ANS-C01 Mock Exam 79 — 25 Questions

Question 1

Refer to the exhibit. A company has an S3 bucket policy that allows public read access only from a specific IP range (203.0.113.0/24). Users outside this range report that they can still access objects in the bucket. What is the most likely reason?

Accepted Answer

The bucket also has a bucket ACL that grants public read access, overriding the policy condition. Option C is correct. The condition key `aws:SourceIp` does not work if the request comes through an AWS service (e.g., CloudFront) because the source IP becomes the CloudFront IP. Also, if the bucket policy allows access via a pre-signed URL, the condition is not evaluated? Actually, pre-signed URLs bypass the bucket policy? No, pre-signed URLs still require the request to match the policy. However, the most common reason is that the bucket has an ACL that allows public access, overriding the policy. Option A is wrong because the bucket policy is evaluated. Option B is wrong because AWS does not use `aws:SourceIp` for requests made through an AWS service? The condition works for direct requests. Option D is wrong because the bucket is not encrypted. The most likely is that the bucket also has a bucket ACL that grants public access, and since ACLs are evaluated before bucket policies? Actually, ACLs and bucket policies are evaluated together, but if an ACL allows access, the policy condition might be ignored? No, the effective access is the union of all allowed permissions. So if ACL allows public access, the condition is irrelevant. Thus, option C is correct.

Answer

The bucket policy uses the wrong condition key; it should be aws:SourceIpAddress

Answer

The bucket policy is not being evaluated because the bucket is in a different region

Answer

The bucket is configured with server-side encryption, which prevents the policy from being applied

Question 2

Which TWO measures can be taken to protect an AWS account's root user credentials? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use that instead of the root user. Options B and D are correct. Enabling MFA and creating an IAM admin user are best practices. Option A is wrong because using root user regularly is not recommended. Option C is wrong because deleting the root user is not possible. Option E is wrong because sharing credentials is insecure.

Answer

Use the root user for daily administrative tasks

Answer

Delete the root user account after creating IAM users

Answer

Store the root user credentials in a shared password manager

Question 3

A company has a VPC peered with another VPC in a different account. They want to ensure that only specific ports are allowed from the peered VPC to their application servers. Which configuration should they use?

Accepted Answer

Configure a Security Group rule with the security group ID of the peered VPC. Option B is correct because Security Groups can reference a peered VPC security group as a source, allowing fine-grained control. Option A is wrong because Security Groups cannot reference a CIDR block of a peered VPC directly. Option C is wrong because Network ACLs are stateless and require rules in both directions, and they cannot reference security groups. Option D is wrong because VPC peering does not have built-in filtering; you need security groups or NACLs.

Answer

Use a VPC peering route table to restrict traffic

Answer

Configure a Security Group rule with the CIDR of the peered VPC

Answer

Configure a Network ACL rule with the CIDR of the peered VPC

Question 4

A company has a VPC with an internet-facing Application Load Balancer (ALB) that routes traffic to EC2 instances in private subnets. The security team wants to block traffic from specific geographic regions. Which AWS service should they use?

Accepted Answer

AWS WAF. Option A is correct because AWS WAF can be associated with an ALB to filter traffic based on geographic location. Option B is wrong because Security Groups do not support geographic blocking. Option C is wrong because Network ACLs do not support geographic blocking. Option D is wrong because AWS Shield Advanced provides DDoS protection, not geographic filtering.

Answer

AWS Shield Advanced

Answer

Network ACLs

Answer

Security Groups

Question 5

A company has a Direct Connect connection to AWS. They want to encrypt all traffic between their on-premises network and their VPC. Which solution meets this requirement?

Accepted Answer

Set up a VPN connection over the Direct Connect link using IPsec.. Option D is correct because Direct Connect does not provide encryption; you must use IPsec VPN over the Direct Connect link or a MACsec at the physical layer. Option A is wrong because Direct Connect itself does not encrypt traffic. Option B is wrong because TLS is for application layer, not all traffic. Option C is wrong because AWS Site-to-Site VPN can be used over Direct Connect to encrypt traffic.

