ANS-C01 Practice Test 44 — 15 Questions

Question 1

A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.. The best approach. By creating a Transit Gateway attachment in the inspection VPC and configuring the Network Load Balancer (NLB) as the target, all inter-VPC traffic can be routed through the firewall via Transit Gateway route tables. This ensures centralized inspection without introducing complexity. Option A is incorrect because a Gateway Load Balancer (GWLB) is not needed here; the NLB already provides load balancing for the firewall instances. Option B is incorrect because VPC peering bypasses the Transit Gateway, defeating centralized inspection. Option C is incorrect because deploying a firewall in each VPC is not centralized and increases management overhead.

Answer

Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.

Answer

Use VPC peering between each VPC and the inspection VPC.

Answer

Deploy a firewall appliance in each VPC and route traffic locally.

Question 2

A company has a hybrid network with multiple AWS Direct Connect connections to multiple VPCs. They want to monitor network performance and receive alerts when latency exceeds a threshold. Which combination of AWS services should be used to achieve this?

Accepted Answer

Amazon CloudWatch and Amazon CloudWatch Alarms. Amazon CloudWatch collects metrics from Direct Connect, including latency, and CloudWatch Alarms can trigger notifications via SNS when thresholds are exceeded. Option A is incorrect because CloudTrail logs API calls, not performance metrics. Option B is incorrect because Trusted Advisor provides best practice checks, not real-time latency monitoring, and SES is for email sending, not alerting. Option D is incorrect because VPC Flow Logs capture IP traffic metadata, not latency metrics, and CloudWatch Logs store log data, not metrics.

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Trusted Advisor and Amazon SES

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Question 3

A company is designing a network security architecture for a multi-account environment using AWS Organizations. Which TWO services can be used to centrally manage security policies across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Firewall Manager provides centralized management of firewall rules (including AWS WAF, AWS Shield Advanced, and security groups) across all accounts in AWS Organizations. AWS Organizations Service Control Policies (SCPs) allow you to centrally define and enforce permission boundaries and security policies across all member accounts. In contrast, AWS Config and AWS CloudTrail operate per account and do not provide centralized policy management across multiple accounts. Amazon VPC is a per-account networking service. Therefore, the correct answers are C (SCPs) and D (Firewall Manager).

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon VPC

Question 4

A company has a VPC with multiple security groups. An EC2 instance in security group A needs to communicate with an RDS instance in security group B on port 3306. The security team wants to minimize exposure. What should the inbound rule in security group B be?

Accepted Answer

Allow inbound TCP 3306 from security group A. Referencing security group A as the source allows inbound traffic on port 3306 from any instance associated with security group A, which is the most specific and secure method. This approach automatically adapts if instances in security group A change IP addresses. Option A is wrong because it allows traffic from any instance in the specified subnet, not just those that need to communicate. Option B is wrong because it allows traffic from all IP addresses, violating the principle of least privilege. Option C is wrong because it ties the rule to a single instance's IP address, which can change and requires updates if the instance is replaced.

Answer

Allow inbound TCP 3306 from the CIDR block of the subnet where the EC2 instance resides

Answer

Allow inbound TCP 3306 from 0.0.0.0/0

Answer

Allow inbound TCP 3306 from the private IP address of the EC2 instance

Question 5

A network engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. Which AWS service should be used?

Accepted Answer

VPC Flow Logs.. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, enabling analysis of traffic between EC2 instances. Option A is wrong because CloudTrail logs API calls, not network traffic. Option B is wrong because CloudWatch Metrics provide performance metrics, not packet-level details. Option D is wrong because AWS Config monitors configuration changes, not traffic.

Answer

AWS CloudTrail.

Answer

Amazon CloudWatch Metrics.

Answer

AWS Config.

Question 6

A company wants to use AWS Certificate Manager (ACM) to provide a TLS certificate for a website hosted on an ALB. The domain is example.com, and the certificate must be renewed automatically. Which type of certificate should be requested?

Accepted Answer

A public certificate issued by ACM with DNS validation. ACM automatically renews public certificates if DNS validation is used. Option A is incorrect because private certificates issued by ACM Private CA are not trusted by public browsers. Option B is incorrect because self-signed certificates are not trusted by browsers and must be manually renewed. Option C is incorrect because imported certificates from third-party CAs must be manually renewed.

Answer

A private certificate issued by ACM Private CA

Answer

A self-signed certificate generated with OpenSSL

Answer

A certificate imported into ACM from a third-party CA

Question 7

Which TWO encryption methods for data at rest in Amazon S3 use AWS-managed or customer-managed keys? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 uses AWS-managed keys, and SSE-KMS uses customer-managed keys via AWS KMS. Both are valid methods to encrypt data at rest in Amazon S3. SSE-C uses customer-provided keys, which is not a managed key service. Client-side encryption is performed by the client before upload and does not use AWS-managed or customer-managed keys. SSL/TLS encrypts data in transit, not at rest.

Answer

SSE-C

Answer

Client-Side Encryption

Answer

SSL/TLS

Question 8

A security group is configured as shown. An EC2 instance in the same VPC with IP 10.0.1.50 can connect to the instance on port 443. An on-premises client with IP 203.0.113.5 cannot connect. What is the most likely reason?

