ANS-C01 Network Security, Compliance and Governance — 20 Questions

Question 1

A company has a hybrid network with an AWS Direct Connect connection to a VPC. They also have a site-to-site VPN connection as a backup. The VPC routing tables are configured with a route to the on-premises CIDR via the virtual private gateway. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect connection even when it is healthy. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC route table has a more specific route pointing to the VPN connection. When both Direct Connect and VPN are configured, the VPC route table typically has a single route to the on-premises CIDR via the virtual private gateway. Without more specific routing, the VPN BGP route may be preferred depending on route propagation and prefix matching. Option B is wrong because the VPN connection being down would not cause traffic to avoid Direct Connect. Option C is wrong because the Direct Connect virtual interface must be in the 'Available' state to pass traffic. Option D is wrong because the AWS Site-to-Site VPN connection uses a virtual private gateway or transit gateway, not a Customer Gateway as the target.

Answer

The VPN connection is down

Answer

The VPN connection is attached to a Customer Gateway

Answer

The Direct Connect virtual interface is in the 'Down' state

Question 2

A company uses AWS Shield Advanced for DDoS protection. During an attack, the security team notices that legitimate traffic is being throttled. They want to allow certain known IP addresses to bypass Shield Advanced rate-based rules. What should they do?

Accepted Answer

Create an AWS WAF rule with an IP set that allows the known IPs, and place it before the rate-based rule. AWS WAF rules can be configured with IP sets to allow traffic from specific IPs before applying rate-based rules. Option A is wrong because Shield Advanced does not support custom allow lists directly; it works with WAF. Option B is wrong because disabling rate-based rules would remove protection for all traffic. Option D is wrong because Shield Advanced does not have a bypass feature; it uses WAF for custom rules.

Answer

Disable rate-based rules during the attack

Answer

Use Shield Advanced automatic application layer DDoS mitigation

Answer

Create an allow list in AWS Shield Advanced to exempt the IPs from all protections

Question 3

Refer to the exhibit. A network engineer is troubleshooting connectivity issues from an EC2 instance in subnet-11111111. The instance can send traffic outbound, but cannot receive inbound HTTPS traffic from the internet. What is the likely cause?

Accepted Answer

The inbound rule only allows HTTPS, but the outbound rule allows all traffic; this is correct. The NACL inbound rule allows HTTPS (port 443) from 0.0.0.0/0, and the outbound rule allows all traffic. NACLs are stateless, so the outbound all-traffic rule correctly permits response traffic using ephemeral ports (1024–65535). Therefore, the NACL configuration is correct for inbound HTTPS traffic. The issue must lie elsewhere, such as the instance's security group not allowing inbound HTTPS, or a missing internet gateway route. Option C is correct because it acknowledges that the NACL is not misconfigured, which is the likely scenario given the exhibit.

Answer

The NACL is not associated with the correct subnet

Answer

The inbound rule should also allow ICMP traffic

Answer

The outbound rule should restrict traffic to only ephemeral ports

Question 4

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. The security team wants to minimize the attack surface. Which design should they choose?

Accepted Answer

Place the web tier in public subnets with an internet gateway, and the app and DB tiers in private subnets. Use security groups to allow traffic only from the web tier to the app tier and from the app tier to the DB tier.. It follows best practices by placing the web tier in public subnets for direct internet access via an internet gateway, and isolating the application and database tiers in private subnets. Security groups are used to allow traffic only from the web tier to the app tier and from the app tier to the DB tier, implementing least privilege. Option B is wrong because placing all tiers in private subnets with only a NAT gateway does not provide inbound internet access to the web tier; NAT gateway only supports outbound traffic. Option C is wrong because placing all tiers in the same subnet with a single security group violates the principle of least privilege, allowing unnecessary communication between tiers. Option D is wrong because placing all tiers in public subnets exposes the app and DB tiers to the internet, increasing the attack surface, and network ACLs are stateless and less flexible than security groups for controlling traffic between tiers.

Answer

Place all tiers in private subnets and use a NAT gateway for internet access.

Answer

Place all tiers in the same subnet and use a single security group for all instances.

Answer

Place all tiers in public subnets and use network ACLs to restrict inbound traffic to the app and DB tiers.

Question 5

A company wants to secure data at rest in an Amazon S3 bucket. Which TWO of the following can be used to achieve this? (Choose two.)

