ANS-C01 Practice Exam 70 — 20 Questions

Question 1

An IAM policy is applied to a user. The user reports that they cannot run 'aws ec2 describe-instances --region eu-west-1' but can run the same command in us-east-1. What is the most likely reason?

Accepted Answer

The policy denies ec2:Describe* when the region is not us-east-1.. Option C is correct because the condition 'StringNotEquals' with 'aws:RequestedRegion' denies the action if the region is not us-east-1. Option A is wrong because the policy explicitly denies ec2:Describe* actions. Option B is wrong because the condition is StringNotEquals, not StringEquals. Option D is wrong because the policy does not specify resource-level conditions.

Answer

The policy only applies to resources in us-east-1, so other regions are implicitly denied.

Answer

The policy condition uses StringEquals, which only allows requests from us-east-1.

Answer

The policy allows ec2:Describe* in all regions, but the user lacks permissions in eu-west-1.

Question 2

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. They want to ensure that only traffic from specific on-premises IP ranges is allowed into the production VPC. Which approach should they use?

Accepted Answer

Deploy AWS Network Firewall in the production VPC and configure stateful rule groups to allow only the on-premises IP ranges.. AWS Transit Gateway supports route tables and can propagate routes from Direct Connect virtual interfaces. To filter traffic, you can use a network firewall appliance or AWS Network Firewall. However, the simplest approach is to use security groups and network ACLs within the VPC, but the question is about Transit Gateway. The best practice is to use AWS Network Firewall to inspect and filter traffic between attachments. Option C is correct. Option A (VPC peering) is not relevant. Option B (Direct Connect gateway) does not filter traffic. Option D (Transit Gateway route tables) does not filter by IP; they only determine routing.

Answer

Configure the Direct Connect gateway to only advertise specific prefixes to the Transit Gateway.

Answer

Use Transit Gateway route tables to blackhole traffic from other IP ranges.

Answer

Create a VPC peering connection between the on-premises network and the production VPC.

Question 3

A company is using AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. Option B is correct because AWS WAF has a managed rule group for SQL injection that can be added to the web ACL. Option A is incorrect because rate-based rules are for DDoS protection. Option C is incorrect because geo-match rules block based on geographic location. Option D is incorrect because IP set rules block based on source IP addresses.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 4

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block a list of known malicious IP addresses from accessing the application. Which service should they use to implement this protection?

Accepted Answer

AWS WAF with an IP set rule that blocks the malicious IPs. Option A is correct because AWS WAF with IP set rules can block malicious IPs. Option B is wrong because Shield Advanced provides DDoS protection, not IP blocking. Option C is wrong because Network ACLs are stateless and less efficient for this use case. Option D is wrong because Security Groups are stateful but not designed for IP blocking at the ALB level.

Answer

Network ACLs on the ALB subnet with deny rules

Answer

AWS Shield Advanced with automatic IP blocking

Answer

Security Groups for the ALB with deny rules

Question 5

A security engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option C is correct because a VPC Gateway Endpoint for S3 allows private connectivity. Option A is wrong because a NAT gateway would route traffic over the internet. Option B is wrong because an Internet Gateway would expose the instance. Option D is wrong because Direct Connect is for on-premises connectivity, not for EC2 to S3.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use AWS Direct Connect to connect to S3.

Answer

Deploy a NAT gateway in a public subnet and update the route table.

Question 6

Refer to the exhibit. An EC2 instance is associated with the IAM role shown. Which action can the EC2 instance perform?

Accepted Answer

Read objects from any S3 bucket.. Option A is correct. The policy allows s3:Get* and s3:List* actions, which include GetObject. Option B is wrong because PutObject is not allowed. Option C is wrong because DeleteObject is not allowed. Option D is wrong because no write actions are allowed.

Answer

Write objects to any S3 bucket.

Answer

Delete objects from any S3 bucket.

Answer

Upload objects to any S3 bucket.

Question 7

A company is designing a network security architecture for a multi-tier application. They need to ensure that the web tier can only communicate with the app tier on port 443, and the app tier can only communicate with the database tier on port 3306. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a security group for the web tier that allows outbound traffic to the app tier security group on port 443.. Options A and D are correct because security groups are stateful and can be used to control traffic between tiers by referencing the source security group. Option B is wrong because NACLs are stateless and require separate inbound/outbound rules. Option C is wrong because AWS Network Firewall is not needed for this simple traffic control. Option E is wrong because the requirement is to allow traffic on specific ports, not deny all.

