ANS-C01 Practice Test 39 — 15 Questions

Question 1

Refer to the exhibit. A security engineer applies this SCP to an AWS account. What is the effect of this policy?

Accepted Answer

All API calls that are not made over HTTPS will be denied. The SCP shown likely denies all API calls that are not made over HTTPS. In AWS, SCPs can enforce conditions such as aws:SecureTransport, which when set to false, denies requests that are not using SSL/TLS. The policy effect is that any API call not using HTTPS is denied, while HTTPS calls are allowed (unless other restrictions apply).

Answer

All API calls over HTTPS will be allowed

Answer

Only S3 API calls will be affected

Answer

The policy requires multi-factor authentication

Question 2

A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. Which THREE steps are necessary?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets. Option B is correct because a Gateway Load Balancer (GWLB) is the AWS service designed to distribute traffic to third-party virtual firewall appliances, using GENEVE encapsulation on port 6081, and its endpoint is what the Transit Gateway routes traffic to for inspection. Option C is correct because Transit Gateway route tables must be configured so that traffic between the VPC attachments is directed to the firewall VPC attachment (specifically to the GWLB endpoint), enabling the inspection path rather than direct VPC-to-VPC routing. Option E is correct because the VPC hosting the firewall appliances must itself be attached to the Transit Gateway so the GWLB endpoint can receive and return traffic from the other VPC attachments. Option A is incorrect because VPC peering bypasses the Transit Gateway entirely and would not route traffic through the firewall appliance. Option D is incorrect because a NAT Gateway provides outbound internet access for private subnets and has nothing to do with inspecting inter-VPC traffic via a third-party firewall.

Answer

Create a VPC peering connection between the VPCs to allow traffic flow

Answer

Configure a NAT Gateway in each VPC to route traffic through the firewall

Question 3

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and receives traffic from clients. The company wants to improve security by adding an additional layer of protection against common web exploits like SQL injection and cross-site scripting. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF (Web Application Firewall) is the correct service because it is specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). It integrates directly with an Application Load Balancer (ALB) to inspect HTTP/HTTPS requests and apply customizable rules to block malicious traffic before it reaches the EC2 instances.

Answer

AWS Firewall Manager

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 4

A company has a VPC with public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which solution provides internet access while keeping the instance private?

Accepted Answer

Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.. A NAT Gateway deployed in a public subnet enables instances in a private subnet to initiate outbound internet connections while remaining private (no inbound connections from the internet). The private subnet's route table must have a route for 0.0.0.0/0 pointing to the NAT Gateway. This is the standard AWS solution for providing internet access to private instances for software updates.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Answer

Use an AWS PrivateLink VPC endpoint for the software update service.

Answer

Set up a VPC peering connection with another VPC that has internet access.

Question 5

An IAM policy is applied to a user. The user reports that they cannot run 'aws ec2 describe-instances --region eu-west-1' but can run the same command in us-east-1. What is the most likely reason?

Accepted Answer

The policy denies ec2:Describe* when the region is not us-east-1.. The most likely reason is that the IAM policy contains an explicit Deny statement for ec2:Describe* when the request region is not us-east-1. In AWS IAM, an explicit Deny always overrides any Allow, so even if the user has Allow permissions elsewhere, the Deny for eu-west-1 blocks the action. This explains why the same command works in us-east-1 but fails in eu-west-1.

Answer

The policy only applies to resources in us-east-1, so other regions are implicitly denied.

Answer

The policy condition uses StringEquals, which only allows requests from us-east-1.

Answer

The policy allows ec2:Describe* in all regions, but the user lacks permissions in eu-west-1.

Question 6

A company is using AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The VPC has a CIDR 10.0.0.0/16. The on-premises network uses 192.168.0.0/16. The company wants to enable communication between on-premises and the VPC, and also allow the VPC to access the internet via an internet gateway. Which TWO of the following configurations are necessary?