Accepted Answer

Enable server-side encryption (SSE-S3) on the bucket.. Server-side encryption (SSE-S3) and bucket policies that deny uploads without encryption both enforce encryption of data at rest in S3. Option A enables SSE-S3, which encrypts data automatically. Option C uses a bucket policy to require encryption on uploads, ensuring data is encrypted at rest. Option B (VPC endpoint) provides private connectivity but does not encrypt data at rest. Option D (client-side encryption) is a valid encryption method, but it is not managed by S3 and is not one of the two selected answers. Option E (Transfer Acceleration) improves transfer speed, not security.

Answer

Use an S3 VPC endpoint.

Answer

Use client-side encryption with AWS KMS.

Answer

Enable S3 Transfer Acceleration.

Question 6

A security engineer created the S3 bucket policy shown. After applying it, users from the 10.0.0.0/16 network (VPC CIDR) are able to access objects, but external users from 203.0.113.0/24 receive 'Access Denied' even though they are using HTTPS. What is the likely cause?

Accepted Answer

The VPC endpoint policy for the S3 endpoint restricts access to the bucket.. The bucket policy allows access from both the VPC CIDR (10.0.0.0/16) and the external IP range (203.0.113.0/24) when using HTTPS. However, external users are likely accessing the bucket through a VPC endpoint (e.g., Gateway Endpoint), not directly over the internet. When traffic goes through a VPC endpoint, the effective policy is the intersection of the bucket policy and the VPC endpoint policy. If the VPC endpoint policy restricts access (e.g., denies all or requires specific source VPCs), then even though the bucket policy allows the external IP, the endpoint policy denies it. This explains the 'Access Denied' for external users who are routed through the VPC endpoint. Option A correctly identifies this cause. Options B, C, and D are incorrect because the bucket policy itself is not the issue; the problem lies with the additional restriction imposed by the VPC endpoint policy.

Answer

The policy only allows 's3:GetObject' but the users are trying to list objects.

Answer

The policy does not include a 'Deny' statement for non-IP ranges.

Answer

The S3 bucket has 'Block public access' enabled, which overrides the policy.

Question 7

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet that needs to access an S3 bucket in the same region. Which approach provides the most secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 provides private connectivity to S3 without leaving the AWS network, at no additional cost. Option B is incorrect because using an Internet Gateway with a public IP would expose the instance to the internet and incur data transfer costs. Option C is incorrect because a VPN connection to on-premises adds unnecessary complexity and cost for accessing a service within the same region. Option D is incorrect because a NAT Gateway would require a public IP and incur costs, and S3 traffic would still traverse the internet; a Gateway Endpoint is more secure and cost-effective.

Answer

Use an Internet Gateway and a public IP

Answer

Set up a VPN connection to on-premises and access S3 via that

Answer

Use a NAT Gateway and route traffic through it

Question 8

A network security engineer is reviewing the NACL configuration. An EC2 instance in the subnet associated with this NACL is not receiving SSH connections from the internet. What is the issue?

Accepted Answer

The rule order is incorrect; the deny rule should have a lower rule number than the allow rule to effectively block traffic. NACL rules are evaluated in ascending order, and the first rule that matches the traffic determines the action. In this exhibit, rule 100 allows SSH traffic from 0.0.0.0/0, and rule 200 denies SSH traffic from 0.0.0.0/0. Since rule 100 is evaluated first and matches, the SSH traffic is allowed. The deny rule is never evaluated. However, the engineer likely intended to block SSH traffic, but due to the rule order, the allow rule takes precedence. To effectively block SSH, the deny rule should have a lower rule number (e.g., 100) than the allow rule (e.g., 200). This is the issue: the rule order is incorrect. The other options are not valid: Option A is not supported by the exhibit; Option B is false because protocol 6 is TCP, correct for SSH; Option D is false because port 22 is correct for SSH.

Answer

The NACL is not associated with the subnet

Answer

The protocol is incorrect; SSH uses TCP, but protocol 6 is for ICMP

Answer

The port range is incorrect; SSH uses port 22, but the rule allows port 22

Question 9

A security engineer is designing a network ACL for a public-facing web application in a VPC. The application uses an Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an RDS database in a private subnet. The engineer needs to allow HTTPS traffic from the internet to the ALB, and allow the ALB to forward traffic to the web servers on port 8080. The web servers need to query the database on port 3306. Which network ACL configuration should the engineer implement for the private subnet containing the web servers?

