ANS-C01 Practice Test 25 — 15 Questions

Question 1

A company wants to monitor and log all network traffic within a VPC for security analysis. Which THREE services can be used to achieve this?

Accepted Answer

VPC Flow Logs. VPC Flow Logs (A) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, accept/reject) for ENIs, subnets, or the entire VPC and publishes it to CloudWatch Logs or S3 for security analysis. AWS Network Firewall (C) is correct because it is a managed stateful firewall that inspects and logs VPC traffic (flow and alert logs) to CloudWatch Logs, S3, or Kinesis Firehose, providing detailed traffic visibility. AWS Traffic Mirroring (D) is correct because it copies actual packet payloads from ENIs to a target NLB or ENI for deep inspection and logging by third-party or custom tools. Amazon CloudWatch (B) is not a traffic-capture service; it only stores/metrics/alarms on logs that other services like Flow Logs deliver. Amazon S3 (E) is only a storage destination for logs, not a service that monitors or captures network traffic itself.

Answer

Amazon CloudWatch

Answer

Amazon S3

Question 2

A company is deploying an AWS Network Firewall in a centralized inspection VPC to inspect traffic between VPCs connected to an AWS Transit Gateway. The architecture uses Transit Gateway route tables to send inter-VPC traffic through the inspection VPC. The Network Firewall is configured with stateful and stateless rule groups. After deployment, the security team notices that traffic from VPC A to VPC B is being dropped. Other traffic flows correctly. What is the MOST likely cause of this issue?

Accepted Answer

The stateless rule group is set to forward traffic, but the stateful rule group is not configured to allow the traffic.. In AWS Network Firewall, stateless rule groups evaluate traffic first. If the stateless rule group is set to 'forward' (i.e., pass traffic to the stateful engine), the stateful rule group must then explicitly allow the traffic. If the stateful rule group is not configured to allow the traffic (e.g., it has no matching allow rule or has a default drop), the traffic will be dropped. This explains why only traffic from VPC A to VPC B is dropped while other flows work, as the issue is specific to the stateful rule group's handling of that particular flow.

Answer

The route table for VPC A's subnets does not have a route to the inspection VPC.

Answer

The stateful rule group is configured to drop all traffic that is not explicitly allowed.

Answer

The security group attached to the Transit Gateway is blocking the traffic.

Question 3

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution meets this requirement?

Accepted Answer

Create a VPC gateway endpoint for S3 and attach an endpoint policy that restricts access to the specific bucket. A VPC gateway endpoint for S3 provides a private route from the VPC to S3 that does not traverse the internet or a NAT gateway. Attaching an endpoint policy restricts access to the specific bucket, satisfying both the connectivity and security requirements. This is the standard AWS pattern for private S3 access from a private subnet.

Answer

Establish a VPN connection to the on-premises network and route through it

Answer

Set up a NAT gateway in the public subnet and route private subnet traffic to it

Answer

Deploy a proxy server in the public subnet and configure the instance to use it

Question 4

A company is deploying a multi-tier web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that the web servers only accept traffic from the ALB and that the ALB only accepts traffic from the internet on ports 80 and 443. Additionally, the web servers should be able to make outbound connections to the internet for updates. Which combination of security group rules meets these requirements?

Accepted Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from ALB SG on app port, outbound to 0.0.0.0/0 on ephemeral. The correct combination requires the ALB security group to allow inbound internet traffic on 80/443 and outbound traffic to the web servers on the application port, while the web server security group allows inbound only from the ALB security group on the app port and outbound to 0.0.0.0/0 on ephemeral ports for updates. Referencing the ALB security group as the source in the web SG inbound rule ensures only ALB traffic reaches the instances, and the outbound ephemeral rule allows return traffic and internet updates.

Answer

Use network ACLs instead: public subnet NACL allow 80/443 inbound, private subnet NACL allow from ALB on app port

Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound deny all; Web SG: inbound from ALB SG on app port, outbound allow all

Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from VPC CIDR on app port, outbound to 0.0.0.0/0 on ephemeral

Question 5

A company wants to connect an on-premises data center to AWS using a dedicated private connection that does not traverse the internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the internet entirely. This service uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a virtual private gateway or AWS Transit Gateway, ensuring low latency, consistent bandwidth, and compliance with data sovereignty requirements.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 6

A company has a VPC with public and private subnets in three Availability Zones. The company hosts a web application on Amazon EC2 instances in the private subnets. The instances need to download security patches from the internet but must not be directly accessible from the internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Deploy a NAT gateway in each public subnet and configure the private subnet route tables to point to the respective NAT gateway.. A NAT gateway is a fully managed AWS service that provides outbound internet connectivity for instances in private subnets while preventing inbound internet access. Deploying a NAT gateway in each public subnet across three Availability Zones ensures high availability and fault tolerance, and configuring private subnet route tables with a default route (0.0.0.0/0) pointing to the respective NAT gateway meets the requirement with minimal operational overhead, as AWS handles patching and scaling.

Answer

Deploy a NAT instance in a public subnet and configure the private subnet route tables to point to the NAT instance.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the private subnet route tables.

Answer

Create a VPC endpoint for Amazon S3 and configure the instances to use the endpoint.

Question 7

A company wants to audit all changes to security groups in their AWS account. Which AWS service should they use to track API calls that modify security groups?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including the identity of the caller, the time of the call, the source IP, and the request parameters. Security group modifications (AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, etc.) are API calls, so CloudTrail is the correct service to audit who changed what and when.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 8

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices that a specific IP address is generating a high number of requests and wants to block it immediately. What is the MOST efficient way to block this IP address?

