ANS-C01 Practice Exam 56 — 20 Questions

Question 1

A network operations team manages a hub-and-spoke topology with an AWS Transit Gateway. They need to capture and analyze traffic that traverses the transit gateway for compliance auditing, without impacting production throughput. The traffic includes inter-VPC flows and traffic to on-premises networks. Which TWO approaches meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Transit Gateway Flow Logs with a custom format that includes the attachment ID and deliver them to Amazon S3.. Transit Gateway Flow Logs are generated by the transit gateway and capture traffic traversing it, including inter-VPC and on-premises flows. They can be sent to CloudWatch Logs or Amazon S3, and custom formats can include attachment IDs for precise mapping. VPC Traffic Mirroring and per-VPC flow logs do not cover transit gateway internal forwarding, and inserting a firewall appliance changes the topology and adds overhead.

Answer

Use VPC Traffic Mirroring on each spoke VPC attachment to copy all packets to a central analyzer.

Answer

Deploy a third-party firewall appliance in a shared services VPC and route all transit gateway traffic through it for inspection.

Answer

Enable VPC Flow Logs on every subnet in all spoke VPCs and aggregate them in a central account.

Question 2

A network engineer is using AWS Network Firewall to protect a VPC. The engineer notices that some traffic is being allowed that should be blocked according to the configured stateless rule group. The engineer wants to ensure that the firewall evaluates traffic correctly. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)

Accepted Answer

Check the rule group's rule order and ensure that the rules are evaluated in the correct sequence.. Troubleshooting unintended allowed traffic in AWS Network Firewall involves checking rule order and rule definitions. Stateless rules are evaluated in priority order; if a lower-priority allow rule is processed before a higher-priority block rule, traffic will be allowed. Also, incorrect match criteria in block rules can cause them to be skipped. Verifying these two aspects directly addresses the problem.

Answer

Enable VPC Flow Logs on the firewall's subnet to capture traffic that is being allowed.

Answer

Verify that the stateless rule group's default action is set to forward to the stateful rule group for further inspection.

Answer

Confirm that the firewall policy is associated with the correct VPC and subnets.

Question 3

A network engineer is using AWS Network Manager to monitor a global network that includes multiple Transit Gateways and VPCs. The engineer wants to visualize the network topology and identify any misconfigured routes. Which feature of AWS Network Manager provides a graphical representation of the network and allows the engineer to view route tables and attachments?

Accepted Answer

Network Manager's Topology View. AWS Network Manager's Topology View provides a graphical representation of the global network, showing Transit Gateways, VPCs, and their connections. It allows engineers to view route tables and attachments, making it ideal for identifying misconfigured routes. Other features like Route Analyzer, Event Log, and Performance Dashboard serve different purposes and do not offer the same comprehensive visualization.

Answer

Network Manager's Event Log

Answer

Network Manager's Performance Dashboard

Answer

Network Manager's Route Analyzer

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. A network engineer needs to monitor the traffic flow between VPCs attached to the transit gateway. The engineer wants to capture metadata about the traffic, such as source and destination IP addresses, ports, and protocol, without impacting performance. The engineer also needs to analyze the data using Amazon Athena. Which AWS service should the engineer use to meet these requirements?

Accepted Answer

Transit Gateway Flow Logs.. Transit Gateway Flow Logs are specifically designed to capture IP traffic metadata for traffic traversing a transit gateway. They can be published to Amazon S3, where they can be queried using Amazon Athena. This service provides the required fields without performance impact and is the correct tool for monitoring transit gateway traffic. Other options either do not capture the necessary data or are not suitable for transit gateway traffic.

Answer

VPC Traffic Mirroring on the transit gateway.

Answer

AWS CloudTrail logs for the transit gateway.

Answer

VPC Flow Logs on the transit gateway attachment.

