ANS-C01 Practice Exam 53 — 20 Questions

Question 1

A company has a VPC with public and private subnets. They launch an Application Load Balancer (ALB) in the public subnets and targets in private subnets. Security requirements dictate that the targets should only accept traffic from the ALB. Which security group configuration meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the target security group inbound rule to allow HTTP from the ALB security group ID.. Referencing the ALB security group by ID in the target security group inbound rule allows traffic only from that specific security group, ensuring that only the ALB can reach the targets. This is a best practice for securing traffic between an ALB and its targets. Option A is incorrect because allowing HTTP from 0.0.0.0/0 would permit traffic from any source, not just the ALB. Option C is incorrect because the ALB's traffic originates from its elastic network interfaces (ENIs), which are associated with the ALB security group, not a fixed public IP. Option D is incorrect because allowing traffic from the entire VPC CIDR would permit any resource in the VPC to reach the targets, not just the ALB.

Answer

Set the target security group inbound rule to allow HTTP from 0.0.0.0/0.

Answer

Set the target security group inbound rule to allow HTTP from the ALB's public IP address.

Answer

Set the target security group inbound rule to allow HTTP from the VPC CIDR.

Question 2

A company is designing a security group configuration for a three-tier web application (web, application, database). The web tier is accessible from the internet. Which TWO rules should be applied to meet security best practices?

Accepted Answer

App tier security group: inbound from the web tier security group on port 8080.. Option C is correct because the application tier should only accept traffic from the web tier, and referencing the web tier's security group as the source enforces that only web-tier instances can reach the app tier on port 8080, following least-privilege and tier isolation. Option D is correct because the web tier is the public-facing layer, so allowing inbound HTTPS (port 443) from 0.0.0.0/0 is appropriate for serving internet users securely over TLS. Option A is wrong because opening the app tier to 0.0.0.0/0 on port 8080 exposes the internal application layer directly to the internet, violating tier isolation. Option B is wrong because the database tier should accept connections from the application tier, not directly from the web tier, since only the app tier should communicate with the database. Option E is wrong because exposing the database on port 3306 to 0.0.0.0/0 makes it publicly reachable, which is a critical security misconfiguration.

Answer

App tier security group: inbound from 0.0.0.0/0 on port 8080.

Answer

Database tier security group: inbound from the web tier security group on port 3306.

Answer

Database tier security group: inbound from 0.0.0.0/0 on port 3306.

Question 3

A company is using AWS Organizations and wants to centrally manage and enforce the use of VPC endpoints for S3 across all accounts. Which THREE services/tools can be combined to achieve this?

Accepted Answer

AWS Config rules. To centrally manage and enforce the use of VPC endpoints for S3 across all accounts in AWS Organizations, you can combine AWS Service Control Policies (SCPs) to allow or deny VPC endpoint creation at the organizational level, AWS CloudFormation StackSets to deploy VPC endpoints consistently across multiple accounts, and AWS Config rules to detect non-compliant resources such as missing VPC endpoints. Option B (AWS Config rules) is correct because it can evaluate compliance and trigger remediation. Option C (AWS CloudFormation StackSets) is correct because it automates deployment of VPC endpoints in target accounts. Option D (AWS SCPs) is correct because it enforces policies on endpoint creation. Option A (VPC Flow Logs) is wrong because it only logs traffic, not enforce policies. Option E (AWS Transit Gateway) is wrong because it provides network connectivity, not endpoint management.

Answer

VPC Flow Logs

Answer

AWS Transit Gateway

Question 4

A network engineer needs to capture and analyze all IP traffic entering and leaving a specific EC2 instance's elastic network interface for security auditing. The engineer wants to avoid capturing traffic from other instances and minimize costs. Which solution BEST meets these requirements?

Accepted Answer

Set up Traffic Mirroring with the instance's elastic network interface as the source and a monitoring instance as the target.. Traffic Mirroring is designed to copy network traffic from an ENI to a target for deep packet inspection. By selecting only the instance's ENI as the source, the engineer limits capture to that instance's traffic, reducing costs and fulfilling the need for full IP traffic analysis. Other options either capture metadata only or are overly complex.

Answer

Use AWS Network Firewall to log all traffic and forward logs to Amazon S3 for analysis.

Answer

Configure Traffic Mirroring on the instance's elastic network interface to send traffic to a Network Load Balancer.

