ANS-C01 Mock Exam 71 — 25 Questions

Question 1

A security engineer is troubleshooting connectivity between an EC2 instance in a private subnet and an S3 bucket. The instance has a VPC gateway endpoint for S3, and the route table has a route to the endpoint. The security group for the instance allows all outbound traffic. However, the instance cannot access the S3 bucket. What is the most likely cause?

Accepted Answer

The security group outbound rule does not allow traffic to the S3 prefix list.. Option A is correct because VPC gateway endpoints use prefix lists, and the security group outbound rule must allow traffic to the S3 prefix list ID. Option B is wrong because the instance is in a private subnet; internet traffic would go through NAT, but S3 access should use the gateway endpoint. Option C is wrong because S3 buckets are accessed via the endpoint, not via the internet. Option D is wrong because the route is present, but security group may still block.

Answer

The VPC endpoint is not associated with the route table.

Answer

The route table does not have a route to a NAT gateway.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Question 2

A network engineer is troubleshooting connectivity from an EC2 instance in subnet-12345678 to a server on the internet. The instance has a public IP and a security group allowing all outbound traffic. However, traffic fails. Based on the exhibit, what is the issue?

Accepted Answer

The inbound rule only allows TCP traffic, which blocks return traffic for other protocols.. Option A is correct because the inbound rule (egress=false) only allows TCP (protocol 6) on port unspecified (all ports), but the outbound rule allows all traffic. However, the inbound rule only allows TCP, so return traffic for non-TCP protocols (like ICMP) is blocked. But the question says connectivity fails, likely because the instance initiates outbound traffic (e.g., HTTP), which is TCP, so that should work. Actually, the issue is that the outbound rule allows all traffic, but the inbound rule only allows TCP, so return traffic for non-TCP (like UDP or ICMP) is blocked. But typical HTTP uses TCP, so maybe the issue is something else. Let's re-evaluate: The outbound rule allows all traffic (protocol -1), but the inbound rule only allows TCP. For outbound connections, the return traffic is inbound, so if the outbound connection is TCP, the return TCP packets are allowed by the inbound rule. However, if the outbound traffic is something else like ICMP (ping), the return ICMP is blocked. The question does not specify the protocol. Option A is correct because the inbound rule only allows TCP, blocking other protocols. Option B is wrong because the outbound rule allows all traffic. Option C is wrong because the security group allows outbound. Option D is wrong because the inbound rule does not restrict TCP on ephemeral ports; it allows TCP from 0.0.0.0/0.

Answer

The inbound rule blocks TCP traffic on ephemeral ports.

Answer

The outbound rule blocks all traffic.

Answer

The security group does not allow outbound traffic.

Question 3

A company wants to audit all network traffic to and from EC2 instances for security analysis. Which AWS service should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC. Option D is correct. AWS CloudTrail records API calls, not network traffic. AWS Config records resource configuration changes. Amazon GuardDuty analyzes logs and flows for threats, but it does not capture the raw traffic itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 4

A network engineer is troubleshooting connectivity issues between an on-premises network and an Amazon VPC over an AWS Direct Connect connection. The on-premises network uses BGP to advertise routes to the VPC. The VPC is associated with a virtual private gateway (VGW). The on-premises network can reach resources in the VPC, but VPC resources cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.. Option C is correct because if the VPC's route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR, traffic from the VPC will not be sent over the Direct Connect. Option A is incorrect because BGP is used for route exchange; if on-premises can reach VPC, BGP is working. Option B is incorrect because security groups are stateful and allow return traffic. Option D is incorrect because the virtual private gateway needs to propagate routes to VPC route tables.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The BGP session is not established.

Answer

The security group associated with the VPC resources is blocking inbound traffic from on-premises.

Question 5

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which policy type should be used?

Accepted Answer

Attach an S3 bucket policy with a condition for aws:SourceVpc. S3 bucket policies support condition keys like aws:SourceVpc to restrict access to a specific VPC. Option C is correct because a bucket policy with a VPC condition is the direct method. Option A is wrong because VPC endpoint policies control what actions can be performed via the endpoint, but they do not replace the bucket policy. Option B is wrong because S3 access points can have policies but are not required. Option D is wrong because network ACLs control traffic at the subnet level, not at the S3 layer.

Answer

Configure a VPC endpoint policy

Answer

Configure a network ACL to block all traffic except from the VPC CIDR

Answer

Use an S3 access point with a network origin condition

Question 6

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team wants to implement defense in depth. Which three layers of security should be configured?

Accepted Answer

Security groups. Security groups act as virtual firewalls at the instance level. Network ACLs provide stateless filtering at the subnet level. AWS WAF protects web applications at the application layer. Option A, C, and D are correct. Option B is wrong because IAM is identity and access management, not network security. Option E is wrong because VPC Flow Logs are for monitoring, not blocking traffic.

