ANS-C01 Practice Test 32 — 15 Questions

Question 1

A company wants to allow their employees to access internal web applications hosted on EC2 instances in a private subnet. The employees are outside the corporate network and connect via the internet. Which AWS service would provide secure, managed remote access without requiring a VPN client on each employee's device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Application Load Balancer with AWS WAF and Cognito authentication

Answer

AWS Direct Connect

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 2

A company uses AWS WAF to protect their web application. They have a rate-based rule that blocks IPs after 100 requests in 5 minutes. However, they notice that legitimate users behind a corporate NAT gateway are being blocked because the aggregate traffic from the NAT IP exceeds the threshold. Which TWO actions would resolve this issue without compromising security? (Choose TWO.)

Accepted Answer

Use a scope-down statement to exclude traffic from the corporate NAT IP range.

Answer

Implement a custom WAF rule to allow traffic from the corporate IP range.

Answer

Change the rate-based rule to count instead of block.

Answer

Use AWS Shield Advanced for automatic mitigation.

Question 3

A company is designing a VPC with both IPv4 and IPv6 CIDR blocks. The VPC must support internet-facing applications accessible via IPv6. Which resource must be configured as IPv6-enabled to allow internet traffic?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is the only resource that supports both IPv4 and IPv6 traffic and provides a target in the VPC route table for IPv6 default routes (::/0) to enable direct internet access for IPv6-enabled resources. Unlike IPv4, which often requires NAT for private addressing, IPv6 globally unique addresses allow direct communication through the IGW without translation.

Answer

VPC Peering connection

Answer

NAT Gateway

Answer

Transit Gateway

Question 4

A security team needs to audit all network traffic entering and leaving a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, allowing auditing of all network traffic. Option B is wrong because AWS Config records resource configuration changes, not network traffic. Option C is wrong because Amazon CloudWatch Logs can store and monitor logs but does not capture network traffic. Option D is wrong because AWS CloudTrail records API calls, not network traffic.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 5

A security team needs to implement a solution to detect and alert on suspicious network traffic within a VPC. The solution should analyze VPC Flow Logs and generate findings for potential threats. Which THREE AWS services can be used together to achieve this?

Accepted Answer

VPC Flow Logs. The correct combination is A (VPC Flow Logs) as the data source, B (Amazon Detective) for deep investigation of findings, and C (Amazon GuardDuty) which automatically analyzes VPC Flow Logs for threat detection. Options D (AWS CloudTrail) is incorrect because it logs API calls, not network traffic. Option E (AWS Config) is incorrect as it tracks resource configuration changes.

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

A company has a VPC with public and private subnets. The public subnet hosts a NAT gateway. The private subnet hosts EC2 instances that need to download patches from the internet. The EC2 instances have a security group that allows outbound HTTPS to 0.0.0.0/0. What additional configuration is required?

Accepted Answer

Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. EC2 instances in a private subnet need a route in their route table that directs internet traffic (0.0.0.0/0) to the NAT gateway to access the internet for patch downloads. Option A is incorrect because an internet gateway is attached to the VPC, not a subnet, and private subnets should not have direct internet access. Option B is incorrect because the NAT gateway must be in a public subnet to have internet access via the internet gateway. Option D is incorrect because a VPC endpoint for S3 is used for private connectivity to S3, not for general internet access.

Answer

Attach an internet gateway to the private subnet.

Answer

Move the NAT gateway to the private subnet.

Answer

Create a VPC endpoint for S3.

Question 7

A company has a VPC with both IPv4 and IPv6 CIDR blocks. The application team wants to allow internet traffic to an IPv6-enabled web server. Which resource must be configured?

Accepted Answer

Internet Gateway. An Internet Gateway (IGW) is required to allow inbound and outbound IPv6 traffic between a VPC and the internet. Unlike IPv4, IPv6 addresses in AWS are globally unique by default, so no NAT is needed; the IGW directly routes traffic for both IPv4 and IPv6 when attached to the VPC and associated with the route table.

Answer

NAT64

Answer

Egress-Only Internet Gateway

Answer

NAT Gateway

Question 8

A security engineer is troubleshooting why an EC2 instance cannot communicate with the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The security group for the instance allows all outbound traffic. What should the engineer check NEXT?

Accepted Answer

Check the network ACL associated with the private subnet. Network ACLs are stateless and must allow both inbound and outbound traffic for the response. Option A is wrong because security group already allows outbound. Option B is wrong because the route is configured. Option D is wrong because flow logs are for analysis, not a next step in troubleshooting connectivity.

Answer

Verify that the security group inbound rules allow return traffic

Answer

Verify that the NAT gateway has an Elastic IP

Answer

Enable VPC Flow Logs to analyze traffic

Question 9

A company wants to audit all Network Load Balancer (NLB) operations performed in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for all AWS services, including Network Load Balancer (NLB) operations. Therefore, to audit NLB operations, CloudTrail should be used. Option B (Amazon CloudWatch Logs) stores logs but does not natively capture API calls. Option C (AWS Config) tracks resource configurations and changes, not API operations. Option D (VPC Flow Logs) captures network traffic information, not API calls. Hence, Option A is correct.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 10

A company uses an AWS Network Firewall to inspect traffic between VPCs and the internet. They want to allow outbound HTTPS traffic only to specific domains. Which rule configuration should be used?

