ANS-C01 Practice Exam 69 — 20 Questions

Question 1

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. Users in a different VPC with IP range 10.0.0.0/16 are able to access objects, but users in a different VPC with IP range 10.1.0.0/16 cannot. What is the most likely cause?

Accepted Answer

The users are accessing the bucket through a NAT Gateway, which changes the source IP. The condition 'aws:SourceIp' checks the source IP address. If the users in 10.1.0.0/16 are accessing via a NAT, the source IP will be the NAT's public IP, not the private IP, and will not match the condition. Option A is wrong because the policy allows all principals. Option B is wrong because the resource is correct. Option C is wrong because the action is correct.

Answer

The bucket policy uses the wrong condition key

Answer

The bucket policy specifies the wrong resource ARN

Answer

The bucket policy does not specify a principal

Question 2

A security engineer is troubleshooting connectivity issues. An EC2 instance cannot access the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in a public subnet with an Elastic IP. The security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The network ACL in the public subnet is blocking inbound traffic to the NAT gateway. Option A is correct because the network ACL in the public subnet must allow inbound traffic from the internet to the NAT gateway's Elastic IP. Option B is wrong because the route table in the private subnet is correct. Option C is wrong because the NAT gateway's security group is not a thing; it uses security groups for instances. Option D is wrong because the internet gateway is required and assumed attached.

Answer

The NAT gateway does not have a security group allowing outbound traffic

Answer

The internet gateway is not attached to the VPC

Answer

The route table in the private subnet has no route to the NAT gateway

Question 3

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3. Which control mechanism should they use?

Accepted Answer

Create a service control policy (SCP) that denies PutBucketEncryption if the encryption is not SSE-S3.. Option A is correct because SCPs can deny actions that do not comply with encryption requirements. Option B is wrong because IAM policies are account-level and cannot enforce across all accounts. Option C is wrong because bucket policies are per-bucket. Option D is wrong because CloudTrail is logging, not enforcement.

Answer

Assign an IAM policy to all users that requires SSE-S3.

Answer

Configure a bucket policy on each bucket to deny writes without SSE-S3.

Answer

Use AWS CloudTrail to monitor and alert on non-compliant bucket creations.

Question 4

A company wants to restrict access to an S3 bucket so that only objects with server-side encryption using AWS KMS (SSE-KMS) can be uploaded. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. Option B is correct because the s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce a specific KMS key ID. Option A is wrong because s3:x-amz-server-side-encryption checks for AES256 or aws:kms but does not enforce a specific key. Option C is wrong because kms:ViaService is a KMS condition, not an S3 condition. Option D is wrong because aws:SourceVpce restricts VPC endpoint, not encryption.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

aws:SourceVpce

Question 5

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Accepted Answer

AWS Firewall Manager. Options A, B, and C are correct. AWS Shield Advanced provides DDoS protection, AWS WAF filters web traffic, and AWS Firewall Manager centrally manages rules. Option D is wrong because VPC Flow Logs only log traffic. Option E is wrong because AWS Config tracks configuration.

Answer

AWS Config

Answer

VPC Flow Logs

Question 6

A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?

Accepted Answer

Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.. Option B is correct because creating an IP set in WAF and adding a rule to allow traffic from that IP set with higher priority than blocking rules will whitelist partner IPs. Option A is wrong because Shield Advanced does not have IP whitelisting; it's for DDoS protection. Option C is wrong because Network ACLs operate at the subnet level, not at the application layer. Option D is wrong because removing blocking rules entirely would weaken security.

Answer

Add the partner IPs to a Network ACL allow rule in the VPC.

Answer

Remove the blocking WAF rules and rely on Shield Advanced only.

Answer

Add the partner IPs to an AWS Shield Advanced IP whitelist.

Question 7

A company uses AWS Organizations with multiple accounts and wants to centrally manage VPC security group rules. They need to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which service should they use to automatically detect and remediate noncompliant security groups?

Accepted Answer

AWS Config. AWS Config with managed rules like restricted-ssh can detect noncompliant security groups, and AWS Config remediation actions can automatically remediate them. AWS Firewall Manager can also centrally manage security group rules across accounts, but it is more about enforcement and policy management. Option A is correct because AWS Config is the primary service for compliance monitoring and remediation. Option B (AWS Firewall Manager) is also a valid service but is more for policy-based management across accounts; however, the question asks for detection and automatic remediation, which AWS Config does directly. Actually, AWS Firewall Manager can also enforce security group rules, but AWS Config is the correct answer for detection and remediation. Let me re-evaluate: AWS Config can detect and remediate via SSM Automation. Option A is correct. Option C (AWS CloudTrail) is for auditing API calls, not for enforcement. Option D (Amazon GuardDuty) is for threat detection, not security group compliance.