Answer

Use MACsec on the Direct Connect connection.

Answer

Enable encryption on the Direct Connect virtual interface.

Answer

Use TLS for all traffic between on-premises and AWS.

Question 6

A company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all new S3 buckets created across accounts have encryption enabled and block public access. Which TWO approaches meet these requirements? (Choose two.)

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the configuration does not meet requirements.. Option A is correct because SCPs can deny actions that create buckets without encryption or with public access allowed, enforcing the policy across all accounts. Option C is correct because AWS Config rules can be applied via a conformance pack to detect and remediate non-compliant buckets. Option B is wrong because CloudTrail only logs API calls; it cannot enforce or remediate. Option D is wrong because IAM roles in individual accounts cannot enforce organization-wide policies; they grant permissions to principals. Option E is wrong because bucket policies are per-bucket and cannot be enforced globally across all accounts.

Answer

Use an S3 bucket policy that denies all principals unless encryption is enabled.

Answer

Enable AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM role in each account that requires MFA for creating S3 buckets.

Question 7

A company applies the above S3 bucket policy. An administrator reports that an application using the AWS SDK is unable to upload objects to the bucket from an EC2 instance in the same account. The EC2 instance has an IAM role with s3:PutObject permission. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS.. Option C is correct because the condition aws:SecureTransport: true requires HTTPS, but the SDK must explicitly use HTTPS; if it uses HTTP, the request is denied. Option A is wrong because the principal is the account root, which does not apply to the EC2 role. Option B is wrong because the resource includes the bucket and objects. Option D is wrong because the condition does not require encryption at rest; it only requires secure transport.

Answer

The bucket policy grants access to the root user only, not the IAM role.

Answer

The application is not using server-side encryption.

Answer

The bucket policy does not grant access to the bucket itself, only to objects.

Question 8

A financial services company must meet PCI DSS compliance. They have a VPC with public and private subnets. The private subnets host applications that process credit card data. The security team wants to ensure that no data leaves the VPC to the internet except through a controlled egress point. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Implement a central inspection VPC with AWS Network Firewall to inspect all outbound traffic.. Option A is correct because a NAT gateway allows outbound traffic from private subnets but the team wants to control egress; however, combined with other measures it can be part of a controlled egress. Option C is correct because a VPC endpoint for S3 and DynamoDB allows access to these services without traversing the internet. Option D is correct because a central inspection VPC with AWS Network Firewall can inspect and allow/deny outbound traffic. Option B is wrong because an Internet Gateway does not provide controlled egress; it allows direct internet access. Option E is wrong because Security Groups do not inspect traffic; they are stateful firewalls that only allow/deny based on rules.

Answer

Configure security groups to deny all outbound traffic from private subnets.

Answer

Attach an Internet Gateway to the VPC and allow all outbound traffic.

Question 9

A security engineer is troubleshooting connectivity issues between two VPCs connected via a VPC Peering connection. The VPCs are in different accounts. The security groups in both VPCs allow traffic between the CIDRs. The route tables have the appropriate entries. However, instances in VPC A cannot communicate with instances in VPC B. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.. Option B is correct because VPC Peering connections do not support transitive routing, so if there is an intermediate gateway, traffic will not flow. Option A is incorrect because security groups are stateful and allow return traffic automatically. Option C is incorrect because VPC Peering does not require an IAM role. Option D is incorrect because NACLs are stateless and return traffic must be allowed, but the problem states security groups allow traffic, not NACLs.

Answer

The VPC Peering connection requires an IAM role to be assumed for cross-account communication.

Answer

The security group in VPC A does not allow inbound traffic from VPC B's CIDR.

Answer

The network ACL in VPC A does not allow return traffic from VPC B.