Accepted Answer

Add the IP address to an IP set in AWS WAF and update the rule to block it. AWS WAF IP sets are designed for exactly this use case: you maintain a named set of IP addresses and reference it in a rule, so adding the offending IP to the set and ensuring the rule action is Block takes effect within seconds across all associated resources. This is the native, lowest-friction mechanism for dynamic IP blocking at Layer 7.

Answer

Add a deny rule in the security group attached to the ALB

Answer

Update the Network ACL associated with the ALB subnets to deny inbound traffic from the IP address

Answer

Create a new web ACL in AWS WAF and associate it with the ALB

Question 9

A company is designing a hybrid network connecting an on-premises data center to AWS via AWS Direct Connect. The company requires high availability and wants to avoid a single point of failure. Which design meets these requirements?

Accepted Answer

Provision two Direct Connect connections at two different Direct Connect locations.. Provisioning two Direct Connect connections at two different Direct Connect locations eliminates any single point of failure. This design ensures that if one connection or location fails, traffic can automatically fail over to the other connection, meeting the high availability requirement. A single Direct Connect connection, regardless of the number of VIFs or VLANs, remains a single point of failure.

Answer

Provision a single Direct Connect connection with multiple virtual interfaces (VIFs).

Answer

Provision one Direct Connect connection with two VLANs to separate production and non-production traffic.

Answer

Use a single Direct Connect connection and a VPN backup over the internet.

Question 10

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team needs to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is purpose-built to filter HTTP/HTTPS traffic at the application layer (Layer 7) and includes managed rule groups that block SQL injection, cross-site scripting, and other OWASP Top 10 exploits. It integrates natively with Application Load Balancers, CloudFront, and API Gateway. This makes it the correct choice for protecting a web app behind an ALB from common web exploits.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 11

A company has a VPC with public and private subnets. The security team wants to allow instances in a private subnet to download software updates from the internet but prevent inbound internet traffic. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway allows outbound internet traffic from private subnets while blocking unsolicited inbound traffic. Option D is correct. Option A is wrong because an internet gateway enables bidirectional traffic, which would allow inbound traffic. Option B is wrong because AWS Site-to-Site VPN is used for hybrid connectivity between on-premises and AWS, not for outbound internet access from private subnets. Option C is wrong because VPC peering connects VPCs together, not to the internet.

Answer

Internet gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 12

A company is designing a multi-Region Active-Active architecture using Application Load Balancers (ALBs) behind AWS Global Accelerator. The application requires sticky sessions (session affinity) and must maintain session persistence even during failover. Which configuration should be used to achieve this?

Accepted Answer

Use a custom application cookie for stickiness that is consistent across all ALBs, and set the cookie domain to the Global Accelerator DNS name.. AWS Global Accelerator does not natively support session affinity (sticky sessions). To maintain session persistence across multi-Region ALBs during failover, you must use a custom application cookie that is consistent across all ALBs and set the cookie domain to the Global Accelerator DNS name. This ensures the client's browser sends the same cookie to any healthy ALB in any Region, preserving the session even when traffic shifts due to a failover.

Answer

Enable stickiness on each ALB individually and use a single Regional endpoint group.

Answer

Configure Global Accelerator to use session affinity with the 'two-tuple' protocol.

Answer

Configure Route 53 with latency-based routing and enable stickiness on each ALB.

Question 13

A company needs to establish private connectivity between two VPCs in different AWS accounts. The VPCs are in the same Region. Which AWS feature should be used?

Accepted Answer

VPC peering. VPC peering is the correct choice because it establishes a direct, private network connection between two VPCs in the same AWS Region, even across different AWS accounts, using the AWS backbone without requiring a transit hub or external connectivity. It leverages the existing AWS infrastructure to route traffic between the VPCs via private IPv4 or IPv6 addresses, with no bandwidth bottlenecks or single points of failure inherent in the design.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 14

A company is migrating its on-premises data center to AWS. The network team needs to design a hybrid connectivity solution that provides high availability with a bandwidth of at least 10 Gbps and low latency for real-time data replication. The company has two redundant on-premises routers connected to two separate internet service providers (ISPs). Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Provision two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connect each on-premises router to one of them.. Provisioning two AWS Direct Connect connections at two different Direct Connect locations, each with a 10 Gbps port, and connecting each on-premises router to one of them provides both high availability (via geographic and path redundancy) and the required 10 Gbps bandwidth with low latency for real-time data replication. This design eliminates single points of failure and meets the bandwidth requirement without relying on VPNs, which cannot guarantee consistent low latency or 10 Gbps throughput.

Answer

Use AWS Direct Connect Gateway to aggregate multiple VPN connections to achieve higher bandwidth.

Answer

Provision a single AWS Direct Connect connection with a 10 Gbps port and connect both on-premises routers to it via a single interface.

Answer

Set up two AWS Site-to-Site VPN tunnels from each on-premises router to two different AWS VPN endpoints in the same region.

Question 15

An organization uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to implement traffic inspection between VPCs using a third-party firewall appliance in a central VPC. The firewall must inspect traffic for all inter-VPC flows. Which architecture meets this requirement?

Accepted Answer

Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC's attachment, and enable appliance mode on the attachment.. Enabling appliance mode on a Transit Gateway attachment forces the Transit Gateway to preserve the source MAC address and use flow hash-based load balancing for traffic sent to the inspection VPC. This ensures that all inter-VPC traffic is routed through the third-party firewall appliance in the central VPC, allowing stateful inspection to work correctly. Without appliance mode, the Transit Gateway would perform MAC address rewriting, breaking the firewall's ability to track sessions.

Answer

Create VPC peering connections between all VPCs and route traffic through the central VPC.

Answer

Use a Network Load Balancer in the central VPC to distribute traffic to the firewall appliances.

Answer

Set up Direct Connect gateways and route all traffic through the on-premises network for inspection.