ANS-C01 Mock Exam 74 — 25 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via a VPN. They want to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the network?

Accepted Answer

Configure Transit Gateway with appliance mode and route traffic through a dedicated inspection VPC.. Option B is correct because Transit Gateway supports appliance mode that forces traffic to be routed through a specific VPC where the security appliance resides. Option A is wrong because VPC Peering does not support transitive routing. Option C is wrong because Network Firewall can inspect traffic but does not require Transit Gateway; however, the question specifically asks for a design with Transit Gateway. Option D is wrong because Security Groups cannot inspect traffic at the network level.

Answer

Create VPC Peering connections between each VPC and the inspection VPC.

Answer

Use security groups in each VPC to restrict traffic and enable VPC Flow Logs for auditing.

Answer

Place the security appliance in each VPC and use Network Firewall to inspect traffic.

Question 2

A company wants to audit all Network Load Balancer (NLB) operations performed in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls for AWS services, including NLB. Option A is wrong because VPC Flow Logs capture network traffic, not API operations. Option B is wrong because Config records resource configurations, not API calls. Option D is wrong because CloudWatch Logs stores logs but does not capture API calls natively.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 3

A security team is designing a network architecture that must meet PCI DSS compliance. They have a VPC with multiple subnets and need to ensure that all traffic between subnets is inspected by a stateful firewall. The solution must also support scalability and high availability. Which AWS service should they use?

Accepted Answer

AWS Network Firewall. Option B is correct. AWS Network Firewall provides stateful inspection, scales automatically, and is highly available. Option A is wrong because security groups are stateless? Actually, security groups are stateful, but they are not a firewall appliance for inspection; they are simple rules. Option C is wrong because Network ACLs are stateless. Option D is wrong because AWS WAF is for web application layer, not network layer.

Answer

Security groups on each subnet

Answer

AWS WAF

Answer

Network ACLs on each subnet

Question 4

A company is using AWS WAF to protect its web application. The security team notices that the WAF logs show a high number of requests from a specific IP address range that are being blocked by the SQL injection rule. However, the application team reports that legitimate users from that IP range are unable to access the application. Which action should the security team take to resolve this issue while maintaining security?

Accepted Answer

Create a rate-based rule to limit requests from the IP range.. Option C is correct because creating a rate-based rule can limit the request rate from the IP range, allowing legitimate traffic while still blocking excessive requests. Option A is wrong because disabling the SQL injection rule removes protection. Option B is wrong because allowing the entire IP range bypasses security. Option D is wrong because increasing the rate limit for the entire WAF is not granular enough.

Answer

Disable the SQL injection rule for the specific IP range.

Answer

Increase the rate limit for the entire WAF.

Answer

Add the IP range to the allow list in the WAF.

Question 5

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3 or SSE-KMS. Which THREE steps should they take to implement this policy?

Accepted Answer

Attach the SCP to the root organizational unit (OU) to apply to all accounts.. Options A, B, and C are correct. Creating an SCP in the root OU denies the creation of unencrypted buckets. Additionally, using AWS Config rules and remediation actions can enforce encryption on existing buckets. Option D is wrong because a bucket policy is per bucket, not organizational. Option E is wrong because a VPC endpoint policy controls access to S3 from a VPC, not encryption.

Answer

Apply a bucket policy in each account that denies PutObject without encryption.

Answer

Use a VPC endpoint policy to enforce encryption for all S3 access from the VPC.

Question 6

A security engineer needs to block traffic from a specific country from reaching an Application Load Balancer. Which AWS service should be used to accomplish this?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF can be associated with an ALB to create IP set rules that block traffic based on geographic origin. Option A is wrong because Security Groups do not support geo-blocking. Option B is wrong because NACLs operate at the subnet level and do not support geo-blocking. Option D is wrong because Route 53 Resolver DNS Firewall filters DNS queries, not HTTP traffic.