Accepted Answer

Create a stateful rule group with a 'pass' action for the allowed domains using domain list rule group.. Domain list rule group in AWS Network Firewall can match FQDNs. Stateful rule groups inspect traffic states. Suricata compatible rules allow custom domain matching. IP set would match by IP, not domain.

Answer

Create a stateless rule group with a 'forward' action for the allowed IP addresses.

Answer

Create a stateful rule group with a 'drop' action for all traffic and then 'pass' for the allowed domains using Suricata compatible rules.

Answer

Create an IP set rule group with the allowed domain IP addresses.

Question 11

A company has a requirement to audit all network traffic leaving a VPC. The traffic includes traffic to the internet, to on-premises via VPN, and to other VPCs via Transit Gateway. Which AWS service can capture and log all outbound traffic for compliance analysis?

Accepted Answer

VPC Traffic Mirroring. (VPC Traffic Mirroring) is correct because it captures and copies all outbound network traffic, including full packets, for compliance analysis. Option B (VPC Flow Logs) is incorrect because it only logs metadata (e.g., IP addresses, ports, protocols) but not the full packet content. Option C (AWS CloudTrail) is incorrect because it logs API calls and management events, not network traffic. Option D (Amazon GuardDuty) is incorrect because it is a threat detection service that analyzes traffic for anomalies, but it does not log all traffic for auditing purposes.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 12

A security engineer is designing a network security architecture for a hybrid cloud environment. The company has an AWS Direct Connect connection to its on-premises data center. They want to ensure that all traffic between on-premises and AWS is encrypted and that the encryption is enforced at the network layer. Which TWO solutions should the engineer consider?

Accepted Answer

Enable MACsec on the Direct Connect dedicated connection.. (MACsec) is correct because it provides encryption at Layer 2 on the Direct Connect connection. Option D (IPsec VPN over Direct Connect) is correct because it creates an encrypted tunnel over the Direct Connect link. TLS is Layer 5+ and not network layer. SSL VPN is not relevant. VPC Peering does not apply to on-premises.

Answer

Set up an SSL VPN between on-premises and AWS.

Answer

Use VPC Peering to connect on-premises to AWS.

Answer

Use TLS encryption at the application layer.

Question 13

A company uses AWS Organizations with SCPs to enforce security controls. The security team wants to prevent users from disabling Amazon GuardDuty or modifying its configuration in any member account. Which SCP effect should be used?

Accepted Answer

Deny. 'Deny' because SCPs use Deny to explicitly block actions. Allow is used to whitelist, but SCPs default to Allow, so Deny is needed to override. 'Block' and 'Prevent' are not valid SCP effects.

Answer

Prevent

Answer

Allow

Answer

Block

Question 14

Which THREE of the following are valid ways to restrict access to an S3 bucket that is accessed by EC2 instances in a VPC?

Accepted Answer

Use an S3 bucket policy that restricts access to the VPC or VPC endpoint.. Options A, C, and D are correct. Option A: S3 bucket policies can restrict access based on source VPC or VPC endpoint. Option C: VPC endpoint policies can specify which S3 buckets can be accessed through the endpoint. Option D: IAM roles (instance profiles) grant permissions to EC2 instances to access S3 buckets. Option B is incorrect because network ACLs operate at the subnet level and do not filter by S3 bucket; they only filter based on IP addresses. Option E is incorrect because security groups do not apply to S3 bucket access; they control traffic to/from EC2 instances.

Answer

Use a network ACL to restrict access to the S3 prefix list.

Answer

Use a security group to allow outbound traffic from the EC2 instance to the S3 bucket.

Question 15

A company has a security requirement to log and monitor all DNS queries made by EC2 instances in a VPC. Which TWO AWS solutions can meet this requirement?

Accepted Answer

Enable Amazon Route 53 Resolver Query Logging.. Amazon Route 53 Resolver Query Logging (Option A) logs all DNS queries that are forwarded by the Route 53 Resolver within a VPC. Amazon Route 53 Resolver DNS Firewall (Option C) provides DNS filtering and can log DNS queries that match the firewall rules. Both are valid AWS solutions for logging DNS queries from EC2 instances. Option B (AWS CloudTrail) logs API calls, not DNS queries. Option D (Amazon CloudWatch Logs with a custom agent) is not a native AWS service for DNS logging; it requires custom configuration and is not a managed solution. Option E (VPC Flow Logs) captures IP traffic metadata, not DNS queries.

Answer

Use AWS CloudTrail to log DNS queries.

Answer

Use Amazon CloudWatch Logs with a custom agent to capture DNS logs.

Answer

Enable VPC Flow Logs.