Question 5

A security engineer needs to provide a forensic team with a complete record of all IP traffic entering and leaving a VPC, including traffic that is denied by security groups or network ACLs. The VPC has several subnets and an internet gateway. Which solution meets this requirement?

Accepted Answer

Enable VPC Flow Logs at the VPC level with a filter of ALL and deliver logs to Amazon S3.. VPC Flow Logs at the VPC level with filter ALL capture both accepted and rejected traffic for all network interfaces in the VPC. This includes traffic denied by security groups and network ACLs, which is essential for forensic analysis. Delivering logs to Amazon S3 provides a durable, cost-effective storage solution for later analysis.

Answer

Use AWS CloudTrail data events to log all network traffic to and from the VPC.

Answer

Enable VPC Flow Logs on each subnet with a filter of ACCEPT and deliver logs to Amazon CloudWatch Logs.

Answer

Configure AWS Network Firewall logging to capture all traffic and send logs to Amazon S3.

Question 6

A network engineer needs to verify that a newly created VPC peering connection is functioning correctly. The peering connection status is Active. The engineer wants to confirm that traffic can flow between an EC2 instance in VPC A and an EC2 instance in VPC B. Which action should the engineer take first?

Accepted Answer

Check that the route tables in both VPCs have routes pointing to the peering connection for the peer VPC CIDR.. For VPC peering, after the connection is Active, the most common oversight is missing routes in the VPC route tables. Both VPCs must have a route to the peer VPC's CIDR block that targets the peering connection. Only after routing is confirmed should you check security groups and network ACLs, which are evaluated later in the packet flow.

Answer

Confirm that the peering connection is in the same AWS Region as both VPCs.

Answer

Verify that the security groups on both instances allow traffic from the peer VPC CIDR.

Answer

Ensure that the network ACLs on the subnets are allowing traffic in both directions.

Question 7

A company needs to ensure that all Amazon S3 bucket policies in their AWS Organization do not allow public read access. They want to enforce this across all accounts, including new accounts, and prevent any user from modifying the policy to allow public access. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Enable S3 Block Public Access at the organization level using AWS Organizations and S3 Block Public Access settings.. S3 Block Public Access at the organization level is a centralized control that prevents any S3 bucket in any account from being made public, regardless of bucket policies or ACLs. It applies to all existing and new accounts, requiring minimal effort to set up and maintain.

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl and s3:PutBucketPolicy actions.

Answer

Use AWS Config rules to detect public S3 buckets and automatically remediate with a Lambda function that removes public access.

Answer

Use AWS Organizations service control policies (SCPs) to deny s3:PutBucketPolicy actions that include a public read ACL.

Question 8

A company runs a three-tier web application in a VPC. The security team wants to inspect all traffic entering and leaving the VPC for malicious activity. They decide to use AWS Network Firewall deployed in a dedicated subnet. After deployment, they notice that traffic between the public subnet and the private subnet is not being inspected. What is the most likely cause?

Accepted Answer

The route tables for the public and private subnets do not have routes that direct traffic to the Network Firewall endpoint.. AWS Network Firewall inspects traffic only when that traffic is routed through the firewall endpoint. The route tables of the subnets generating the traffic must contain routes that target the firewall endpoint. Without such routes, traffic flows directly between subnets, bypassing inspection. Therefore, the missing routes are the root cause.

Answer

The Network Firewall policy is not attached to the VPC.

Answer

The Network Firewall subnet is not associated with the VPC route tables for the public and private subnets.

Answer

The security groups on the Network Firewall endpoint are blocking traffic from the public subnet.

Question 9

A network engineer is using AWS Network Manager to monitor a global network of Transit Gateways across multiple regions. The engineer needs to visualize the network topology and monitor real-time performance metrics such as latency and packet loss between on-premises and AWS. Which TWO features of AWS Network Manager should the engineer use? (Choose two.)