Answer

AWS Identity and Access Management (IAM) policies

Answer

VPC Flow Logs

Question 7

A security engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. The engineer wants to capture full packets and store them for later analysis. Which TWO AWS services can be used together to accomplish this? (Choose TWO.)

Accepted Answer

Amazon S3. Options A and C are correct. Traffic Mirroring (A) captures full packets and sends them to a target. Amazon S3 (C) can store the captured traffic. Option B is wrong because VPC Flow Logs capture metadata only. Option D is wrong because CloudWatch Logs is not designed for packet storage. Option E is wrong because AWS Config does not capture traffic.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 8

Which TWO actions should be taken to secure a VPC that hosts a web application? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for S3 to allow private access.. Options A and D are correct. Using Security Groups allows instance-level firewall rules, and using a VPC Gateway Endpoint for S3 allows private access to S3. Option B is wrong because allowing all ICMP is not secure. Option C is wrong because the default route should point to a NAT gateway or internet gateway, but not a virtual private gateway unless for VPN. Option E is wrong because allowing all outbound traffic is not a best practice.

Answer

Allow all ICMP traffic from the internet to the VPC.

Answer

Set the default route (0.0.0.0/0) to a virtual private gateway.

Answer

Allow all outbound traffic from the application instances.

Question 9

A company has a requirement to encrypt all data in transit between EC2 instances and an RDS database. The database is in a private subnet, and the application connects using an SSL connection. The security team wants to ensure that even if the network is compromised, the data remains confidential. What additional measure should be taken?

Accepted Answer

Use IAM database authentication with SSL.. Option C is correct because enabling IAM database authentication with SSL ensures that the connection uses a certificate that is validated. Option A is wrong because RDS does not support client-side encryption of connections natively; SSL is the standard. Option B is wrong because encryption at rest does not protect data in transit. Option D is wrong because a VPN adds complexity but does not replace SSL encryption between app and DB.

Answer

Deploy a VPN connection between the EC2 instances and the RDS database.

Answer

Use a client-side encryption library to encrypt data before sending.

Answer

Enable encryption at rest on the RDS instance.

Question 10

A network engineer runs the above command and sees that VPC Flow Logs are configured for a VPC. The engineer wants to analyze rejected traffic to troubleshoot a connectivity issue. Which field in the flow log records should they examine?

Accepted Answer

action. Option B is correct because the 'action' field in VPC Flow Logs indicates ACCEPT or REJECT. Option A is wrong because 'srcaddr' is source IP. Option C is wrong because 'dstport' is destination port. Option D is wrong because 'protocol' is the protocol number.

Answer

protocol

Answer

srcaddr

Answer

dstport

Question 11

A company is designing a security group configuration for a three-tier web application (web, application, database). The web tier is accessible from the internet. Which TWO rules should be applied to meet security best practices?

Accepted Answer

App tier security group: inbound from the web tier security group on port 8080.. For a three-tier architecture, the web tier security group should allow inbound from the internet (0.0.0.0/0 on HTTP/HTTPS). The app tier security group should allow inbound only from the web tier security group. The database tier should allow inbound only from the app tier security group. Options A and C are correct. Option B (app tier from 0.0.0.0/0) is wrong. Option D (database tier from web tier) bypasses the app tier. Option E (database tier from 0.0.0.0/0) is wrong.

Answer

App tier security group: inbound from 0.0.0.0/0 on port 8080.

Answer

Database tier security group: inbound from the web tier security group on port 3306.

Answer

Database tier security group: inbound from 0.0.0.0/0 on port 3306.

Question 12

Refer to the exhibit. An IAM role ARN is shown. A security engineer wants to allow an EC2 instance to assume this role. What is required for the EC2 instance to successfully assume the role?

Accepted Answer

The role's trust policy must allow the EC2 service principal to assume the role, and the EC2 instance must be launched with an instance profile that includes this role.. Option A is correct because the trust policy of the role must allow the EC2 service to assume it. Additionally, the EC2 instance must have an instance profile with the role attached. Option B is incorrect because the role's permissions policy defines what the role can do, not who can assume it. Option C is incorrect because the EC2 instance does not need a public IP. Option D is incorrect because the trust policy must allow ec2.amazonaws.com, not the instance's IP address.

Answer

The trust policy must specify the EC2 instance's private IP address.

Answer

The role's permissions policy must include an Allow for the EC2 instance's security group.

Answer

The EC2 instance must have a public IP address to access the IAM endpoint.

Question 13

A security engineer is designing a hybrid network with an AWS Site-to-Site VPN. The company requires that all traffic between the on-premises network and VPC be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Use AWS Site-to-Site VPN with IPsec tunnels. Site-to-Site VPN uses IPsec tunnels to encrypt traffic. Option C is correct because the VPN connection inherently encrypts all traffic. Option A is wrong because VPC peering does not provide encryption. Option B is wrong because Direct Connect does not encrypt by default. Option D is wrong because Transit Gateway does not itself provide encryption.