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Answer

AWS CloudTrail

Question 8

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which THREE services should they combine to protect against common web attacks and network threats?

Accepted Answer

Amazon GuardDuty. A defense-in-depth strategy for web applications includes AWS WAF to protect against web exploits, AWS Shield Advanced for DDoS protection, and Amazon GuardDuty for threat detection. Option A, C, and E are correct. Option B (AWS Certificate Manager) is for SSL/TLS certificates, not security. Option D (AWS Direct Connect) is for dedicated network connectivity, not security.

Answer

AWS Direct Connect

Answer

AWS Certificate Manager (ACM)

Question 9

Refer to the exhibit. A network engineer examines the network ACL for a subnet. Which statement best describes the effect of this network ACL?

Accepted Answer

Inbound TCP traffic is allowed, but all outbound traffic is denied. The inbound rule allows TCP traffic (protocol 6) from all sources, but the default deny rule blocks all other inbound traffic. Outbound traffic is all denied. The explicit allow rule for inbound TCP takes precedence over the default deny. Option A is wrong because it allows TCP inbound. Option B is wrong because it allows TCP inbound. Option C is wrong because outbound is denied.

Answer

Both inbound and outbound TCP traffic are allowed

Answer

All inbound traffic is allowed

Answer

All outbound traffic is allowed

Question 10

A company wants to use AWS Certificate Manager (ACM) to provide a TLS certificate for a website hosted on an ALB. The domain is example.com, and the certificate must be renewed automatically. Which type of certificate should be requested?

Accepted Answer

A public certificate issued by ACM with DNS validation. Option B is correct because ACM automatically renews public certificates if DNS validation is used. Option A is wrong because private certificates are not for public websites. Option C is wrong because imported certificates must be manually renewed. Option D is wrong because self-signed certificates are not trusted by browsers.

Answer

A private certificate issued by ACM Private CA

Answer

A self-signed certificate generated with OpenSSL

Answer

A certificate imported into ACM from a third-party CA

Question 11

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized security appliance running in a security VPC. Which configuration should be used?

Accepted Answer

Attach the VPCs to the Transit Gateway and configure route tables to send inter-VPC traffic to the security VPC via a blackhole route.. Option A is correct because Transit Gateway route tables with route propagation and blackhole routes enable inspection. Option B is wrong because VPC peering is not centralized. Option C is wrong because NAT gateways are for outbound only. Option D is wrong because Network ACLs are stateless and not designed for traffic inspection routing.

Answer

Configure network ACLs in each VPC to deny traffic directly between VPCs.

Answer

Create VPC peering connections between each VPC and the security VPC, then update route tables.

Answer

Use NAT gateways in each VPC to route traffic through the security VPC.

Question 12

A security engineer is designing a network firewall solution for a VPC with multiple subnets. The solution must inspect traffic between instances in the same VPC, including traffic within the same subnet. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. Option A is correct because AWS Network Firewall can inspect traffic between subnets and within a subnet when deployed in a VPC. Option B is wrong because AWS WAF is for web application layer 7 inspection, not for general network traffic. Option C is wrong because Security Groups are stateless and cannot perform deep packet inspection. Option D is wrong because VPC Flow Logs only capture metadata, not inspect packets.

Answer

Security Groups

Answer

VPC Flow Logs

Answer

AWS WAF

Question 13

Which TWO are valid methods to encrypt data at rest in Amazon S3? (Choose TWO.)

Accepted Answer

SSE-S3. Options B and C are correct. SSE-S3 and SSE-KMS are two server-side encryption options. Option A is wrong because SSL/TLS is for data in transit. Option D is wrong because Client-Side Encryption is not server-side. Option E is wrong because SSE-C is also valid, but the question asks for TWO, and SSE-S3 and SSE-KMS are the most common.

Answer

SSE-C

Answer

Client-Side Encryption

Answer

SSL/TLS

Question 14

A company wants to audit all changes to security groups in their AWS account. Which AWS service should they use to track API calls that modify security groups?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records API calls, including those that modify security groups. Option B is wrong because CloudWatch Logs can store logs but not capture API calls directly. Option C is wrong because AWS Config tracks resource configuration changes but not API calls. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 15

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must only accept traffic from known corporate IP addresses, but the company also needs to allow healthy traffic from AWS health checkers. Which architecture meets these requirements securely?