Accepted Answer

Network Manager Infrastructure Performance metrics. The Network Manager topology view provides visualization of the global network, while Infrastructure Performance metrics provide real-time latency and packet loss data. Route Analyzer, Event Logs, and CloudWatch integration do not fulfill both requirements. Thus, the correct features are the topology view and Infrastructure Performance metrics.

Answer

Network Manager CloudWatch integration

Answer

Network Manager Route Analyzer

Answer

Network Manager Event Logs

Question 10

A company has a Transit Gateway with multiple VPC attachments. They want to centrally log all traffic that is accepted and rejected by the Transit Gateway to an S3 bucket for long-term analysis. The security team requires that the logs include the source and destination IP addresses, ports, protocol, and the action taken. Which solution should a network engineer implement?

Accepted Answer

Enable Transit Gateway Flow Logs and publish to S3.. Transit Gateway Flow Logs capture traffic at the TGW level, including accepted and rejected packets, with detailed 5-tuple information. They can be published to S3 for long-term retention. VPC Flow Logs, CloudTrail, and NLB traffic mirroring do not provide centralized TGW traffic logging. Thus, enabling TGW Flow Logs is the correct solution.

Answer

Configure a Network Load Balancer to mirror traffic to a logging instance.

Answer

Use AWS CloudTrail to log all API calls related to the Transit Gateway.

Answer

Enable VPC Flow Logs on each VPC attachment and publish to S3.

Question 11

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet with CIDR 10.0.1.0/24. The company wants to use AWS Network Firewall to inspect all traffic entering and leaving the VPC. They deploy the firewall endpoint in a dedicated firewall subnet with CIDR 10.0.2.0/24. After deployment, they notice that traffic to and from the internet is not being inspected. What is the most likely cause?

Accepted Answer

The route tables of the workload subnets must be updated to route traffic through the firewall endpoint.. For AWS Network Firewall to inspect traffic, the route tables of the subnets where the resources reside must point to the firewall endpoint. This ensures that all traffic from those subnets is sent to the firewall for inspection before continuing to its destination. The firewall subnet itself does not need special routing; it simply hosts the endpoint. Without updating the workload subnet route tables, traffic bypasses the firewall entirely.

Answer

The firewall subnet must have a route table that directs all traffic to the firewall endpoint.

Answer

The Network Firewall policy must have a rule group that allows all traffic.

Answer

The firewall endpoint must be deployed in the same subnet as the workload resources.

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network engineer needs to monitor traffic flow between VPCs and identify any dropped packets. The engineer has enabled Transit Gateway Flow Logs. Which field in the flow log record should the engineer examine to determine if traffic was dropped?

Accepted Answer

The 'action' field, which indicates ACCEPT or REJECT.. Transit Gateway Flow Logs capture information about IP traffic going through a transit gateway. The action field indicates whether the traffic was accepted or rejected. A REJECT action means the traffic was dropped, often due to a missing route or a blackhole route in the transit gateway route table. By analyzing this field, the engineer can identify dropped packets and troubleshoot routing issues. Other fields like packets, bytes, and log-status do not indicate whether traffic was dropped.

Answer

The 'packets' field, which shows the number of packets transferred.

Answer

The 'log-status' field, which indicates the logging status.

Answer

The 'bytes' field, which shows the number of bytes transferred.

Question 13

A healthcare company stores protected health information in an Amazon S3 bucket accessible only through a VPC endpoint. Compliance requires that all access to the bucket be logged with the identity of the requester and that the logs be immutable for 365 days. The security team enables AWS CloudTrail data events for the bucket and configures S3 server access logging. Which additional configuration is required to meet the immutability requirement?

Accepted Answer

Enable S3 Object Lock in compliance mode on the destination bucket for the CloudTrail and access log objects, with a retention period of 365 days.. Immutability for audit logs is achieved with S3 Object Lock, which enforces retention at the object level. Compliance mode prevents deletion by any principal, including the root user, for the specified period. Combining CloudTrail data events and S3 access logs with a locked destination bucket provides both requester identity and tamper-proof retention.