Answer

Enable VPC Flow Logs on the VPC and filter the logs for the instance's private IP address.

Question 5

A company uses AWS Transit Gateway to connect multiple VPCs. Security requirements mandate that traffic between VPCs must be inspected by a centralized firewall appliance in a dedicated inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

Accepted Answer

Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment. Configuring Transit Gateway route tables with blackhole routes for inter-VPC traffic forces that traffic to be dropped unless a more specific route exists. By adding a default route pointing to the inspection VPC attachment, all inter-VPC traffic is routed through the inspection VPC for centralized firewall inspection. This approach is efficient and scalable. Option A is incorrect because deploying AWS Network Firewall in each VPC distributes inspection and does not centralize it. Option B is incorrect because Transit Gateway multicast is designed for one-to-many data replication, not for routing traffic through a central inspection point. Option D is incorrect because VPC peering connections do not provide centralized routing control and do not scale well as the number of VPCs increases.

Answer

Deploy AWS Network Firewall in each VPC and configure central logging

Answer

Use Transit Gateway multicast to replicate traffic to the inspection VPC

Answer

Create VPC peering connections between all VPCs and the inspection VPC, then configure route tables to send traffic through the peering connection

Question 6

A company uses AWS WAF to protect its web application from common exploits. The security team notices that a specific IP address is generating a high volume of requests and should be blocked immediately. Which action should be taken?

Accepted Answer

Update the AWS WAF IP set rule to block the IP address. AWS WAF allows creating IP set rules to block specific IP addresses. Therefore, the correct action is to update the IP set rule to include the problematic IP. Option A is correct. Option B is wrong because security groups operate at the network layer and are not integrated with WAF. Option C is wrong because NACLs are stateless and not suitable for application-layer blocking. Option D is wrong because CloudFront geo-restriction blocks based on geographic location, not individual IPs.

Answer

Add a rule to the security group to deny traffic from that IP

Answer

Add a network ACL rule to deny traffic from that IP in the subnet

Answer

Use AWS CloudFront geo-restriction to block the IP

Question 7

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The security team needs to centrally manage and enforce network security policies across all accounts. Which TWO services or features can be used to centrally enforce network security controls? (Choose TWO.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed, stateful firewall service that provides application-layer filtering and intrusion prevention for VPCs. AWS Firewall Manager offers a centralized dashboard to deploy and manage firewall rules across all accounts in an AWS Organization. Together, they enable consistent, centrally enforced network security policies. In contrast, Network ACLs (option B) are stateless and must be configured per subnet per account—no central management. VPC Flow Logs (option D) capture traffic metadata but do not enforce any rules. Security groups with cross-account references (option E) allow referencing security groups from other accounts but require per-resource attachment and lack central policy enforcement. Therefore, the two correct services are AWS Network Firewall (A) and AWS Firewall Manager (C).

Answer

Network ACLs

Answer

VPC Flow Logs

Answer

VPC security groups with cross-account references

Question 8

A company has a VPC with a single NAT gateway in one Availability Zone. EC2 instances in private subnets across three AZs use that NAT gateway for internet access. During an AZ impairment, instances in the other AZs lose internet connectivity. The network team must design a resilient egress solution with minimal operational overhead. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in each Availability Zone and update each private subnet's route table to use the NAT gateway in the same AZ.. A NAT gateway is an AZ-scoped resource, so a single NAT gateway creates a single point of failure for all subnets that route through it. Deploying one NAT gateway in each AZ and aligning each private subnet's route table with the NAT gateway in the same AZ provides fault isolation and high availability. Because NAT gateways are fully managed, this design adds resilience without adding patching or scaling tasks.

Answer

Replace the NAT gateway with a NAT instance on an EC2 instance in each private subnet and configure each instance to route through itself.

Answer

Attach an internet gateway to the VPC and add a route in each private subnet's route table to the internet gateway.

Answer

Create a VPC peering connection from each private subnet to a shared services VPC that hosts a single NAT gateway.

Question 9

A company is using Amazon S3 to store sensitive data. They want to ensure that data is encrypted at rest and that access is logged. Which TWO services should they enable?

