ANS-C01 Mock Exam 73 — 25 Questions

Question 1

A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?

Accepted Answer

The target group health checks are failing, so the NLB is not sending traffic to those targets. NLB target group health checks might be failing, so the NLB does not send traffic to unhealthy targets. Option A is wrong because security groups on targets would drop traffic after NLB sends it. Option B is wrong because NLB does not have security groups. Option C is wrong because NACLs on the target subnet affect traffic to the instance, but the NLB would still send traffic if the target is healthy.

Answer

The target subnet network ACL blocks the client IP

Answer

The target instance security group does not allow traffic from the NLB

Answer

The NLB security group blocks the client IP

Question 2

A company uses AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate for a domain hosted on Route 53. The certificate is used by an Application Load Balancer. After renewal, the ALB continues to serve the old certificate. What is the most likely cause?

Accepted Answer

The ALB listener is not configured to use the new certificate.. Option A is correct because ACM automatically renews certificates but the ALB may not use the new certificate until it is redeployed or the listener is updated. Option B is wrong because the certificate is public and can be used with an ALB. Option C is wrong because ACM uses DNS validation with Route 53 automatically. Option D is wrong because ACM does not need to import the certificate; it issues it.

Answer

The certificate was not imported into ACM correctly.

Answer

The certificate is a private certificate and cannot be used with an ALB.

Answer

DNS validation failed during renewal.

Question 3

A company needs to meet compliance requirements that mandate encryption of all data in transit between EC2 instances in the same VPC. The instances are in different subnets and communicate using TCP port 443. Which solution should a network engineer implement?

Accepted Answer

Configure the application to use TLS for communication.. Option C is correct because enabling TLS on the application ensures end-to-end encryption. Option A is wrong because AWS Certificate Manager does not automatically encrypt traffic; it provides certificates. Option B is wrong because VPNs are not needed for same-VPC traffic. Option D is wrong because VPC Flow Logs do not encrypt traffic.

Answer

Enable VPC Flow Logs to monitor for unencrypted traffic.

Answer

Use AWS Certificate Manager (ACM) to provision certificates and enable encryption automatically.

Answer

Deploy a VPN connection between the instances.

Question 4

A security team needs to implement a solution to detect and alert on suspicious network traffic within a VPC. The solution should analyze VPC Flow Logs and generate findings for potential threats. Which THREE AWS services can be used together to achieve this?

Accepted Answer

VPC Flow Logs. Option A (VPC Flow Logs) provides the data source. Option B (Amazon GuardDuty) can analyze Flow Logs for threats. Option D (Amazon Detective) can perform deeper investigation. Option C is wrong because CloudTrail is for API logging, not network traffic analysis. Option E is wrong because Config is for resource configuration tracking.

Answer

AWS CloudTrail

Answer

AWS Config

Question 5

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The security team wants to enforce multi-factor authentication (MFA) for all VPN connections. Which configuration should be used?

Accepted Answer

Use SAML-based federation with an identity provider that requires MFA. AWS Client VPN supports mutual authentication and can use SAML-based identity federation with an IdP that requires MFA. Option A is wrong because client certificates alone do not enforce MFA. Option B is wrong because Active Directory alone does not enforce MFA. Option D is wrong because security groups do not enforce authentication.

Answer

Attach a security group to the Client VPN endpoint that only allows MFA-authenticated traffic

Answer

Use AWS Managed Microsoft AD for authentication

Answer

Use mutual authentication with client certificates

Question 6

A company has a VPC with public and private subnets. The public subnet hosts a NAT gateway. The private subnet hosts EC2 instances that need to download patches from the internet. The EC2 instances have a security group that allows outbound HTTPS to 0.0.0.0/0. What additional configuration is required?

Accepted Answer

Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. Option B is correct because private subnet instances need a route to the NAT gateway for internet access. Option A is wrong because an internet gateway is attached to the VPC, not the private subnet. Option C is wrong because the NAT gateway is already in the public subnet. Option D is wrong because a VPC endpoint is for private connectivity to AWS services, not for internet access.

Answer

Attach an internet gateway to the private subnet.

Answer

Move the NAT gateway to the private subnet.

Answer

Create a VPC endpoint for S3.

Question 7

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer needs to restrict access to only the company's public IP range (203.0.113.0/24). What is the correct way to modify the security group rule?

Accepted Answer

Edit the existing inbound rule and change the source CIDR to 203.0.113.0/24.. Option A is correct because the CIDR should be changed from 0.0.0.0/0 to 203.0.113.0/24. Option B is wrong because adding a second rule does not remove the open rule. Option C is wrong because NACLs operate at the subnet level. Option D is wrong because removing the rule and adding a new deny rule is not how security groups work; security groups are allow-only.

Answer

Add a new inbound rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

Answer

Remove the security group rule and add a new rule to deny SSH from 0.0.0.0/0.

