ANS-C01 Practice Test 33 — 15 Questions

Question 1

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The application is fronted by Amazon CloudFront and an Application Load Balancer. The security team wants to receive notifications when a DDoS attack is detected. Which AWS service should be used to receive these notifications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch. AWS Shield Advanced integrates with Amazon CloudWatch to emit DDoS detection metrics. You can create a CloudWatch alarm based on these metrics (e.g., DDoSDetected) to send notifications via SNS. Option A (AWS Config) is for resource configuration auditing, not DDoS notifications. Option C (VPC Flow Logs) captures network traffic metadata but does not provide Shield-specific alerts. Option D (Amazon GuardDuty) is a threat detection service, but it does not directly provide Shield Advanced event notifications.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 2

A company is designing a multi-account architecture. They need to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the security account. The logs must be encrypted at rest using a customer-managed KMS key in the security account. Which combination of steps is required?

Accepted Answer

Configure the KMS key policy to allow the log-producing accounts to use the key, and the S3 bucket policy to allow those accounts to write.. To centralize VPC flow logs with customer-managed KMS encryption, you need both a KMS key policy that grants the log-producing accounts permission to use the key (kms:Encrypt, kms:GenerateDataKey) and an S3 bucket policy that allows those accounts to write objects. Option A is wrong because SSE-S3 cannot be used with cross-account access in this context. Option B is wrong because using separate keys per account defeats centralization. Option D is wrong because without modifying the KMS key policy, cross-account encryption will fail.

Answer

Configure the S3 bucket policy to allow the log accounts to write; encryption is automatic with SSE-S3.

Answer

Create a KMS key in each account and configure the S3 bucket to use each key.

Answer

Create a KMS key in the security account with no key policy changes; use bucket policies to allow cross-account writes.

Question 3

A company is designing a network security architecture for a multi-account AWS environment using AWS Transit Gateway. They need to ensure that all traffic between VPCs must be inspected by a centralized security appliance (e.g., firewall) in a shared services VPC. Which routing design meets this requirement?

Accepted Answer

Attach the inspection VPC and all spoke VPCs to the same Transit Gateway route table, and add a static route for the spoke VPC CIDRs pointing to the inspection VPC attachment, with blackhole routes for the same CIDRs.. By attaching both the inspection VPC and the spoke VPCs to the same route table with blackhole routes, traffic between spokes is forced to go through the inspection VPC. Option A is incorrect because it uses separate route tables, which would allow direct routing. Option B allows direct traffic. Option D is not a standard practice.

Answer

Attach all VPCs to a single route table and enable VPC peering for inspection VPC.

Answer

Use a centralized NAT gateway in the inspection VPC and configure all spokes to route traffic through it.

Answer

Create separate route tables for each VPC attachment and propagate routes from all VPCs.

Question 4

A security engineer is designing a network ACL for a public subnet. The subnet hosts a web server on port 443. Which inbound and outbound rules should be configured to allow HTTPS traffic from the internet? (Assume default deny all rule.)

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0.. NACLs are stateless, requiring explicit inbound and outbound rules. The inbound rule allows HTTPS (TCP 443) from the internet. The outbound rule allows return traffic on ephemeral ports (1024-65535) back to the internet. Option B is wrong because the outbound rule only allows TCP 443, which is too restrictive for return traffic. Option C is wrong because the inbound rule only allows ephemeral ports, not HTTPS. Option D is wrong because it incorrectly states 'for responses' and the outbound rule is still too restrictive.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

Answer

Inbound: allow TCP 1024-65535 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0 for responses.

Question 5

A company wants to allow a specific IAM user to manage network ACLs for a specific VPC only. Which IAM policy action should be used?

Accepted Answer

ec2:ModifyNetworkAclAttribute. Managing network ACLs requires multiple IAM actions, including creating, deleting, and modifying rules and attributes. None of the listed actions alone sufficiently allows full management. ec2:ModifyNetworkAclAttribute only modifies attributes like tags, ec2:CreateNetworkAcl only creates new ACLs, ec2:DescribeNetworkAcls is read-only, and ec2:AuthorizeSecurityGroupIngress is for security groups. To allow a user to manage network ACLs, a combination of actions such as ec2:CreateNetworkAcl, ec2:DeleteNetworkAcl, ec2:ReplaceNetworkAclEntry, etc. is needed.