Accepted Answer

S3 Server Access Logs. And E are correct: S3 Server-Side Encryption (SSE) encrypts data at rest, fulfilling the encryption requirement; S3 Server Access Logs log requests to the bucket, fulfilling the logging requirement. Option A (AWS Config) is incorrect because it monitors configuration changes, not data access. Option C (VPC Flow Logs) is incorrect because it captures network traffic, not S3 requests. Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls but S3 Server Access Logs provide more granular object-level logging, and the question asks for access logging, not API call logging.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 10

A network engineer is troubleshooting an issue where an on-premises server cannot reach an EC2 instance in a VPC over a Site-to-Site VPN. The VPN tunnel is up, and BGP is established. The engineer checks the route tables and sees the on-premises CIDR in the VPC route table pointing to the virtual private gateway. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route back to the VPC CIDR pointing to the VPN tunnel.. Although the VPN tunnel is up and BGP is established, the on-premises router must have a route pointing back to the VPC CIDR through the VPN tunnel for return traffic. Without this route, traffic from the EC2 instance to the on-premises server cannot be routed back, causing a one-way connectivity issue. Option A is incorrect because a mismatch in pre-shared keys would prevent the tunnel from coming up. Option C is incorrect because network ACLs are stateless and would affect traffic in both directions if misconfigured, not just one-way. Option D is incorrect because security group rules affect inbound traffic only; the issue here is return traffic from the EC2 instance, which is outbound from the VPC perspective, and the security group does not control outbound traffic in this context.

Answer

The VPN tunnel is not passing traffic due to a mismatch in pre-shared keys.

Answer

The network ACLs in the VPC are blocking the traffic.

Answer

The security group attached to the EC2 instance is blocking inbound traffic from the on-premises CIDR.

Question 11

An engineer runs the command above for a subnet associated with this network ACL. The subnet's CIDR is 10.0.1.0/24. An EC2 instance in the subnet attempts to initiate an HTTPS connection to a server on the internet. What is the result?

Accepted Answer

The connection fails because the inbound HTTPS return traffic is denied by rule 200.. Based on the provided network ACL exhibit, inbound rule 200 denies all traffic (0.0.0.0/0, ALL traffic). Even though outbound HTTPS is allowed, the return traffic for the HTTPS connection (which is inbound) is evaluated against the inbound rules. Since rule 200 denies all inbound traffic, the return packets are dropped, causing the connection to fail. Network ACLs are stateless, so both inbound and outbound rules must explicitly allow the traffic.

Answer

The connection fails because the outbound rule does not allow HTTPS.

Answer

The connection succeeds because outbound traffic is allowed.

Answer

The connection succeeds because inbound rule 100 allows HTTPS from the subnet.

Question 12

A company is deploying a new application in a VPC with public and private subnets. The application servers in the private subnets need to access the internet to download patches. Which configuration meets this requirement without allowing inbound internet traffic?

Accepted Answer

Create a NAT gateway in a public subnet and add a route to the NAT gateway from the private subnets' route tables.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet (e.g., for patch downloads) while preventing unsolicited inbound traffic from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer

Attach an internet gateway to the private subnets and configure route tables accordingly.

Answer

Establish a site-to-site VPN connection to an on-premises internet gateway.

Answer

Configure a VPC endpoint for the internet in the private subnets.

Question 13

A company operates a Transit Gateway in us-east-1. They have three VPC attachments and one Site-to-Site VPN attachment. The network team needs to capture detailed flow information for traffic traversing the Transit Gateway to analyze which attachments are communicating and whether traffic is being dropped due to blackhole routes. They have already enabled Transit Gateway Flow Logs to CloudWatch Logs. After reviewing the logs, they see records with a 'status' field of 'NODATA' for some flows. What does this status indicate?

Accepted Answer

No packets matching the flow were observed during the aggregation interval.. Transit Gateway Flow Logs capture information about IP traffic going to and from the Transit Gateway. The 'status' field can be 'OK', 'NODATA', or 'SKIPDATA'. NODATA is used when no packets are observed for a flow during the aggregation interval. This helps network engineers confirm whether traffic is actually traversing the Transit Gateway or if it is being routed elsewhere.

Answer

The flow was allowed but no data was transferred during the aggregation interval.

Answer

The flow log record was skipped because the Transit Gateway did not have sufficient permissions to publish to CloudWatch Logs.

Answer

The flow was observed but the packet was dropped due to a blackhole route in the Transit Gateway route table.