Accepted Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the internet gateway.. An internet gateway (IGW) provides internet access for a VPC, and the VPC's main route table must include a default route (0.0.0.0/0) pointing to the IGW for outbound internet traffic. This allows instances in the VPC to reach the internet, which is a stated requirement. Without this route, traffic destined for the internet would have no path.

Answer

A route in the on-premises router for the VPC CIDR (10.0.0.0/16) pointing to the AWS Direct Connect router.

Answer

A route in the VPC route table for 0.0.0.0/0 pointing to the virtual private gateway.

Answer

A route in the VPC route table for the on-premises CIDR (192.168.0.0/16) pointing to the internet gateway.

Question 7

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The security team wants to ensure that traffic between the on-premises network and the VPC is encrypted using IPSec. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN connection over the Direct Connect public virtual interface using a customer gateway and a virtual private gateway.. It establishes an IPSec VPN tunnel over a Direct Connect public virtual interface (VIF), which encrypts traffic between the on-premises network and the VPC. The customer gateway and virtual private gateway create a site-to-site VPN connection that uses IPSec to secure all data traversing the Direct Connect link, meeting the encryption requirement without relying on physical-layer security.

Answer

Use a private virtual interface (VIF) on the Direct Connect connection and enable encryption at the physical layer.

Answer

Use VPC endpoints (Gateway Endpoints) for all traffic between on-premises and the VPC.

Answer

Attach the Direct Connect virtual interface to a Transit Gateway and enable multicast.

Question 8

Refer to the exhibit. A network engineer is creating an IAM policy to allow a user to manage VPC Peering connections. The user reports that they cannot delete a VPC Peering connection. What should the engineer add to the policy?

Accepted Answer

ec2:DeleteVpcPeeringConnection. The IAM policy must include the ec2:DeleteVpcPeeringConnection action to allow deletion of a VPC peering connection. Without this specific action, the user's API call to delete the peering connection is denied, even if they have other peering-related permissions. Adding this action to the policy grants the necessary authorization.

Answer

ec2:DescribeVpcPeeringConnectionRouteTables

Answer

ec2:ModifyVpcPeeringConnectionOptions

Answer

ec2:RejectVpcPeeringConnection

Question 9

A company is deploying a web application behind an Application Load Balancer (ALB). The application must only accept traffic from the ALB. Which security group configuration should be used for the EC2 instances?

Accepted Answer

Allow inbound from the ALB security group on port 80. To ensure the EC2 instances only accept traffic from the ALB, the security group should reference the ALB's security group as the source. This is a best practice because the ALB acts as a proxy, and using its security group dynamically allows traffic from any ALB instance, even if the ALB's IP addresses change. Option A is insecure as it allows traffic from any source (0.0.0.0/0). Option C is not recommended because the ALB's private IP addresses can change (e.g., during scaling or replacement), making static IP rules difficult to maintain. Option D is too broad, as it would allow traffic from any resource within the VPC CIDR, not just the ALB.

Answer

Allow inbound from 0.0.0.0/0 on port 80

Answer

Allow inbound from the ALB's private IP addresses on port 80

Answer

Allow inbound from the VPC CIDR on port 80

Question 10

Refer to the exhibit. A network engineer has established a VPC peering connection between VPC A (10.0.0.0/16) in account 111111111111 and VPC B (192.168.0.0/16) in account 222222222222. The peering connection status is 'active'. However, instances in VPC A cannot reach instances in VPC B. What is the MOST likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes to the peer CIDR. Even when a VPC peering connection is 'active', traffic will not flow unless both VPC route tables contain routes pointing the peer CIDR to the peering connection. The most common cause of this symptom is missing or incorrect route table entries in one or both VPCs. Security groups and CIDR overlap are possible but less likely given the scenario.

Answer

The peering connection is not in the 'active' state

Answer

Security groups in VPC B are blocking traffic

Answer

The CIDR blocks overlap

Question 11

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. The bucket policy should deny requests that do not originate from the VPC. Which condition key should be used in the bucket policy?