Answer

ec2:AuthorizeSecurityGroupIngress

Answer

ec2:CreateNetworkAcl

Answer

ec2:DescribeNetworkAcls

Question 6

A company is using AWS WAF to protect a web application. They want to block requests that originate from known malicious IP addresses. Which WAF rule type should be used?

Accepted Answer

IP set match condition. IP set match conditions are used to match the source IP address of a request against a list of IP addresses. Regex, string match, and SQL injection are for other attack types.

Answer

String match condition

Answer

Regex match condition

Answer

SQL injection match condition

Question 7

A company is deploying a web application behind an Application Load Balancer (ALB). The application must only accept traffic from the ALB. Which security group configuration should be used for the EC2 instances?

Accepted Answer

Allow inbound from the ALB security group on port 80. To ensure the EC2 instances only accept traffic from the ALB, the security group should reference the ALB's security group as the source. This is a best practice because the ALB acts as a proxy, and using its security group dynamically allows traffic from any ALB instance, even if the ALB's IP addresses change. Option A is insecure as it allows traffic from any source (0.0.0.0/0). Option C is not recommended because the ALB's private IP addresses can change (e.g., during scaling or replacement), making static IP rules difficult to maintain. Option D is too broad, as it would allow traffic from any resource within the VPC CIDR, not just the ALB.

Answer

Allow inbound from 0.0.0.0/0 on port 80

Answer

Allow inbound from the ALB's private IP addresses on port 80

Answer

Allow inbound from the VPC CIDR on port 80

Question 8

A company is designing a network security architecture for a multi-tier web application. Which THREE best practices should they implement? (Choose three.)

Accepted Answer

Use network ACLs as a stateless firewall for subnet-level traffic. The correct answers are C, D, and E. Option C is correct because network ACLs provide a stateless firewall at the subnet level. Option D is correct because databases in private subnets have no direct internet access, enhancing security. Option E is correct because security groups control traffic at the instance level. Option A is wrong because internet gateways should be attached to public subnets, not private. Option B is wrong because security groups are stateful, not stateless.

Answer

Attach an internet gateway to the private subnet for outbound traffic

Answer

Use security groups as a stateless firewall

Question 9

A security engineer is troubleshooting an issue where Amazon Inspector is not finding any vulnerabilities in an EC2 instance. The instance has the AWS Systems Manager Agent (SSM Agent) installed and is managed by AWS Systems Manager. What is the most likely reason for Inspector not reporting findings?

Accepted Answer

The EC2 instance does not have an IAM role that allows Inspector to scan it.. Amazon Inspector requires an IAM role that grants it permission to assess the EC2 instance. Without such a role, Inspector cannot perform vulnerability scans, even if the SSM Agent is installed and the instance is managed by Systems Manager. The other options are incorrect: the instance is managed by SSM (contradicting D), and missing NAT gateway or security group outbound rules do not prevent Inspector from scanning (Inspector initiates scans internally).

Answer

The EC2 instance is in a private subnet without a NAT gateway.

Answer

The EC2 instance's security group blocks outbound traffic to the Inspector service.

Answer

The EC2 instance is not managed by AWS Systems Manager.

Question 10

A company wants to block outbound traffic from a VPC to the internet except through a NAT Gateway for updates to specific software repositories. Which AWS service should be used to control outbound traffic?

Accepted Answer

Network ACLs. Network ACLs can be attached to subnets to control inbound and outbound traffic at the subnet level, and can be used to block outbound internet traffic except through the NAT Gateway. Option A is wrong because Security Groups are stateful and cannot block outbound traffic based on destination IP ranges in a granular manner. Option B is wrong because Route Tables control routing, not filtering. Option C is wrong because VPC Endpoints are for private connectivity to AWS services, not for controlling outbound internet traffic.

Answer

Security Groups

Answer

Route Tables

Answer

VPC Endpoints

Question 11

Which THREE components are necessary to enable encryption in transit for traffic between an on-premises data center and an Amazon VPC over AWS Site-to-Site VPN? (Choose three.)