Answer

Create a network ACL that denies SSH from 0.0.0.0/0.

Question 8

A company needs to ensure that all outbound internet traffic from a VPC goes through a centralized inspection appliance. The VPC has multiple subnets. Which THREE steps are required to implement this?

Accepted Answer

Configure security groups to allow outbound traffic from the instances. Options A, C, and D are correct. An egress-only Internet Gateway is used for IPv6, but for IPv4, the default route points to a NAT gateway or appliance. However, the question implies IPv4; using a NAT gateway is common. Option A (route table) is essential. Option C (security groups) allows traffic. Option D (NAT gateway in public subnet) provides outbound connectivity. Option B is wrong because VPC endpoints are for AWS services, not internet. Option E is wrong because IGW is for inbound, not outbound inspection.

Answer

Attach an Internet Gateway to the VPC and route all traffic to it

Answer

Create VPC endpoints for all required AWS services

Question 9

A company is using AWS Secrets Manager to store database credentials. They want to ensure that the credentials are automatically rotated every 30 days. Which configuration is required?

Accepted Answer

Enable automatic rotation in the secret configuration and provide a Lambda rotation function.. Option A is correct because Secrets Manager can automatically rotate secrets with a Lambda function. Option B is wrong because Systems Manager Parameter Store does not have built-in rotation. Option C is wrong because IAM Access Analyzer does not rotate credentials. Option D is wrong because CloudHSM is for hardware security modules, not automated rotation.

Answer

Store the secret in AWS Systems Manager Parameter Store and configure a rotation schedule.

Answer

Store the secret in AWS CloudHSM and use a scheduled Lambda to rotate.

Answer

Use IAM Access Analyzer to rotate the credentials periodically.

Question 10

A company is designing a VPC with private subnets for databases and public subnets for web servers. They need to allow the web servers to make outbound internet requests for software updates but prevent inbound traffic from the internet. Which configuration should they use?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.. Option C is correct because a NAT Gateway in a public subnet allows outbound internet traffic from private subnets while blocking unsolicited inbound traffic. Option A is wrong because an Internet Gateway alone would allow inbound traffic. Option B is wrong because a NAT Gateway in a private subnet cannot access the internet. Option D is wrong because a proxy in a public subnet could work but is more complex and not the simplest solution.

Answer

Deploy a NAT Gateway in the private subnet and route the private subnet traffic through it.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through it.

Answer

Deploy a proxy server in the private subnet and configure the web servers to use it.

Question 11

A company is designing a security group rule to allow outbound HTTPS traffic (TCP 443) to a specific external service IP range 203.0.113.0/24. The security group is attached to a fleet of EC2 instances. Which rule should be added?

Accepted Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/24. Option D is correct because security group outbound rules require a destination CIDR. Option A is wrong because source is for inbound rules. Option B is wrong because security groups do not use prefix lists for destinations. Option C is wrong because the IP range is /24, not /32.

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/32

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: pl-12345 (prefix list for the IP range)

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Source: 203.0.113.0/24

Question 12

A company wants to encrypt all data in transit between an Application Load Balancer (ALB) and its target EC2 instances. Which TWO actions should be taken?

Accepted Answer

Configure the target group to use HTTPS as the protocol. Options A and D are correct. The ALB listener must use HTTPS to terminate SSL. The target group for the ALB must use HTTPS protocol to encrypt traffic to targets. Option B is wrong because listener rules do not affect encryption. Option C is wrong because security group rules do not encrypt traffic. Option E is wrong because Client Certificate Authentication is for client-to-ALB, not ALB-to-target.

Answer

Enable Client Certificate Authentication on the ALB

Answer

Add a listener rule to forward traffic based on path

Answer

Configure security groups to allow only HTTPS traffic

Question 13

A company has a VPC with multiple subnets. They have an Application Load Balancer (ALB) in a public subnet and a web server fleet in private subnets. The security team wants to ensure that only the ALB can communicate with the web servers. Which security group configuration should be used?

Accepted Answer

Set the web server security group inbound rule to allow traffic from the ALB's security group.. Option B is correct because referencing the ALB's security group as the source allows only traffic from the ALB. Option A is wrong because allowing all traffic from the VPC CIDR is too broad. Option C is wrong because allowing all traffic from the public subnet is still broad. Option D is wrong because allowing from 0.0.0.0/0 allows all inbound traffic.

Answer

Set the web server security group inbound rule to allow traffic from the public subnet CIDR.

Answer

Set the web server security group inbound rule to allow traffic from the VPC CIDR.

Answer

Set the web server security group inbound rule to allow traffic from 0.0.0.0/0.