Accepted Answer

Inbound: allow 0.0.0.0/0 on port 8080; Outbound: allow 0.0.0.0/0 on all ports. The most correct because it allows inbound traffic on port 8080 from the internet (which is the port the ALB forwards to the web servers) and outbound traffic on all ports, enabling web servers to respond to the ALB (via ephemeral ports) and query the database on port 3306. Although allowing inbound from 0.0.0.0/0 is not as restrictive as using the ALB subnet CIDR, it is still functional since the web servers are in a private subnet with no direct internet route. Option C is incorrect because its outbound rule only allows traffic to the database subnet on port 3306, missing the required outbound rules for HTTP responses to the ALB (ALB subnet CIDR on ephemeral ports).

Answer

Inbound: allow 0.0.0.0/0 on port 3306; Outbound: allow 0.0.0.0/0 on port 8080

Answer

Inbound: allow ALB subnet CIDR on port 8080 and ephemeral ports; Outbound: allow database subnet CIDR on port 3306

Answer

Inbound: allow 0.0.0.0/0 on port 443; Outbound: allow 0.0.0.0/0 on port 3306

Question 10

A company has a requirement to encrypt all data in transit between its on-premises network and AWS over a VPN connection. Which solution provides encryption in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN uses IPsec tunnels to encrypt data in transit. Option B is wrong because Transit Gateway alone does not provide encryption. Option C is wrong because VPC Peering does not encrypt traffic. Option D is wrong because Direct Connect does not natively encrypt traffic; encryption must be added at the application layer.

Answer

AWS Transit Gateway

Answer

VPC Peering

Answer

AWS Direct Connect

Question 11

A company uses AWS Shield Advanced to protect their web application against DDoS attacks. They have configured automatic application layer DDoS mitigation with AWS WAF. During a recent attack, the application experienced increased latency, and some legitimate users were blocked. The security team reviews the WAF logs and finds that many requests from legitimate IPs were rate-limited. The team had set a rate-based rule with a threshold of 100 requests per 5 minutes. What is the most likely reason legitimate users were blocked?

Accepted Answer

The rate-based rule uses the source IP address as the aggregation key, and legitimate users behind a NAT gateway share the same public IP, causing the aggregate rate to exceed the threshold.. AWS WAF rate-based rules aggregate requests by source IP address over a specified time period. When legitimate users are behind a NAT gateway, they all share the same public IP, so their combined request rate can exceed the threshold (100 requests per 5 minutes in this case), causing the rule to block them. Option A is incorrect because the blocking duration for a rate-based rule is typically 5 minutes by default (configurable), not 24 hours. Option B is incorrect because sticky sessions on the ALB are unrelated to how WAF aggregates by source IP. Option D is incorrect because if the action were 'count' it would not block traffic, but the scenario states users were blocked, implying the action is 'block'.

Answer

The rate-based rule is set to block requests for 24 hours after the threshold is exceeded, and once triggered, all requests from that IP are blocked indefinitely.

Answer

The WAF web ACL is associated with an Application Load Balancer that is not configured for sticky sessions, causing requests from the same user to be distributed across multiple IPs.

Answer

The rate-based rule is evaluating requests before the WAF allows them, and the threshold is too low, but the rule action is set to 'count' instead of 'block', so it should not block traffic.

Question 12

A network engineer needs to block traffic from a specific IP address to an EC2 instance. Which component should be modified?

Accepted Answer

Network ACL. A Network ACL can deny inbound traffic from a specific IP address at the subnet level. Option A is wrong because route tables do not filter traffic. Option B is wrong because VPC Flow Logs only capture traffic, not filter. Option D is wrong because security groups only support allow rules, not explicit deny.

Answer

Route table

Answer

VPC Flow Logs

Answer

Security group

Question 13

A company wants to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used?

Accepted Answer

aws:SourceVpce. (aws:SourceVpce) is correct because the aws:SourceVpce condition key allows restricting requests to a specific VPC endpoint. Option A (ec2:Vpc) is wrong because ec2:Vpc is an EC2-specific condition key and not applicable to S3. Option B (aws:SourceVpc) is wrong because it restricts to a VPC, not a specific VPC endpoint. Option C (aws:SourceIp) is wrong because it restricts based on IP address, not a VPC endpoint.

Answer

ec2:Vpc

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 14

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should they use?