Answer

Deploy an AWS Network Firewall to inspect inter-tier traffic.

Answer

Use network ACLs to statelessly filter traffic on the subnets.

Answer

Configure a VPC endpoint policy to deny all traffic between tiers.

Question 8

A company has deployed a web application on an EC2 instance that needs to access an S3 bucket and a DynamoDB table. The instance is in a private subnet. Which approach meets the security best practice of avoiding long-lived credentials on the instance?

Accepted Answer

Create an IAM role with policies granting access to S3 and DynamoDB, and attach the role to the EC2 instance profile.. The best practice is to attach an IAM role with the necessary permissions to the EC2 instance. The instance will automatically obtain temporary credentials via the instance metadata service. Option C is correct. Option A (IAM user credentials) is not recommended as they are long-lived. Option B (AWS Systems Manager Parameter Store) still requires credentials to access the parameters. Option D (security groups) does not grant access to S3 or DynamoDB.

Answer

Store IAM user access keys in the application configuration file.

Answer

Configure security group rules to allow outbound traffic to S3 and DynamoDB endpoints.

Answer

Use AWS Systems Manager Parameter Store to store credentials and retrieve them at runtime using the instance's IAM role.

Question 9

A company is designing a VPC with a public subnet for web servers and a private subnet for database servers. The web servers must be able to access the internet for software updates, but the database servers must not have direct internet access. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route to it in the private subnet's route table.. Option B is correct because a NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is incorrect because an internet gateway in the private subnet would allow direct inbound traffic. Option C is incorrect because a VPC endpoint is for accessing AWS services privately, not for general internet access. Option D is incorrect because a VPN connection does not provide internet access.

Answer

Use a VPC endpoint for Amazon S3 to provide internet access to the database servers.

Answer

Set up a VPN connection to an on-premises data center and route traffic through it.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet's route table.

Question 10

Which TWO of the following are valid ways to encrypt data in transit between an on-premises data center and an Amazon VPC? (Choose two.)

Accepted Answer

Use AWS Site-to-Site VPN.. Options A and C are correct. AWS Site-to-Site VPN creates an IPSec tunnel, encrypting all traffic. AWS Direct Connect can be combined with a VPN over the connection to encrypt traffic. Option B is incorrect because Direct Connect alone does not provide encryption. Option D is incorrect because VPC peering does not encrypt traffic. Option E is incorrect because internet gateway does not encrypt traffic.

Answer

Use AWS Direct Connect without any additional encryption.

Answer

Use VPC peering.

Answer

Use an internet gateway with a security group.

Question 11

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region and the peering connection is in the 'active' state. Security groups in both VPCs allow all traffic. However, instances in VPC A cannot reach instances in VPC B. What is the most likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes pointing to the peering connection. VPC peering requires route table entries in both VPCs to direct traffic to the peering connection. Option A is correct because missing routes are a common issue. Option B is wrong because the peering is active. Option C is wrong because security groups allow all. Option D is wrong because NACLs are not mentioned as blocking.

Answer

Security groups are blocking traffic between the VPCs

Answer

The VPC peering connection is in the 'pending-acceptance' state

Answer

Network ACLs are blocking traffic between the VPCs

Question 12

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team notices that the BGP session between the on-premises router and the AWS virtual private gateway (VGW) is flapping. The on-premises router is configured to advertise a specific prefix. Which configuration change is MOST likely to stabilize the BGP session?

Accepted Answer

Adjust BGP timers (keepalive and hold time) to match between the on-premises router and the VGW.. Option C is correct because BGP timers mismatch can cause flapping; adjusting them to match stabilizes the session. Option A is wrong because MD5 authentication is for security, not flapping. Option B is wrong because ASN prepending affects route selection, not stability. Option D is wrong because VGW does not support route-maps.

Answer

Add ASN prepending to the advertised prefix.

Answer

Enable BGP MD5 authentication on both sides.

Answer

Apply a route-map on the VGW to filter the prefix.

Question 13

A company uses AWS CloudFormation to deploy resources. The security team wants to ensure that no IAM user can modify the stack set if they are not authorized via a specific IAM policy. Which feature should be used?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Option D is correct because a service control policy (SCP) can be used to deny CloudFormation actions at the organization level. Option A is wrong because stack policies protect resources within a stack, not who can update the stack. Option B is wrong because IAM policies are account-specific and can be overridden by administrators. Option C is wrong because AWS Config does not prevent modifications.