Question 14

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The connection is up, but the network team cannot reach resources in a VPC. The virtual interface is in the 'available' state, and BGP session is established. What should the team check next?

Accepted Answer

Check the VPC route tables for propagated routes. Since the Direct Connect physical link is up, the virtual interface is available, and the BGP session is established, the issue lies in the routing of traffic within AWS. The most likely cause is that the VPC route tables do not contain the necessary routes (either static or propagated from the Direct Connect virtual private gateway) to direct traffic back to the on-premises network. Checking the VPC route tables for propagated routes is the correct next step to ensure the on-premises CIDR is being advertised and accepted.

Answer

Check the on-premises firewall rules

Answer

Check the BGP authentication

Answer

Check the Direct Connect physical link status

Question 15

A company is migrating its on-premises data center to AWS. The network team needs to extend the on-premises network to the cloud and support IP multicast traffic between environments. Which AWS service or feature should be used?

Accepted Answer

AWS Transit Gateway with multicast support. AWS Transit Gateway with multicast support is the correct choice because it is the only AWS service that natively supports IP multicast traffic between VPCs and on-premises networks. It allows you to create multicast domains and associate subnets, enabling multicast sources and receivers to communicate across attached networks, including on-premises via AWS Direct Connect or Site-to-Site VPN.

Answer

AWS Direct Connect with a private virtual interface

Answer

Site-to-Site VPN connection

Answer

VPC peering connection

Question 16

A company has a VPC with a transit gateway (TGW) connected to multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises a specific prefix 10.0.0.0/16. A VPC attachment in the same region also advertises the same prefix. The TGW route table has the on-premises route as static and the VPC route as propagated. Which route will be used for traffic destined to 10.0.0.5?

Accepted Answer

The static route to on-premises. When a transit gateway (TGW) receives both a static route and a propagated route for the same prefix, the static route takes precedence regardless of the propagation source. This is because static routes have a higher administrative distance (lower priority number) than dynamically learned routes. Therefore, traffic destined to 10.0.0.5 will be forwarded via the Direct Connect attachment to the on-premises network.

Answer

The propagated route from VPC

Answer

Both routes will be used with ECMP

Answer

The route with the shortest AS_PATH

Question 17

A company is deploying a VPC with public and private subnets. The private subnets need outbound internet access for updates, but must not be directly reachable from the internet. Which AWS service should be used to achieve this?

Accepted Answer

NAT Gateway. A NAT Gateway enables instances in private subnets to initiate outbound IPv4 traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private source IP to the NAT Gateway's Elastic IP address, so responses return to the gateway, which then forwards them to the private instance. This meets the requirement of outbound-only internet access without direct internet reachability.

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 18

A company needs to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which policy element should be used in an IAM policy to deny access if MFA is not present?

Accepted Answer

Condition. The Condition element in an IAM policy allows you to specify conditions for when a policy is in effect. To deny access if MFA is not present, you use the `aws:MultiFactorAuthPresent` condition key with a Boolean value of `false`. This ensures that only requests authenticated with MFA are allowed, enforcing the security requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 19

A company has a VPC with multiple subnets and an internet gateway. The security team wants to detect and block malicious traffic patterns. Which AWS service should be used to provide intrusion detection and prevention?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed, stateful network firewall and intrusion detection/prevention service that can inspect traffic at the VPC level. It supports Suricata-compatible rules for deep packet inspection, allowing you to detect and block malicious patterns. It is the only AWS-native service in the list that provides true IDS/IPS capabilities.

Answer

Network ACLs

Answer

Security Groups

Answer

AWS WAF

Question 20

A company has a VPC with an application load balancer (ALB) in public subnets and web servers in private subnets. The web servers must be accessible only from the ALB. What is the most secure and efficient configuration?

Accepted Answer

Configure the web server security group to allow inbound HTTP from the ALB's security group.. Referencing the ALB's security group in the web server security group rule allows traffic only from the ALB, regardless of its IP addresses. This is the most secure and efficient configuration as it leverages AWS security group referencing, which automatically scales with the ALB's elastic network interfaces and avoids managing IP changes.

Answer

Configure the web server security group to allow inbound HTTP from 0.0.0.0/0.

Answer

Configure the web server security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Configure the web server security group to allow inbound HTTP from the VPC CIDR.