Accepted Answer

A customer gateway (CGW) in the on-premises network. The correct answers are A, D, and E. A customer gateway (CGW) represents the on-premises device, a virtual private gateway (VGW) is the AWS endpoint, and an IPsec VPN tunnel between them provides encryption in transit. Option B is wrong because an internet gateway is used for internet connectivity, not VPN. Option C is wrong because SSL/TLS is not used for Site-to-Site VPN; it uses IPsec with pre-shared keys or certificates.

Answer

An internet gateway (IGW) attached to the VPC

Answer

An SSL/TLS certificate for the VPN tunnel

Question 12

A company is using AWS Shield Advanced to protect against DDoS attacks. They want to receive notifications when an attack is detected. Which AWS service should they integrate with to receive notifications?

Accepted Answer

Amazon CloudWatch and Amazon Simple Notification Service (SNS). AWS Shield Advanced sends metrics to CloudWatch, and you can create CloudWatch alarms to trigger SNS notifications. Option A (SQS) is for queuing. Option B (Lambda) can be triggered but SNS is simpler. Option D (Kinesis) is for streaming.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon Kinesis Data Streams

Question 13

A company has a VPC with public and private subnets in two Availability Zones. The private subnets host EC2 instances that need to access the internet for software updates but must not be accessible from the internet. Which combination of resources meets these requirements with the least operational overhead?

Accepted Answer

A NAT Gateway in each public subnet, with a route in the private route tables pointing to the NAT Gateway. A NAT Gateway in each public subnet provides outbound-only internet access for instances in private subnets, with no inbound accessibility from the internet. This solution requires minimal operational overhead because NAT Gateways are fully managed by AWS, automatically handle failover across Availability Zones, and scale up to 45 Gbps without manual intervention. The private route table simply needs a default route (0.0.0.0/0) pointing to the NAT Gateway, which forwards traffic to the Internet Gateway attached to the VPC.

Answer

A VPC endpoint for Amazon S3 in each private subnet

Answer

A NAT instance in each public subnet, with a route in the private route tables pointing to the NAT instance

Answer

An Internet Gateway attached to the VPC with a route in the private route tables pointing to the Internet Gateway

Question 14

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company has a NAT gateway in a public subnet. The EC2 instance can connect to other instances in the VPC but cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table in the private subnet does not have a default route to the NAT gateway.. For an EC2 instance in a private subnet to reach the internet via a NAT gateway, the private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway as the target. Without this route, traffic destined for the internet has no path to the NAT gateway, so the instance can communicate within the VPC but cannot reach external hosts. Option D correctly identifies this missing route as the most likely cause.

Answer

The security group of the EC2 instance blocks outbound HTTPS traffic.

Answer

The NAT gateway does not have an Elastic IP address.

Answer

The network ACL of the private subnet blocks inbound traffic from the NAT gateway.

Question 15

A company is designing a multi-Region architecture using AWS Transit Gateway and Direct Connect. They have VPCs in us-east-1 and eu-west-1, each with an attached Transit Gateway. The Direct Connect gateway is associated with the Transit Gateway in us-east-1. They need to enable communication between VPCs across Regions using the Direct Connect gateway. What is the correct design to achieve this?

Accepted Answer

Create a Transit Gateway peering attachment between the Transit Gateways in us-east-1 and eu-west-1, and route traffic over the Direct Connect gateway via the peering.. Transit Gateway peering attachments allow transitive routing between Transit Gateways in different AWS Regions. By establishing a peering attachment between the Transit Gateways in us-east-1 and eu-west-1, traffic from the VPC in eu-west-1 can be routed through its local Transit Gateway, across the peering attachment to the Transit Gateway in us-east-1, and then over the Direct Connect gateway to on-premises networks. This design enables cross-region VPC communication via Direct Connect without requiring a single Transit Gateway or direct VPC peering.

Answer

Create a single Transit Gateway that spans both Regions and attach VPCs in both Regions.

Answer

Use VPC peering between the VPCs and route Direct Connect traffic through the VPC peering connection.

Answer

Associate the Direct Connect gateway with both Transit Gateways in us-east-1 and eu-west-1.