Answer

Network ACLs on the VPC subnet

Answer

Security groups associated with the ALB

Answer

Route 53 Resolver DNS Firewall

Question 7

A company is using AWS Direct Connect to connect on-premises to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which TWO options can achieve this?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect virtual interface. Option A is correct because IPsec VPN over Direct Connect can encrypt traffic. Option D is correct because MACsec provides encryption at Layer 2 for dedicated connections. Option B is wrong because TLS is for application-level encryption, not link-level. Option C is wrong because VPC endpoints do not encrypt the Direct Connect link. Option E is wrong because Direct Connect by itself does not provide encryption.

Answer

Use TLS on all applications

Answer

Use VPC gateway endpoints for S3

Answer

Rely on Direct Connect's physical security

Question 8

A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?

Accepted Answer

AWS Network Firewall. Option D is correct because AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A is wrong because security groups do not support allowlisting based on domain names. Option B is wrong because NACLs are stateless and work at the subnet level. Option C is wrong because AWS WAF works at the application layer for inbound web traffic.

Answer

AWS WAF

Answer

Network ACL

Answer

Security group with outbound rules

Question 9

A company has a requirement to audit all network traffic leaving a VPC. The traffic includes traffic to the internet, to on-premises via VPN, and to other VPCs via Transit Gateway. Which AWS service can capture and log all outbound traffic for compliance analysis?

Accepted Answer

VPC Traffic Mirroring. Option D is correct because VPC Traffic Mirroring captures and copies traffic for analysis. Option A is wrong because Flow Logs log metadata, not full packets. Option B is wrong because CloudTrail logs API calls, not network traffic. Option C is wrong because GuardDuty detects threats but does not log all traffic.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 10

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to use a proxy server running on an EC2 instance in the public subnet. The security group for the proxy server must allow inbound HTTP/HTTPS from the instance in the private subnet. The security group for the private instance must allow outbound HTTP/HTTPS to the proxy server. However, the private instance cannot connect to the proxy. What is the most likely cause?

Accepted Answer

The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.. Option B is correct because the route table of the private subnet likely has a default route to a NAT gateway or internet gateway, causing traffic to bypass the proxy. The private instance's security group allows outbound HTTP/HTTPS to the proxy, but the subnet route may not point to the proxy. Option A is wrong because the network ACL must allow both inbound and outbound traffic; if it blocks inbound, the proxy cannot receive requests. Option C is wrong because the proxy's security group allows inbound from the private instance. Option D is wrong because the private instance's security group allows outbound to the proxy.

Answer

The security group for the private instance does not allow outbound traffic to the proxy server.

Answer

The network ACL for the private subnet blocks inbound traffic from the proxy.

Answer

The security group for the proxy server does not allow inbound traffic from the private instance's security group.

Question 11

A security engineer needs to audit all changes to security group rules in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls, including changes to security group rules. Option A is wrong because AWS Config records configuration changes but not API calls. Option C is wrong because CloudWatch Logs is for log storage, not recording API calls. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to centrally enforce that no Amazon S3 buckets are publicly accessible across all accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Apply a service control policy (SCP) in AWS Organizations that denies the s3:PutBucketPublicAccessBlock action or enforces a bucket policy condition.. Option C is correct because an SCP can be applied at the root OU to deny the s3:PutBucketPublicAccessBlock action or enforce a specific bucket policy. Option A is wrong because IAM roles are per-account and cannot centrally enforce across accounts. Option B is wrong because Trusted Advisor provides recommendations, not enforcement. Option D is wrong because security groups are for EC2, not S3.

Answer

Use AWS Trusted Advisor to check for public buckets and send alerts.

Answer

Create an IAM role in each account with a policy to deny public bucket access, and require users to assume that role.

Answer

Configure security group rules to block public internet access to the S3 endpoints.

Question 13

A company is building a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The security team requires that all API requests are authenticated and authorized, and that the Lambda function has only the necessary permissions to access DynamoDB. Which THREE steps should be taken?

Accepted Answer

Configure API Gateway to use an Amazon Cognito user pool or a Lambda authorizer for authentication.. Options A, C, and D are correct. Option A: Cognito or Lambda authorizer provides authentication. Option C: IAM roles with least privilege for Lambda. Option D: Resource-based policy on DynamoDB to restrict access to the Lambda function. Option B is wrong because API keys are for usage plans, not authentication. Option E is wrong because VPC endpoints are not required for serverless; the function can access DynamoDB over the internet.