Accepted Answer

The security group only allows traffic from the 10.0.0.0/16 CIDR. The security group inbound rule only allows traffic from the 10.0.0.0/16 CIDR block. The on-premises client IP (203.0.113.5) is outside that range, so the connection is implicitly denied. Option A is incorrect because security groups are stateful, so return traffic is allowed automatically. Option B is incorrect because HTTPS uses TCP, not UDP. Option D is incorrect because security groups do not support explicit deny rules; they only have allow rules, and any traffic not matching an allow rule is implicitly denied.

Answer

The security group's outbound rules block return traffic

Answer

The protocol is incorrect; HTTPS uses UDP

Answer

The security group has a deny rule for the on-premises IP

Question 9

A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?

Accepted Answer

Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.. AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF. Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.

Answer

Add the partner IPs to a Network ACL allow rule in the VPC.

Answer

Remove the blocking WAF rules and rely on Shield Advanced only.

Answer

Add the partner IPs to an AWS Shield Advanced IP whitelist.

Question 10

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the AWS account, including calls to authorize security group rule changes (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). This makes it the appropriate service for auditing changes to security group rules. AWS Config (Option B) records resource configurations and can track changes, but it is not the primary service for API-level auditing. VPC Flow Logs (Option C) capture network traffic metadata, not configuration changes. Amazon Inspector (Option D) is a vulnerability assessment service, not an audit service for changes.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 11

A company has a VPC with public and private subnets. The security team wants to allow instances in a private subnet to download software updates from the internet but prevent inbound internet traffic. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway allows outbound internet traffic from private subnets while blocking unsolicited inbound traffic. Option D is correct. Option A is wrong because an internet gateway enables bidirectional traffic, which would allow inbound traffic. Option B is wrong because AWS Site-to-Site VPN is used for hybrid connectivity between on-premises and AWS, not for outbound internet access from private subnets. Option C is wrong because VPC peering connects VPCs together, not to the internet.

Answer

Internet gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 12

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should they use?

Accepted Answer

Add a bucket policy with a condition that requires aws:SourceVpc to be the VPC ID.. S3 bucket policies can use the aws:SourceVpc condition key to restrict access to requests originating from a specific VPC. Option A is wrong because IAM policies are attached to users, roles, or groups, not to the bucket itself, and they cannot restrict based on VPC directly. Option B is wrong because security groups cannot be attached to S3 buckets; they are used for EC2 instances and other resources. Option D is wrong because a VPC Endpoint policy controls what actions are allowed through the endpoint, but it does not restrict access based on the source VPC; the bucket policy is required for that.

Answer

Create an IAM policy that restricts access to the VPC and attach it to all users.

Answer

Attach a security group to the S3 bucket that allows traffic from the VPC.

Answer

Create a VPC Endpoint policy that allows access only from the VPC.

Question 13

A company is implementing a multicast application in AWS. The application requires that multicast traffic be forwarded between Amazon EC2 instances in different VPCs. The company has set up a multicast domain using AWS Transit Gateway Connect with multicast support. The multicast group is using the IP address 239.0.1.10. The network engineer has confirmed that the EC2 instances are registered as multicast members and that the Transit Gateway multicast domain is configured correctly. However, receivers in VPC B are not receiving multicast traffic from senders in VPC A. What is the MOST likely cause of this issue?

Accepted Answer

The security group for the sender EC2 instances does not allow outbound UDP traffic to the multicast group address.. The issue is that the sender EC2 instances' security group must allow outbound UDP traffic to the multicast group address 239.0.1.10. Even though the Transit Gateway multicast domain is correctly configured, security groups act as a virtual firewall at the instance level and can block multicast traffic if the appropriate outbound rule is not present. Option C is correct because without this rule, the traffic is blocked at the source. Option A is incorrect because multicast groups are not tied to specific subnets; they are associated with the transit gateway. Option B is incorrect because TTL is not a limiting factor in this scenario; AWS Transit Gateway multicast handles traffic within the domain regardless of TTL. Option D is incorrect because IGMP join messages are not required; multicast group members are statically registered in the Transit Gateway multicast domain.

Answer

The multicast group is not associated with the correct subnet in VPC A.

Answer

The multicast traffic has a TTL value of 1, which prevents it from leaving the source subnet.

Answer

The receiver instances are not sending IGMP join messages to the multicast group.

Question 14

A company needs to establish a dedicated, low-latency, and consistent network connection from their on-premises data center to AWS. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, low-latency, and consistent private network connection from on-premises to AWS, bypassing the internet. Option A (Site-to-Site VPN) uses the public internet and is less consistent. Option B (VPN CloudHub) connects multiple on-premises sites to AWS but still relies on the internet. Option C (VPC peering) connects VPCs within AWS, not on-premises. Therefore, D is correct.

Answer

AWS Site-to-Site VPN

Answer

AWS VPN CloudHub

Answer

VPC peering

Question 15

A company has a VPC with multiple subnets. They want to block all traffic from the internet to their private subnets, but allow outbound internet traffic from those subnets through a NAT Gateway. Which configuration should they use?

Accepted Answer

Route table with 0.0.0.0/0 -> NAT Gateway. A route table associated with the private subnets should have a default route (0.0.0.0/0) pointing to the NAT Gateway. This allows outbound internet traffic while blocking inbound internet traffic. Option B (Virtual Private Gateway) is for VPN connections. Option C (VPC Peering) is for connectivity between VPCs. Option D (Internet Gateway) would allow inbound internet traffic, which is not desired.

Answer

Route table with 0.0.0.0/0 -> Virtual Private Gateway

Answer

Route table with 0.0.0.0/0 -> VPC Peering Connection

Answer

Route table with 0.0.0.0/0 -> Internet Gateway