Accepted Answer

Configure the Application Load Balancer's security group to allow inbound from corporate IPs, and the EC2 instances' security group to allow inbound from the ALB's security group.. The correct approach is to use security groups. The ALB security group should allow inbound from corporate IPs, and the EC2 security group should allow inbound only from the ALB security group. AWS health checkers come from the ALB's private IPs, so they are covered. Option B is correct. Option A (NACL) is incorrect because NACLs are stateless and would require complex rules. Option C (WAF) can filter by IP but also needs to allow health checks, and it adds complexity. Option D (dedicated ALB for health checks) is overkill and unnecessary.

Answer

Create two target groups: one for corporate traffic and one for health check traffic, each with different security groups.

Answer

Use AWS WAF on the ALB to create an IP set containing corporate IPs, and allow all traffic from ALB to instances.

Answer

Use a network ACL on the VPC subnet to allow inbound traffic from corporate IPs and AWS health checker IP ranges.

Question 16

A company needs to encrypt data in transit between an Application Load Balancer and EC2 instances. Which TWO actions should they take?

Accepted Answer

Upload a certificate to AWS Certificate Manager (ACM).. To encrypt traffic between ALB and EC2 instances, you need to upload a certificate to AWS Certificate Manager (ACM) and configure the ALB listener to use HTTPS for the backend. Option B and D are correct. Option A (TCP listener) does not support encryption. Option C (self-signed certificate) is not recommended for production. Option E (CloudFront) is a CDN, not required for backend encryption.

Answer

Create a TCP listener on the ALB.

Answer

Place Amazon CloudFront in front of the ALB.

Answer

Use a self-signed certificate on the EC2 instances.

Question 17

A security group is configured as shown. An EC2 instance in the same VPC with IP 10.0.1.50 can connect to the instance on port 443. An on-premises client with IP 203.0.113.5 cannot connect. What is the most likely reason?

Accepted Answer

The security group only allows traffic from the 10.0.0.0/16 CIDR. Option D is correct because the security group only allows traffic from the 10.0.0.0/16 CIDR, which is the VPC range. On-premises traffic comes from outside that range. Option A is wrong because the protocol is correct. Option B is wrong because there is no explicit deny, only implicit deny. Option C is wrong because security groups do not have outbound rules shown, but outbound is allow all by default.

Answer

The security group's outbound rules block return traffic

Answer

The protocol is incorrect; HTTPS uses UDP

Answer

The security group has a deny rule for the on-premises IP

Question 18

A network engineer is troubleshooting connectivity issues between an EC2 instance and an RDS database in the same VPC. The EC2 instance can connect to the database, but the connection is slow. Which TWO actions should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.. Options A and B are correct. Checking security group rules (A) ensures proper allow rules. Reviewing VPC Flow Logs (B) can reveal dropped packets or latency. Option C is wrong because NACLs are stateless and may drop return traffic. Option D is wrong because the default route is not relevant to internal traffic. Option E is wrong because route propagation is for VPN/Direct Connect.

Answer

Verify the route table for the database subnet to ensure there is a default route to the internet.

Answer

Check the network ACL for the database subnet to ensure it is stateful.

Answer

Check the route propagation settings on the VPC.

Question 19

An application running on EC2 instances needs to access a DynamoDB table. The security team requires that traffic does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for DynamoDB.. Option B is correct because a VPC Gateway Endpoint for DynamoDB provides private access. Option A is wrong because a NAT gateway routes to the internet. Option C is wrong because an Internet Gateway provides internet access. Option D is wrong because a VPC Interface Endpoint is for services like API Gateway, but DynamoDB uses Gateway Endpoint.

Answer

Create a VPC Interface Endpoint for DynamoDB.

Answer

Attach an Internet Gateway to the VPC.

Answer

Deploy a NAT gateway and update the route table.

Question 20

A company is designing a network security architecture for a multi-account AWS environment. They need to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which AWS service should they use to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. Option B is correct because AWS Transit Gateway with a central inspection VPC allows routing traffic through a firewall appliance. Option A is wrong because VPC Peering does not support transitive routing. Option C is wrong because Direct Connect is for on-premises connectivity. Option D is wrong because VPC Endpoints are for private access to AWS services, not inter-VPC traffic.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPC Endpoints

ANS-C01 Practice Exam 69 — 20 Questions

Exhibit

ANS-C01 Practice Exam 69 — 20 Questions

Exhibit