Question 10

Which TWO actions improve the security of an AWS account's root user? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use it for daily tasks.. Options A and D are correct. Enabling MFA on the root user is a critical security best practice. Creating an IAM admin user and not using the root user for daily tasks reduces exposure. Option B is wrong because a strong password alone is insufficient; MFA is also needed. Option C is wrong because sharing the password is insecure. Option E is wrong because the Access Key is not needed and should be avoided.

Answer

Share the root user password with the security team.

Answer

Set a strong password for the root user.

Answer

Generate an Access Key for the root user and use it for programmatic access.

Question 11

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from an S3 bucket in the same AWS region. The company wants to ensure that traffic does not traverse the internet. Which solution is MOST cost-effective?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the private subnet's route table to the endpoint.. Option D is correct because a Gateway VPC Endpoint for S3 allows private connectivity to S3 without cost, and it does not require a NAT Gateway or Internet Gateway. Option A is wrong because a NAT Gateway would incur hourly charges and data processing fees. Option B is wrong because an Internet Gateway is not needed and would allow internet traffic. Option C is wrong because an Interface VPC Endpoint for S3 incurs hourly charges.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic directly to S3.

Answer

Create an Interface VPC Endpoint for S3 in the private subnet.

Answer

Deploy a NAT Gateway in a public subnet and route the private subnet traffic through it to access S3.

Question 12

A CloudFormation stack created a VPC Gateway Endpoint for S3 with the above policy. An EC2 instance in the VPC is unable to download objects from the S3 bucket using the AWS CLI. The instance has an IAM role with s3:GetObject permission. What is the most likely cause?

Accepted Answer

The VPC Endpoint policy does not allow s3:ListBucket, which is needed for the CLI to list objects.. Option B is correct because the VPC Endpoint policy allows only s3:GetObject, but the CLI often requires s3:ListBucket to list objects, and also the endpoint policy must be combined with IAM; the instance role may not have the correct permissions. Option A is wrong because the endpoint policy allows GetObject. Option C is wrong because Gateway Endpoints do not use security groups. Option D is wrong because the route table must have a route to the endpoint, but the question implies it's configured.

Answer

The security group associated with the VPC Endpoint blocks traffic.

Answer

The VPC Endpoint policy does not allow s3:GetObject.

Answer

The route table for the private subnet does not have a route to the VPC Endpoint.

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.. Option A is correct because the inspection VPC must be attached to the Transit Gateway. Option B is correct because route tables must direct inter-VPC traffic to the inspection VPC. Option C is correct because the firewall appliance must be configured to inspect and forward traffic. Option D is wrong because Direct Connect is not required; VPN is already used. Option E is wrong because VPC Peering is not used with Transit Gateway; Transit Gateway replaces peering.

Answer

Set up VPC peering between the inspection VPC and each spoke VPC.

Answer

Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.

Question 14

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Create an S3 bucket policy with a condition that allows access only from the VPC endpoint.. Option A is correct because an S3 bucket policy can use the aws:SourceVpce condition key to allow access only from a specific VPC endpoint. Option C is correct because a VPC endpoint policy controls what actions principals within the VPC can perform on the S3 bucket. Option B is wrong because NACLs are stateless and not designed for this purpose; they control traffic at the subnet level but cannot enforce S3 bucket access. Option D is wrong because Security Groups do not apply to VPC endpoints; they are for EC2 instances. Option E is wrong because IAM roles do not restrict traffic origin; they grant permissions to identities.

Answer

Assign a security group to the VPC endpoint that allows inbound traffic from the VPC.

Answer

Configure a network ACL on the subnet to deny all inbound traffic except from the VPC.

Answer

Use an IAM role to grant the VPC access to the S3 bucket.

Question 15

A security team needs to block outbound traffic from an EC2 instance to known malicious IP addresses while allowing all other outbound traffic. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Update the VPC route table to send traffic for the malicious IPs to a network firewall appliance.. Option A is correct because the VPC route table directs traffic; the malicious IPs must be routed to a network firewall appliance. Option B is correct because a network firewall (like AWS Network Firewall) can inspect and block traffic to specific IPs. Option D is correct because the firewall rule should explicitly deny traffic to the malicious IPs. Option C is wrong because Security Groups are stateful and can only allow/deny inbound/outbound based on source/destination, not specific IPs in a scalable way; they are not designed for blocklists. Option E is wrong because NACLs are stateless and do not support stateful inspection or application-layer filtering.

