ANS-C01 Practice Exam 67 — 20 Questions

Question 1

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

Accepted Answer

Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket. Option A is correct because the Lambda function's execution role needs an IAM policy allowing s3:GetObject (or appropriate actions) on the bucket. The bucket policy must also grant access to the Lambda execution role. Option B is wrong because VPC endpoints do not grant access; IAM permissions are still needed. Option C is wrong because a VPC endpoint is not required for Lambda to access S3 in the same account if the bucket policy allows the role. Option D is wrong because the Lambda function does not need an internet gateway if it uses a VPC endpoint or if the bucket policy allows the role.

Answer

Remove the bucket policy that denies all principals

Answer

Attach an internet gateway to the VPC and a public IP to the Lambda function

Answer

Create a VPC endpoint for S3 and attach it to the Lambda function's VPC

Question 2

A company needs to securely connect an on-premises data center to AWS using multiple VPN tunnels. The security team requires that all traffic between the VPC and on-premises be encrypted and that the tunnels use a second authentication mechanism beyond pre-shared keys. Which solution meets these requirements?

Accepted Answer

Use AWS VPN CloudHub with multiple VPN connections and configure certificate-based authentication for each tunnel. Option B is correct because AWS VPN CloudHub uses multiple VPN connections with BGP routing and supports certificate-based authentication with mutual TLS for enhanced security. Option A is wrong because Direct Connect does not provide encryption by default; VPN over Direct Connect adds encryption but not a second authentication factor beyond PSK. Option C is wrong because Client VPN is for individual clients, not site-to-site. Option D is wrong because Transit Gateway with VPN attachments uses PSK by default; certificate-based authentication is not supported.

Answer

Use AWS Client VPN with mutual authentication

Answer

Use AWS Transit Gateway with VPN attachments and configure pre-shared keys

Answer

Use AWS Direct Connect with a public VIF and establish an IPsec VPN over the Direct Connect connection

Question 3

Which TWO features are provided by AWS Shield Advanced that are not available in AWS Shield Standard? (Choose 2)

Accepted Answer

DDoS cost protection. Option A is correct because Shield Advanced provides DDoS cost protection for scaling resources. Option D is correct because Shield Advanced includes 24/7 access to the DDoS Response Team. Option B is wrong because network-layer protection is available in Standard. Option C is wrong because basic logging is available without Shield. Option E is wrong because WAF is separate; Shield Advanced includes WAF at no extra cost but does not manage rules automatically.

Answer

Automatic web application firewall rule updates

Answer

Access to detailed DDoS logs

Answer

Network-layer DDoS protection

Question 4

A company has an AWS account with multiple VPCs. The security team wants to ensure that no VPC has an internet gateway attached. Which AWS service can be used to automatically detect and remediate non-compliant VPCs?

Accepted Answer

AWS Config with a managed rule to detect internet gateways and an automatic remediation action to detach them.. AWS Config rules can evaluate compliance and trigger remediation. Option A is correct. Option B is wrong because GuardDuty is for threat detection, not configuration compliance. Option C is wrong because SCPs prevent actions but do not detect existing resources. Option D is wrong because CloudTrail is for auditing API calls, not real-time compliance.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Service control policies (SCPs)

Question 5

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic. Option A is wrong because an Internet Gateway allows inbound traffic. Option B is wrong because a VPC Peering connection does not provide internet access. Option D is wrong because a VPN connection does not provide internet access.

Answer

VPC Peering

Answer

Internet Gateway

Answer

VPN Connection

Question 6

A company wants to monitor and log all network traffic within a VPC for security analysis. Which THREE services can be used to achieve this?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information. AWS Network Firewall provides stateful inspection and logs. AWS Traffic Mirroring replicates network traffic for analysis. Option D is wrong because CloudWatch is for monitoring, not capturing traffic. Option E is wrong because S3 is storage.

Answer

Amazon CloudWatch

Answer

Amazon S3

Question 7

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs is encrypted. What should they do?

Accepted Answer

Use a third-party VPN appliance in each VPC to create an IPsec tunnel between them. Option D is correct because VPC peering does not encrypt traffic; an overlay of IPsec or using a third-party appliance is needed. Option A is wrong because VPC peering is not encrypted. Option B is wrong because Direct Connect is for on-prem. Option C is wrong because VPN is for on-prem.

Answer

Establish a VPN connection between the VPCs using virtual private gateways

Answer

Enable encryption on the VPC peering connection

Answer

Use AWS Direct Connect to connect the VPCs

Question 8

A security engineer is designing a network ACL for a public-facing web application in a VPC. The application uses an Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an RDS database in a private subnet. The engineer needs to allow HTTPS traffic from the internet to the ALB, and allow the ALB to forward traffic to the web servers on port 8080. The web servers need to query the database on port 3306. Which network ACL configuration should the engineer implement for the private subnet containing the web servers?