Accepted Answer

S3 server-side encryption and CloudTrail log file validation. S3 server-side encryption (SSE-S3 or SSE-KMS) encrypts logs at rest, and CloudTrail log file validation provides integrity verification to detect tampering. Option B (AWS KMS and CloudWatch Logs) only encrypts logs but does not provide integrity validation. Option C (S3 bucket policies and versioning) can help with access control and versioning but does not inherently encrypt logs or validate integrity. Option D (IAM roles and S3 bucket policies) manages access but does not provide encryption or tamper detection.

Answer

AWS KMS and CloudWatch Logs

Answer

S3 bucket policies and versioning

Answer

IAM roles and S3 bucket policies

Question 15

A company is deploying a web application that must be accessible over the internet from specific IP addresses only. The application runs behind an Application Load Balancer (ALB) in a VPC. Which AWS service should be used to restrict access to the ALB based on source IP addresses?

Accepted Answer

Security groups attached to the ALB. Security groups are stateful firewalls that can be attached to ALBs to allow traffic from specific IP addresses. Option B is wrong because AWS WAF is a web application firewall that inspects HTTP requests, not simply IP filtering. Option C is wrong because network ACLs are stateless and operate at the subnet level, not directly on the ALB. Option D is wrong because AWS Shield Advanced is a DDoS protection service, not for IP-based access control.

Answer

AWS WAF with IP set rules

Answer

Network ACLs on the ALB's subnets

Answer

AWS Shield Advanced

Question 16

Which TWO actions can be used to improve the security of an Amazon S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS). Options A and C are correct. Enabling S3 server-side encryption with AWS KMS (SSE-KMS) protects data at rest, and enabling S3 Block Public Access prevents public exposure of the bucket. Option B (MFA Delete) is incorrect because it protects against accidental deletion but does not improve confidentiality. Option D (S3 Versioning) is incorrect as it aids in data recovery, not security. Option E (S3 Cross-Region Replication) is incorrect because it enhances durability and availability, not security.

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Versioning

Answer

Enable S3 Cross-Region Replication

Question 17

A company wants to restrict access to an EC2 instance such that only traffic from a specific security group (sg-12345678) can reach it. The instance is in a VPC with default network ACLs. What should the security group rule for the instance be?

Accepted Answer

Inbound rule with source set to sg-12345678. Security groups allow you to reference another security group as a source. Option A is incorrect because referencing a CIDR block would allow traffic from any instance in that range, not specifically from the security group. Option C is incorrect because referencing a VPC CIDR allows traffic from any IP in that range, which is broader than the specific security group requirement. Option D is incorrect because security group rules cannot reference prefix lists as a source; they can only reference CIDR blocks, other security groups, or prefix lists for VPC endpoints.

Answer

Inbound rule with source set to the CIDR block of the VPC

Answer

Inbound rule with source set to the VPC's CIDR block

Answer

Inbound rule with source set to a prefix list that includes the security group

Question 18

A company has a VPC with a public subnet containing a NAT gateway and a private subnet with EC2 instances. The EC2 instances need to access an S3 bucket. The security team wants to log all S3 API calls made by the instances. Which approach should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and enable AWS CloudTrail to log S3 API calls. A VPC endpoint for S3 (Gateway type) allows EC2 instances in a private subnet to access S3 without going through the internet or a NAT gateway. AWS CloudTrail can be configured to log S3 API calls made via the endpoint, providing the required logging. Option A is incorrect because CloudWatch Logs on the instances capture application logs, not S3 API calls. Option B is incorrect because a proxy server adds unnecessary complexity and does not inherently log API calls. Option C is incorrect because VPC Flow Logs capture IP traffic metadata, not application-level API operations.

Answer

Enable Amazon CloudWatch Logs on the instances to capture application logs

Answer

Configure a proxy server in the public subnet and use it for S3 access

Answer

Enable VPC Flow Logs on the private subnet

Question 19

A company needs to audit all changes to security groups in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security groups. Option A is wrong because AWS Config records resource configuration changes but is not primarily for auditing API calls. Option C is wrong because Amazon CloudWatch Logs stores logs but does not capture API calls by default. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 20

A company has a VPC with an internet-facing Application Load Balancer (ALB) that routes traffic to EC2 instances in private subnets. The security team wants to block traffic from specific geographic regions. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF can be associated with an ALB to filter traffic based on geographic location. Option B is wrong because AWS Shield Advanced provides DDoS protection, not geographic filtering. Option C is wrong because Network ACLs do not support geographic blocking. Option D is wrong because Security Groups do not support geographic blocking.

Answer

AWS Shield Advanced

Answer

Network ACLs

Answer

Security Groups