Answer

Enable versioning on the log bucket and configure a lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Use AWS CloudTrail Lake to store the events and set the event data store retention to 365 days.

Answer

Configure an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except the logging service.

Question 14

A network engineer is using AWS Network Manager to monitor a global network that includes multiple transit gateways and Direct Connect gateways. The engineer wants to visualize the network topology and monitor real-time performance metrics. Which TWO features of AWS Network Manager should the engineer use to achieve these goals? (Choose two.)

Accepted Answer

Network Manager topology view. AWS Network Manager provides a topology view to visualize your global network, and a performance dashboard to monitor real-time performance metrics such as latency and packet loss. These two features together meet the requirements of visualizing topology and monitoring performance.

Answer

Network Manager route analyzer

Answer

Network Manager CloudWatch integration

Answer

Network Manager event log

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. The security team wants to restrict outbound traffic from a subnet to only allow HTTP and HTTPS to the internet, while denying all other outbound traffic. They also want to allow return traffic for established connections. Which solution should they implement?

Accepted Answer

Create a network ACL on the subnet that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and allows inbound TCP ports 1024-65535 from 0.0.0.0/0.. Network ACLs are stateless and operate at the subnet level, making them suitable for restricting outbound traffic for an entire subnet. To allow only HTTP and HTTPS outbound, you must add outbound rules for TCP 80 and 443 to 0.0.0.0/0, and inbound rules for ephemeral ports (1024-65535) to allow return traffic. The default deny rule will block all other outbound traffic. This meets the requirement.

Answer

Create a security group that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and configure the subnet's route table to send all other traffic to a blackhole.

Answer

Create a network ACL on the subnet that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and allows inbound TCP ports 80 and 443 from 0.0.0.0/0.

Answer

Create a security group that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and attach it to the instances in the subnet.

Question 16

A security team needs to capture all DNS queries made by workloads in a VPC and forward the query logs to a central S3 bucket in a logging account for compliance retention. The VPC uses the default Amazon-provided DNS resolver at the .2 address of the VPC CIDR. Which configuration will capture the query logs without changing the resolver address used by the instances?

Accepted Answer

Create a Route 53 Resolver query logging configuration, associate it with the VPC, and specify the destination S3 bucket in the logging account.. Route 53 Resolver query logging is purpose-built for capturing DNS queries that reach the VPC Resolver, and it can deliver those logs directly to an S3 bucket in a centralized logging account. It requires no change to the resolver address that instances use, and it captures queries for both public and private names, making it the correct compliance-oriented choice.

Answer

Configure a private hosted zone for each domain and enable query logging on the hosted zone, then export the logs to S3.

Answer

Deploy a Route 53 Resolver outbound endpoint and configure a forwarding rule that sends all queries to an on-premises DNS server that writes logs to S3.

Answer

Enable VPC Flow Logs with a filter of UDP port 53 and deliver the logs to the central S3 bucket.

Question 17

A media company stores sensitive content in an Amazon S3 bucket that is accessed by applications running on EC2 instances in a VPC. The security team wants every S3 request to stay on the AWS network and never traverse the public internet, and they want to restrict bucket access so that only requests originating from a specific VPC endpoint are allowed. The VPC has an internet gateway and a NAT gateway, and the applications currently reach S3 over the public endpoint. Which combination of changes enforces this requirement?

Accepted Answer

Create a gateway VPC endpoint for S3, attach it to the route tables of the application subnets, and modify the bucket policy to allow access only when aws:SourceVpce equals the endpoint ID.. A gateway VPC endpoint for S3 adds a prefix list route in the subnet route table so S3-bound traffic never leaves the AWS network through the NAT or internet gateway. Restricting the bucket policy with the aws:SourceVpce condition ensures only requests that arrive through that endpoint are accepted, which satisfies both the private-path and the origin-restriction requirements. This is the standard private-access pattern for S3 from a VPC.