Answer

Use VPC peering instead of VPN

Answer

Use AWS Direct Connect with MACsec

Answer

Deploy a Transit Gateway with route tables

Question 14

A company has a VPC with multiple subnets and is using Network Access Analyzer to identify unintended network access. It reports that an EC2 instance in a private subnet has a route to an internet gateway. Which two actions should be taken to remediate this?

Accepted Answer

Ensure the EC2 instance does not have a public IP address. The instance should not have a route to the internet. Removing the route from the subnet's route table and ensuring the instance does not have a public IP are correct. Option A and D are correct. Option B is wrong because a NAT gateway would still allow outbound internet. Option C is wrong because security groups do not affect routing. Option E is wrong because the instance may not have a public IP already.

Answer

Assign a public IP address to the instance

Answer

Update the security group to deny outbound traffic to 0.0.0.0/0

Answer

Attach a NAT gateway to the private subnet

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have block public access enabled. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) that denies bucket creation without block public access.. Option C is correct because a service control policy (SCP) can deny the s3:PutBucketPublicAccessBlock action or enforce the block public access settings. Option A is wrong because IAM roles in each account would require manual management. Option B is wrong because CloudTrail only logs, does not enforce. Option D is wrong because AWS Config can detect noncompliance but not enforce automatically in real-time.

Answer

Use AWS CloudTrail to monitor bucket creation and alert.

Answer

Use AWS Config rules to detect and remediate noncompliant buckets.

Answer

Create an IAM role in each account that restricts bucket permissions.

Question 16

Refer to the exhibit. A security engineer applies this S3 bucket policy. What is the result of this policy?

Accepted Answer

All PutObject requests must use SSE-KMS encryption.. Option C is correct. The policy denies s3:PutObject if the object is not encrypted with SSE-KMS (condition StringNotEquals aws:kms). Option A is wrong because it does not require a specific KMS key, just SSE-KMS. Option B is wrong because it does not allow any encryption. Option D is wrong because the policy explicitly denies, not allows.

Answer

All objects must be encrypted with SSE-S3 or SSE-KMS.

Answer

All objects must be encrypted with a specific KMS key.

Answer

All PutObject requests are allowed regardless of encryption.

Question 17

A company has a VPC with multiple subnets. They deploy a Network Firewall to inspect traffic. The firewall is configured with a stateful rule that allows outbound HTTP traffic to any destination. However, traffic from an EC2 instance in a private subnet to an external web server fails. The route table for the private subnet has a default route pointing to the firewall endpoint. What is the likely issue?

Accepted Answer

The firewall endpoint is in a different Availability Zone than the instance.. Option D is correct because the firewall endpoint is in a different Availability Zone; traffic must be routed to the firewall endpoint in the same AZ to avoid cross-AZ charges and potential routing issues. Option A is wrong because the stateful rule allows HTTP outbound. Option B is wrong because a NAT gateway is not required if using firewall. Option C is wrong because the security group allows outbound HTTP.

Answer

The stateful rule order is incorrect; a default deny rule is blocking traffic.

Answer

The EC2 instance security group does not allow outbound HTTP.

Answer

The subnet does not have a route to a NAT gateway.

Question 18

A security engineer needs to audit all API calls that modify security group rules in a VPC. Which AWS service should be used to record these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS API, including modifications to security group rules. Option B is correct. AWS Config records resource configuration changes but not API calls. VPC Flow Logs capture network traffic logs, not API calls. Amazon Inspector is for vulnerability assessment.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs

Question 19

Which TWO of the following are valid methods to secure data at rest in Amazon S3? (Choose two.)

Accepted Answer

Use SSE-S3 (Server-Side Encryption with S3 managed keys).. Options B and C are correct. Server-side encryption with S3 managed keys (SSE-S3) is a valid method. Client-side encryption where the customer encrypts data before uploading is also valid. Option A is incorrect because SSL/TLS encrypts data in transit, not at rest. Option D is incorrect because network ACLs do not encrypt data. Option E is incorrect because VPC endpoints do not encrypt data.

Answer

Use SSL/TLS to encrypt data during transfer.

Answer

Use a VPC endpoint to restrict access to the bucket.

Answer

Configure a network ACL to block unauthorized access.

Question 20

A company has a VPC with public and private subnets. The public subnet hosts a web server that must be accessible from the internet. The private subnet hosts a database that should only be accessible from the web server. Which security group configuration should be used?

Accepted Answer

Database security group: inbound rule allowing traffic from the web server security group on the database port. Security groups can reference other security groups as sources. Option A is correct because it allows traffic from the web server's security group. Option B is wrong because it allows all traffic from the VPC CIDR, which is too permissive. Option C is wrong because it allows all inbound traffic. Option D is wrong because it allows traffic from the web server but not specifically via its security group.

Answer

Database security group: inbound rule allowing traffic from the VPC CIDR on the database port

Answer

Database security group: inbound rule allowing traffic from the web server's private IP on the database port

Answer

Database security group: inbound rule allowing traffic from 0.0.0.0/0 on the database port