Accepted Answer

Inbound: allow ALB subnet CIDR on port 8080 and ephemeral ports; Outbound: allow database subnet CIDR on port 3306. Option C is correct because inbound allows ALB traffic on port 8080 and ephemeral ports for responses, outbound allows database traffic. Option A is wrong because web servers do not need inbound on port 443. Option B is wrong because inbound port 3306 is not needed. Option D is wrong because inbound should not allow all traffic.

Answer

Inbound: allow 0.0.0.0/0 on port 3306; Outbound: allow 0.0.0.0/0 on port 8080

Answer

Inbound: allow 0.0.0.0/0 on port 8080; Outbound: allow 0.0.0.0/0 on all ports

Answer

Inbound: allow 0.0.0.0/0 on port 443; Outbound: allow 0.0.0.0/0 on port 3306

Question 9

A company is designing a network security architecture for a multi-account environment using AWS Organizations. They need to centrally manage and enforce security policies across all accounts. Which THREE services should they consider?

Accepted Answer

AWS Firewall Manager. Option A, B, and C are correct: AWS Firewall Manager centrally manages firewall rules across accounts; AWS Security Hub provides a unified view of security alerts; AWS CloudTrail logs API calls across accounts. Option D is wrong because Amazon Route 53 Resolver DNS Firewall is not a central policy enforcement service. Option E is wrong because AWS Direct Connect is for connectivity, not policy enforcement.

Answer

AWS Direct Connect

Answer

Amazon Route 53 Resolver DNS Firewall

Question 10

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?

Accepted Answer

Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC. Option D is correct because with overlapping CIDRs, VPC Peering cannot route traffic correctly due to identical CIDR blocks. A Transit Gateway with Network Manager can be used with a VPN connection or Direct Connect to connect the VPCs, but the question asks for a solution to allow communication without changing CIDRs. However, the only way to allow communication with overlapping CIDRs is to use PrivateLink (VPC endpoint services) where one VPC hosts the service and the other VPC accesses it via an endpoint, avoiding routing conflicts. Option A is wrong because security groups do not solve routing issues. Option B is wrong because NAT gateways do not resolve overlapping CIDR routing. Option C is wrong because a Transit Gateway does not resolve overlapping CIDRs without additional configuration like NAT.

Answer

Configure a NAT gateway in each VPC

Answer

Use security group references to allow traffic between the instances

Answer

Create a Transit Gateway and attach both VPCs

Question 11

A security engineer is configuring AWS CloudTrail to log all management events across all regions. The logs must be stored in an S3 bucket that is encrypted with an AWS KMS key. Which bucket policy element is required to allow CloudTrail to write logs?

Accepted Answer

kms:Decrypt. Option B is correct because CloudTrail requires the kms:Decrypt permission for the bucket key to verify encrypted objects. Option A is wrong because CloudTrail does not need kms:CreateKey. Option C is wrong because kms:Encrypt is needed for the object, but the bucket policy must include Decrypt for the key. Option D is wrong because kms:GenerateDataKey is not used by CloudTrail.

Answer

kms:Encrypt

Answer

kms:GenerateDataKey

Answer

kms:CreateKey

Question 12

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all Amazon S3 buckets in the organization are encrypted at rest. Which policy should be attached to the root organizational unit to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. A service control policy (SCP) attached to the root OU can deny creation of S3 buckets without default encryption, enforcing encryption across all accounts. Option A is correct because SCPs allow you to centrally control permissions. Option B is wrong because IAM roles are per-account. Option C is wrong because bucket policies are per-bucket, not organization-wide. Option D is wrong because AWS Config rules can detect but not enforce in real time.

Answer

Configure AWS Config rules to mark non-compliant buckets and trigger a Lambda function to add encryption.

Answer

Create an IAM role in each account that requires encryption for any S3 operation.

Answer

Use an S3 bucket policy on every existing and future bucket to deny unencrypted uploads.

Question 13

A company has a VPC with public and private subnets. The security team wants to inspect all traffic leaving the VPC to the internet for malicious activity. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

VPC Flow Logs. A NAT gateway routes outbound traffic, VPC Flow Logs capture metadata, and Amazon GuardDuty analyzes flow logs for threats. Options A, C, and D are correct. Option B is wrong because Internet Gateway is for inbound. Option E is wrong because Network Firewall can inspect, but the combination of NAT, Flow Logs, and GuardDuty is a common pattern for outbound inspection.