Answer

Create a gateway VPC endpoint for S3, add a route in the route table, and attach a security group to the endpoint that allows only the application instances.

Answer

Create an interface VPC endpoint for S3 in each application subnet, then add a bucket policy that allows only the elastic network interface IDs of the endpoint.

Answer

Create a gateway VPC endpoint for S3 and modify the bucket policy to deny requests whose aws:SourceIp is the NAT gateway elastic IP address.

Question 18

A media company runs a VPC with a CIDR of 10.0.0.0/16. The company's security policy requires that all outbound traffic to the internet be inspected by AWS Network Firewall, and that the firewall logs be retained for 90 days. The company has deployed a firewall endpoint in a dedicated subnet and updated the route tables to send 0.0.0.0/0 traffic through the firewall endpoint. After deployment, the security team notices that traffic to Amazon S3 within the same Region is not being inspected. What is the MOST likely cause of this behavior?

Accepted Answer

The route table for the subnet containing the EC2 instances does not have a route for the S3 prefix list pointing to the firewall endpoint.. AWS Network Firewall inspects traffic only if the route table directs that traffic to the firewall endpoint. For S3 traffic within the same Region, the destination is the S3 prefix list, not the internet gateway. If the route table lacks a route for the S3 prefix list pointing to the firewall endpoint, that traffic follows the default route (or a more specific route) and bypasses inspection. Adding a route for the S3 prefix list to the firewall endpoint ensures inspection.

Answer

The firewall policy is missing a rule that allows traffic to the S3 prefix list.

Answer

The S3 bucket policy is allowing traffic from the VPC CIDR, which bypasses the firewall.

Answer

The firewall endpoint is deployed in a subnet that does not have a route to the S3 prefix list.

Question 19

A company must ensure that all Amazon S3 bucket policies in its organization never grant public access, and that this guardrail applies to every existing and future account, including accounts created by new business units. The security team wants a single control that cannot be overridden by account administrators. Which solution meets these requirements?

Accepted Answer

Create an AWS Organizations service control policy that denies s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, and s3:DeletePublicAccessBlock unless the request comes from the security account.. Service control policies in AWS Organizations define the permission ceiling for member accounts and are enforced regardless of identity-based or resource-based policies inside those accounts. Denying the S3 APIs that can weaken public access protections, with an exception for the security account, prevents any account administrator from making a bucket public. Because SCPs inherit down the organization tree, they automatically cover accounts created in the future.

Answer

Use AWS Config managed rules to detect public S3 buckets and invoke an AWS Lambda function that remediates noncompliant buckets.

Answer

Attach an IAM permissions boundary to every IAM role in each account that denies s3:PutBucketPolicy.

Answer

Enable S3 Block Public Access at the bucket level in every account and require account owners to attest annually.

Question 20

A compliance officer requires that all API calls that modify VPC networking components, including CreateRoute, DeleteRoute, and ModifyVpcAttribute, be recorded with the identity of the caller and retained for seven years in a dedicated account. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail with a multi-Region trail delivering events to a central Amazon S3 bucket, plus S3 Object Lock for retention.. CloudTrail is the service that records AWS API activity with caller identity, and a multi-Region trail ensures coverage regardless of where the networking changes occur. Delivering the trail to an S3 bucket in the dedicated account centralizes the records, and S3 Object Lock in compliance mode prevents deletion or alteration for the required seven years, satisfying both the identity and retention requirements.

Answer

VPC Flow Logs published to Amazon CloudWatch Logs with a seven-year retention policy configured on the log group.

Answer

Amazon CloudWatch Logs with a subscription filter that forwards events to an Amazon S3 bucket in the dedicated account.

Answer

AWS Config with a configuration recorder and delivery channel to an Amazon S3 bucket, plus an AWS Config aggregator.