentials in AWS Systems Manager Parameter Store as SecureString parameters. A developer reports that their Lambda function can read the parameter but receives an encrypted blob instead of plaintext. The Lambda function's IAM role has ssm:GetParameter permission. What is the most likely cause of this issue?

Correct Answer: The Lambda function's IAM role lacks kms:Decrypt permission on the KMS key used to encrypt the SecureString parameter

When retrieving a SecureString parameter from Parameter Store, the caller must have kms:Decrypt permission on the KMS key used to encrypt the parameter in order to receive the plaintext value; without this permission, the API call succeeds but returns the encrypted ciphertext blob.

GetParametersByPath is a different API for retrieving parameters by hierarchy path, not related to decryption. There is no ssm:DecryptParameter permission in IAM; the WithDecryption flag controls whether decryption is attempted, but the underlying requirement is kms:Decrypt. KMS key policies grant KMS actions like kms:Decrypt, not SSM actions.

Key concept tested: the relationship between Parameter Store SecureString parameters and KMS decrypt permissions required by the calling principal.

Question 3

An organization orchestrates a shared Amazon VPC leveraging AWS RAM. The central team shared a private subnet alongside participant accounts designated as Account X and Account Y. Account X operates frontend application instances, while Account Y operates backend database instances within this identically shared subnet. Account Y must restrict database access securely to only originate from the frontend application instances belonging to Account X. How should the engineering team for Account Y configure the backend database access to satisfy this requirement?

Correct Answer: Configure an inbound security group rule on the database referencing the security group ID of the frontend instances, prepended with Account X's AWS account ID.

The correct approach is right because in a shared VPC setup, you can reference a security group from another participant account in your security group rules by prepending the external account ID to the security group ID.
Referencing a centralized security group managed by the VPC owner introduces unnecessary administrative overhead. AWS Resource Access Manager principal identifiers cannot be referenced directly in security group rules. Network access control lists evaluate traffic based strictly on IP addresses or CIDR blocks rather than security group identifiers.
The key concept tested is cross account security group referencing within a shared Amazon VPC.

More Domain 3: Infrastructure Security questions
339 questions (total)
Practice 100 questions
One session at a time, always new questions