Question 14

A company needs to audit all changes to security groups in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls, including changes to security groups. Option A is wrong because AWS Config records resource configuration changes but is not primarily for auditing API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because CloudWatch Logs stores logs but does not capture API calls by default.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 15

Refer to the exhibit. A company has attached this bucket policy to an S3 bucket. An EC2 instance in VPC vpc-12345 is trying to access the bucket but is getting access denied. The EC2 instance has a public IP of 198.51.100.10. What is the MOST likely reason?

Accepted Answer

The EC2 instance's source IP is not in the allowed IP range. Option B is correct. The policy has two allow statements: one for source IP range and one for source VPC. The EC2 instance's source IP (198.51.100.10) is not in the allowed IP range (203.0.113.0/24). The second statement allows requests from the VPC, but the condition aws:SourceVpc is only present when the request comes through a VPC endpoint (Gateway or Interface endpoint). If the EC2 instance accesses S3 via the internet (public IP), the aws:SourceVpc condition is not satisfied, so the second statement does not apply. The first statement does not allow the IP, resulting in implicit deny. Option A is wrong because the policy allows GetObject. Option C is wrong because the policy does not require both conditions. Option D is wrong because there is no explicit deny.

Answer

The policy does not have an explicit allow for the instance's IP

Answer

Both conditions must be met for access

Answer

The EC2 instance does not have the s3:GetObject permission

Question 16

A company is using AWS Direct Connect to connect their on-premises network to AWS. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect virtual interface (VIF) configured. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures that traffic automatically uses the VPN if the Direct Connect connection fails?

Accepted Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the Direct Connect VIF with a higher metric.. Option D is correct because propagating BGP routes from both the Direct Connect VIF and the VPN, and creating a static route with a higher metric (less preferred) for the Direct Connect route, allows automatic failover. Option A is wrong because the VPN must be configured to handle failover. Option B is wrong because the VPN alone does not provide automatic failover without route propagation. Option C is wrong because the VPN must be attached to the VGW.

Answer

Configure the VPN connection but attach it to a separate VGW, and use a transit gateway with failover routing.

Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the VPN.

Answer

Configure the VPN connection but do not propagate routes; use static routes in the route table.

Question 17

Which THREE components are required to enable AWS Shield Advanced automatic application layer DDoS mitigation for an Application Load Balancer? (Choose three.)

Accepted Answer

AWS Shield Advanced subscription. Options A, B, and C are correct. Shield Advanced integrates with WAF for automatic mitigation, requires a web ACL, and must be associated with the ALB. Option D is wrong because CloudFront is not required. Option E is wrong because Route53 is not required.

Answer

Amazon CloudFront distribution in front of the ALB

Answer

Amazon Route53 DNS configuration

Question 18

A company is designing a network security architecture for a multi-tier application. They want to ensure that the web tier can communicate with the application tier only on specific ports, and the application tier can communicate with the database tier only on specific ports. Which TWO configurations should be implemented?

Accepted Answer

Use network ACLs to provide a secondary layer of stateless filtering at the subnet level.. Options A and B are correct. Security groups are used to control traffic between tiers based on security group IDs. Network ACLs are stateless and can be used as a secondary layer. Option C is wrong because a single security group cannot differentiate between tiers; multiple security groups are needed. Option D is wrong because VPC peering is for connecting VPCs, not for traffic filtering within a VPC. Option E is wrong because a transit gateway is for connecting multiple VPCs, not for security filtering.

Answer

Use a transit gateway with network ACLs to filter traffic between tiers.

Answer

Use VPC peering to connect the tiers and apply security groups on the peering connection.

Answer

Use a single security group for all tiers and define rules based on CIDR blocks.

Question 19

A security engineer is troubleshooting why an EC2 instance cannot communicate with the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The security group for the instance allows all outbound traffic. What should the engineer check NEXT?

Accepted Answer

Check the network ACL associated with the private subnet. Option C is correct because network ACLs are stateless and must allow both inbound and outbound traffic for the response. Option A is wrong because security group already allows outbound. Option B is wrong because the route is configured. Option D is wrong because flow logs are for analysis, not a next step in troubleshooting connectivity.

Answer

Verify that the security group inbound rules allow return traffic

Answer

Verify that the NAT gateway has an Elastic IP

Answer

Enable VPC Flow Logs to analyze traffic

Question 20

A financial services company is required to encrypt all data at rest and in transit. They have an Amazon S3 bucket with server-side encryption enabled (SSE-S3) and are using HTTPS for all API calls. During an audit, the auditor points out that the bucket policy does not explicitly deny requests that do not use HTTPS. Which of the following should the company add to the bucket policy to enforce HTTPS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. Option B is correct because the condition block with aws:SecureTransport false and a Deny effect ensures that any request not using HTTPS is denied. Option A is wrong because using Bool with true would allow only HTTPS, but the condition should be false to deny non-HTTPS. Option C is wrong because it allows HTTPS requests but does not deny non-HTTPS. Option D is wrong because it denies when SecureTransport is true, which would block HTTPS requests.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}