Answer

Configure network ACLs to deny outbound traffic to the malicious IPs.

Answer

Modify the security group for the EC2 instance to deny outbound traffic to the malicious IPs.

Question 16

A network engineer is troubleshooting connectivity between two VPCs connected via a VPC peering connection. Security groups and NACLs are configured correctly. The engineer verifies that the route tables have the necessary entries. However, traffic from an EC2 instance in VPC A to an RDS instance in VPC B fails. Which TWO additional checks should be performed? (Choose two.)

Accepted Answer

Check that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A.. Option B is correct because a VPC peering connection must accept the request; if it's in 'pending-acceptance' or 'rejected' state, traffic will not flow. Option D is correct because security group rules must allow inbound traffic from the peer VPC's CIDR; misconfigured rules can block traffic. Option A is wrong because NACLs are stateless and if correctly configured should allow traffic; but the issue is likely elsewhere. Option C is wrong because IAM roles are not required for VPC peering. Option E is wrong because the issue is not about Internet Gateway; it's about VPC peering.

Answer

Verify that the network ACLs in both VPCs have appropriate inbound and outbound rules for the traffic.

Answer

Confirm that the VPCs have an Internet Gateway attached.

Answer

Check that the EC2 instance has an IAM role that allows it to communicate with RDS.

Question 17

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM role can be created without an approved custom trust policy. Which SCP should be attached to the root OU to enforce this requirement?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/Approved":"true"}}}]}. Option A is correct because it uses a Deny effect with a condition that only blocks IAM role creation when the request does not include a tag with key 'Approved' set to 'true'. This enforces that every new IAM role must have an approved custom trust policy by requiring the tag as a proxy for approval, while still allowing role creation when the tag is present. The SCP is attached to the root OU to apply globally across all accounts in the organization.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"arn:aws:iam::*:role/*","Condition":{"StringNotLike":{"iam:RoleName":"approved-*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:PassRole","Resource":"*"}]}

Question 18

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. The bucket policy should deny requests that do not originate from the VPC. Which condition key should be used in the bucket policy?

Accepted Answer

aws:SourceVpc. The correct condition key is `aws:SourceVpc`, which allows you to restrict access to an S3 bucket based on the VPC from which the request originates. When used in a bucket policy with a Deny effect, it ensures that only requests coming from the specified VPC ID are allowed, and all other requests are denied. This key is specifically designed for VPC-based access control in S3 bucket policies.

Answer

aws:VpcSourceIp

Answer

aws:Referer

Answer

aws:SourceIp

Question 19

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The security team needs to centrally manage and enforce network security policies across all accounts. Which TWO services or features can be used to centrally enforce network security controls? (Choose TWO.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides stateful, application-layer filtering and intrusion prevention for VPCs. It can be centrally deployed and managed across multiple accounts using AWS Firewall Manager, enabling consistent enforcement of network security policies at scale.

Answer

Network ACLs

Answer

VPC Flow Logs

Answer

VPC security groups with cross-account references

Question 20

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?

Accepted Answer

The security group for the ALB does not allow inbound traffic from the internet.. The most likely cause is that the ALB's security group does not allow inbound traffic from the internet (0.0.0.0/0) on the listener port (e.g., 80 or 443). Without this rule, the ALB will reject incoming client requests, causing intermittent timeouts as users attempt to connect. The ALB must have an inbound rule permitting traffic from the internet to receive and forward requests to the targets.

Answer

The ALB is not associated with an internet gateway.

Answer

The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.

Answer

Cross-zone load balancing is disabled on the ALB.

ANS-C01 Mock Exam 79 — 25 Questions

Exhibit

ANS-C01 Mock Exam 79 — 25 Questions

Exhibit