Accepted Answer

aws:SourceVpc. The correct condition key is `aws:SourceVpc`, which allows you to restrict access to an S3 bucket based on the VPC from which the request originates. When used in a bucket policy with a Deny effect, it ensures that only requests coming from the specified VPC ID are allowed, and all other requests are denied. This key is specifically designed for VPC-based access control in S3 bucket policies.

Answer

aws:VpcSourceIp

Answer

aws:Referer

Answer

aws:SourceIp

Question 12

A company has a VPC with resources that need to access an S3 bucket in the same region. To minimize latency and avoid internet traffic, which configuration should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet, minimizing latency and avoiding data transfer costs. It is the recommended approach for accessing S3 from a VPC. While VPC Interface Endpoints for S3 also provide private access, they incur hourly charges and additional data processing fees. In most scenarios, Gateway Endpoints are preferred for S3 and DynamoDB due to their simplicity and cost-effectiveness. NAT Gateway (A) is used for internet-bound traffic, not private S3 access. VPC peering (C) connects VPCs but does not provide direct access to S3.

Answer

Use a NAT Gateway in a public subnet and route traffic through it

Answer

Use VPC peering to connect to an S3 bucket

Answer

Create a VPC Interface Endpoint for S3

Question 13

A company is deploying a global application behind an Application Load Balancer (ALB) in AWS. They want to use AWS Global Accelerator to improve performance by directing traffic to the nearest healthy endpoint. Which configuration is required to achieve this?

Accepted Answer

Create an accelerator with an endpoint group that includes the ALB as an endpoint. AWS Global Accelerator uses endpoint groups to direct traffic to the nearest healthy endpoint. By creating an accelerator with an endpoint group that includes the ALB as an endpoint, Global Accelerator can route user traffic over the AWS global network to the optimal ALB based on latency and health, improving performance for global users.

Answer

Configure Route 53 health checks for the ALB and associate them with Global Accelerator

Answer

Configure a CloudFront distribution with the ALB as an origin and enable Global Accelerator

Answer

Create a Route 53 latency-based routing record set pointing to the ALB

Question 14

A company is deploying a global application that uses Amazon Route 53 for DNS. The application runs in multiple AWS Regions and uses latency-based routing. The company wants to ensure that if all endpoints in a Region become unhealthy, traffic is automatically routed to the next best Region. Which Route 53 configuration should be used to achieve this?

Accepted Answer

Create latency records for each Region and associate health checks with each record. Enable Evaluate Target Health for the records.. Latency-based routing with health checks and Evaluate Target Health allows Route 53 to direct users to the lowest-latency healthy endpoint. If a Region becomes unhealthy, its records are removed from consideration, and traffic goes to the next best healthy Region.

Answer

Create weighted records for each Region with equal weights and associate health checks with each record.

Answer

Create geolocation records for each Region and associate health checks with each record.

Answer

Create failover records with a primary record for one Region and a secondary record for another Region.

Question 15

A network engineer is setting up an AWS Site-to-Site VPN connection. The customer gateway device is behind a NAT device that performs PAT. The VPN tunnel fails to come up. What is the most likely cause?

Accepted Answer

The NAT device is not forwarding UDP 500 and UDP 4500 traffic.. IPsec requires UDP ports 500 and 4500, which must be forwarded through the NAT device. Option A is incorrect because tunnel options such as DPD and encryption algorithms do not need to match exactly for the tunnel to come up. Option B is incorrect because disabling DPD does not prevent tunnel establishment; it only affects detection of peer failure. Option C is incorrect because route propagation does not affect the establishment of the VPN tunnel itself; it affects routing of traffic once the tunnel is up.

Answer

The tunnel options (DPD, encryption algorithms) must match exactly.

Answer

Dead peer detection (DPD) is disabled.

Answer

The VPN connection does not have route propagation enabled.