Answer

Place the Lambda function inside a VPC and use a VPC endpoint for DynamoDB.

Answer

Use API keys in API Gateway to authenticate requests.

Question 14

A company uses an AWS Network Firewall to inspect traffic between VPCs and the internet. They want to allow outbound HTTPS traffic only to specific domains. Which rule configuration should be used?

Accepted Answer

Create a stateful rule group with a 'pass' action for the allowed domains using domain list rule group.. Domain list rule group in AWS Network Firewall can match FQDNs. Stateful rule groups inspect traffic states. Suricata compatible rules allow custom domain matching. IP set would match by IP, not domain.

Answer

Create a stateless rule group with a 'forward' action for the allowed IP addresses.

Answer

Create a stateful rule group with a 'drop' action for all traffic and then 'pass' for the allowed domains using Suricata compatible rules.

Answer

Create an IP set rule group with the allowed domain IP addresses.

Question 15

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Transit Gateway with appliance mode and a dedicated inspection VPC. Transit Gateway with appliance mode enables asymmetric routing and forces traffic to the inspection VPC. Option A is wrong because VPC peering does not centralize inspection. Option C is wrong because AWS Network Firewall is a managed service, not a third-party appliance. Option D is wrong because PrivateLink is for service access, not traffic inspection.

Answer

AWS PrivateLink endpoints in each VPC

Answer

AWS Network Firewall deployed in each VPC

Answer

VPC peering between each VPC and the inspection VPC

Question 16

A company needs to audit network traffic in a VPC for compliance. Which THREE AWS services can be used to capture and analyze network traffic?

Accepted Answer

Traffic Mirroring. Option A is correct because VPC Flow Logs capture IP traffic information. Option B is correct because Traffic Mirroring captures and inspects traffic. Option D is correct because AWS Network Firewall can log traffic. Option C is wrong because CloudTrail logs API calls, not network traffic. Option E is wrong because AWS Config monitors resource configurations, not traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Question 17

A company needs to ensure that all outbound traffic from a VPC goes through a centralized inspection appliance in a different VPC. Which TWO actions must be taken to achieve this?

Accepted Answer

Use AWS Transit Gateway with appropriate route tables to direct traffic to the inspection VPC.. Option A is correct: Transit Gateway with route tables can direct traffic to the inspection VPC. Option C is correct: The inspection VPC must have routes to forward traffic back. Option B is wrong: VPC peering does not support transitive routing. Option D is wrong: Direct Connect is for on-premises. Option E is wrong: VPC endpoints do not route general internet traffic.

Answer

Deploy VPC endpoints for all AWS services used.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs.

Answer

Create VPC peering connections between all VPCs.

Question 18

A company wants to securely connect an on-premises data center to an AWS VPC over the internet using IPsec. Which AWS service should be used?

Accepted Answer

AWS Site-to-Site VPN. Option A is correct because AWS Site-to-Site VPN provides IPsec tunnels. Option B is wrong because Client VPN is for individual users. Option C is wrong because Direct Connect is a dedicated physical connection, not over the internet. Option D is wrong because Transit Gateway is a network transit hub, not a VPN service itself.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Client VPN

Question 19

A company needs to audit all changes to security groups in a VPC. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls, including changes to security groups, and can be used for auditing. Option A is wrong because CloudWatch is for monitoring metrics and logs, not API activity. Option B is wrong because VPC Flow Logs capture network traffic, not API changes. Option D is wrong because AWS Config can track resource changes but is not primarily for auditing API calls; it focuses on resource configuration.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch

Question 20

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which policy type should be used?

Accepted Answer

Service Control Policy (SCP). Option A is correct because an SCP can restrict permissions at the account level. Option B is wrong because IAM policies apply to users/roles, not resource configurations. Option C is wrong because AWS Config rules are detective, not preventive. Option D is wrong because NACLs are per-subnet, not account-wide.

Answer

Network ACL

Answer

IAM policy

Answer

AWS Config rule