Answer

Internet gateway

Answer

AWS Network Firewall

Question 14

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its backend targets. Which AWS service should be used to terminate TLS at the ALB and re-encrypt traffic to the targets?

Accepted Answer

Application Load Balancer with HTTPS listeners. An ALB can terminate TLS and optionally re-encrypt traffic to targets using HTTPS. Option A is wrong because AWS Certificate Manager provides certificates, not encryption. Option B is wrong because AWS WAF is for web application firewall. Option D is wrong because AWS Shield is for DDoS protection.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Answer

AWS WAF

Question 15

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which SCP should be applied to the root OU?

Accepted Answer

Deny s3:PutBucketEncryption unless encryption settings include AES256 or aws:kms. Option A is correct because an SCP that denies the PutBucketEncryption action unless the bucket has encryption settings matching the desired configuration enforces encryption. Option B is wrong because SCPs cannot be applied to individual resources. Option C is wrong because SCPs cannot modify resources. Option D is wrong because SCPs are not IAM policies.

Answer

Create an IAM policy that allows s3:PutBucketEncryption only with specific conditions

Answer

Attach an IAM policy to each S3 bucket requiring encryption

Answer

Use AWS Config rules to auto-enable encryption on existing buckets

Question 16

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose 3)

Accepted Answer

A VPN tunnel between the customer gateway and the virtual private gateway. Options A, C, and D are correct: virtual private gateway (or transit gateway), customer gateway device, and VPN tunnel. Option B is wrong because Direct Connect is separate. Option E is wrong because VPC endpoint is for AWS services.

Answer

A VPC endpoint for the VPN service

Answer

An AWS Direct Connect dedicated line

Question 17

A company wants to audit all network traffic to and from an EC2 instance for compliance. The security team needs to capture full packet contents, including headers and payload, and store them in Amazon S3 for analysis. Which AWS service should they use?

Accepted Answer

Traffic Mirroring. Option B is correct because VPC Flow Logs capture metadata, not full packets. Option A is wrong because CloudWatch Logs can capture logs but not packets. Option C is correct because Traffic Mirroring captures full packets. Option D is wrong because AWS Config records configuration changes, not traffic.

Answer

Amazon CloudWatch Logs with the EC2 agent

Answer

AWS Config

Answer

VPC Flow Logs

Question 18

A company has a hybrid network with an AWS Direct Connect connection to a VPC. They also have a site-to-site VPN connection as a backup. The VPC routing tables are configured with a route to the on-premises CIDR via the virtual private gateway. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect connection even when it is healthy. What is the most likely cause?

Accepted Answer

The VPC route table has a more specific route pointing to the VPN connection. Option A is correct because when both Direct Connect and VPN are configured, the VPC route table typically has a single route to the on-premises CIDR via the virtual private gateway. Without more specific routing, the VPN BGP route may be preferred depending on route propagation and prefix matching. Option B is wrong because the VPN connection being down would not cause traffic to avoid Direct Connect. Option C is wrong because the Direct Connect virtual interface must be in the 'Available' state to pass traffic. Option D is wrong because the AWS Site-to-Site VPN connection uses a virtual private gateway or transit gateway, not a Customer Gateway as the target.

Answer

The VPN connection is down

Answer

The VPN connection is attached to a Customer Gateway

Answer

The Direct Connect virtual interface is in the 'Down' state

Question 19

A company is using AWS Organizations and wants to centrally manage and enforce the use of VPC endpoints for S3 across all accounts. Which THREE services/tools can be combined to achieve this?

Accepted Answer

AWS Config rules. Option A (AWS Service Control Policy) can enforce that VPC endpoint creation is allowed or denied. Option C (AWS CloudFormation StackSets) can deploy VPC endpoints across multiple accounts. Option E (AWS Config rules) can detect non-compliant resources. Option B is wrong because VPC Flow Logs do not enforce compliance. Option D is wrong because AWS Transit Gateway is for network connectivity, not policy enforcement.

Answer

VPC Flow Logs

Answer

AWS Transit Gateway

Question 20

Which TWO statements are correct regarding the use of AWS Network Firewall? (Choose 2)

Accepted Answer

It supports stateful inspection using Suricata-compatible rules. Option B is correct because Network Firewall supports stateful inspection with Suricata rules. Option C is correct because it can be deployed in a centralized inspection VPC with Transit Gateway. Option A is wrong because it is deployed in a VPC, not as a separate service. Option D is wrong because it cannot be used without a VPC. Option E is wrong because it does not provide SSL/TLS decryption natively.

Answer

It can be used to inspect traffic between on-premises and AWS without a VPC

Answer

It provides automatic SSL/TLS decryption

Answer

It is a managed service that can be deployed outside of a VPC