Answer

AWS Config rule with remediation

Answer

CloudFormation stack policy

Answer

IAM permissions boundary

Question 14

A company uses AWS Organizations with SCPs to restrict access. The security team notices that users in the 'Developers' account can launch EC2 instances with public IP addresses, even though the SCP denies ec2:AssociateAddress. What is the most likely reason?

Accepted Answer

The users logged in as the root user of the account.. Option C is correct because SCPs do not affect the root user of a member account; root user actions are not restricted by SCPs. Option A is wrong because SCPs apply to all IAM users and roles, not just root. Option B is wrong because SCPs are not bypassed by IAM roles. Option D is wrong because SCPs apply to all accounts, but root user is exempt.

Answer

The SCP was applied to the wrong organizational unit.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The users assumed an IAM role that bypasses the SCP.

Question 15

A company has a VPC with multiple subnets and uses AWS Transit Gateway to connect to on-premises via AWS Direct Connect. They want to implement network segmentation so that certain VPCs can only communicate with specific on-premises networks. Which THREE components should they use? (Choose THREE.)

Accepted Answer

Direct Connect gateway. Options A, C, and D are correct. Transit Gateway route tables allow separate routing domains, Direct Connect gateways route traffic to on-premises, and gateway associations link the gateways. Option B is wrong because VPC peering is not needed with Transit Gateway. Option E is wrong because VPN is not required if using Direct Connect.

Answer

VPC peering connections

Answer

Site-to-Site VPN connection

Question 16

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can manage the encryption keys if the company wants to use server-side encryption with AWS KMS?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the service that manages encryption keys for server-side encryption (SSE-KMS). Option B is correct. AWS Certificate Manager (ACM) manages SSL/TLS certificates. AWS CloudHSM provides dedicated hardware security modules but is not required for SSE-KMS. AWS Secrets Manager manages secrets like database credentials.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Question 17

A company is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets across the organization are encrypted with AWS KMS. Which approach should be used to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) at the root level that denies S3 bucket creation unless encryption is configured.. Option C is correct because a service control policy (SCP) can be applied to the root organizational unit to deny creation or modification of S3 buckets without KMS encryption. Option A is incorrect because an SCP cannot be applied to individual S3 buckets; it applies to accounts. Option B is incorrect because IAM policies are account-specific and cannot enforce across the organization. Option D is incorrect because bucket policies are per-bucket and not centrally enforced.

Answer

Configure each S3 bucket with a bucket policy that denies access if encryption is not used.

Answer

Use AWS Config rules to detect unencrypted S3 buckets and automatically remediate them.

Answer

Create an IAM policy that denies creating S3 buckets without encryption and attach it to all users.

Question 18

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket for backups. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach a bucket policy allowing access from the VPC. A VPC Gateway Endpoint for S3 allows private access to S3 without internet gateway or NAT. Option B is correct. Option A is wrong because a NAT gateway incurs costs and uses internet. Option C is wrong because a VPC Interface Endpoint for S3 is more expensive and not required. Option D is wrong because a proxy server adds complexity and cost.

Answer

Set up a proxy server in the public subnet and configure the EC2 instance to use it

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Place the EC2 instance in a public subnet with a public IP and use a NAT gateway

Question 19

A company is designing a multi-account architecture using AWS Organizations. They want to centrally manage and enforce network security policies across all accounts. Which THREE services or features should they use together to achieve this? (Choose THREE.)

Accepted Answer

AWS Network Firewall. Options A, C, and D are correct. AWS Firewall Manager (A) centrally manages firewall rules. AWS Network Firewall (C) provides stateful inspection. Service Control Policies (D) enforce guardrails. Option B is wrong because AWS Config is for compliance monitoring, not enforcement. Option E is wrong because Security Groups are per-resource.

Answer

Security Groups

Answer

AWS Config

Question 20

A company needs to ensure that all API calls to AWS services are logged and monitored for suspicious activity. Additionally, any API call that creates a security group rule should trigger an immediate notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. Option C is correct because CloudTrail logs API calls, and CloudWatch Events (now Amazon EventBridge) can trigger notifications. Option A is wrong because AWS Config is for resource configuration, not API call monitoring. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because AWS Shield is for DDoS protection.

Answer

VPC Flow Logs and Amazon CloudWatch

Answer

AWS Config and Amazon SNS

Answer

AWS Shield and AWS WAF

ANS-C01 Practice Exam 70 — 20 Questions

Exhibit

ANS-C01 Practice Exam 70 — 20 Questions

Exhibit