ANS-C01 Network Security, Compliance and Governance — 20 Questions

Question 1

A company wants to enforce that all outbound traffic from its VPC flows through a centralized inspection VPC for security monitoring. The VPCs are connected via Transit Gateway. Which set of actions should a network engineer take to ensure that traffic from application VPCs is routed to the inspection VPC before reaching the internet?

Accepted Answer

Create a TGW route table with a blackhole route for 0.0.0.0/0 and associate it with application VPC attachments; attach the inspection VPC to a different TGW route table that has a route to the internet via an egress VPC.. Option D is correct because it uses separate Transit Gateway route tables to enforce traffic isolation: the application VPC attachments use a route table with a blackhole for 0.0.0.0/0, preventing direct internet access, while the inspection VPC uses a different route table with a route to an egress VPC that has an internet gateway. This ensures all outbound traffic from application VPCs must first traverse the inspection VPC for security monitoring before reaching the internet.

Answer

Create VPC peering connections between each application VPC and the inspection VPC, and add routes pointing to the peering connection.

Answer

Attach an internet gateway to each application VPC and add a default route pointing to the inspection VPC's NAT gateway.

Answer

Attach an internet gateway to each application VPC and add default route pointing to it.

Question 2

A security engineer is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The company requires that all VPC flow logs be delivered to a central S3 bucket in the security account. The security engineer has created a bucket policy that grants the necessary permissions. However, flow logs from member accounts are failing to be delivered. What is the most likely cause?

Accepted Answer

The bucket policy does not include a condition that restricts access to the flow log delivery service using aws:SourceArn or aws:SourceAccount.. Option B is correct because the VPC Flow Logs delivery service uses a service-linked role to write to the destination S3 bucket. Without a condition in the bucket policy that restricts access using `aws:SourceArn` or `aws:SourceAccount`, the policy is vulnerable to the confused deputy problem, where a different AWS service or account could potentially write to the bucket. The missing condition causes the delivery to fail because the service cannot verify that the request originated from the expected source.

Answer

The member accounts have not created an IAM role with permissions to write to the central bucket.

Answer

The bucket policy does not grant write access to the member accounts' root user.

Answer

The central S3 bucket has not been configured with ACLs enabled.

Question 3

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. Option B is correct because AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet for software updates. The company wants to ensure that all outbound traffic goes through a single, highly available IP address for whitelisting purposes. Which solution should be used?

Answer

Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.

Answer

Create an internet gateway and attach it to the private subnet, then configure the route table.

Answer

Create a VPC endpoint for Amazon S3 and route software update traffic through that endpoint.

Answer

Create a NAT gateway in each Availability Zone and assign the same Elastic IP to both.

Question 5

A company wants to audit all changes made to security groups and network ACLs in its AWS account. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those that modify security groups and network ACLs. By enabling CloudTrail, you can capture CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, CreateNetworkAclEntry, and similar API calls, providing an audit trail of who made the change, when, and from which IP address.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 6

A security engineer is designing a security group configuration for a web application that consists of an Application Load Balancer (ALB), Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS database. Which TWO actions should the engineer take to follow security best practices? (Choose TWO.)

Accepted Answer

Configure the EC2 instance security group to allow inbound traffic on port 443 from the ALB security group.. Option B is correct because referencing the ALB security group as the source in the EC2 security group rule ensures that only traffic originating from the ALB (and not any other source) is allowed on port 443. This follows the security best practice of using security group references instead of IP ranges, providing a tighter, more dynamic access control that automatically scales with the ALB's elastic network interfaces.

Answer

Configure the RDS security group to allow inbound traffic on port 3306 from 0.0.0.0/0.

Answer

Configure the ALB security group to allow inbound traffic on port 443 from the security group of the EC2 instances.

Answer

Configure the ALB security group to allow inbound traffic on port 80 from the security group of the EC2 instances.

Question 7

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Accepted Answer

A shared services VPC containing the security appliances.. Option A is correct because the shared services VPC hosts the centralized security appliances (e.g., firewalls, intrusion detection systems) that must inspect all inter-VPC traffic. This VPC acts as a hub for traffic inspection, ensuring that both ingress and egress traffic flows through the appliances before reaching its destination.

Answer

VPC peering connections between each spoke VPC and the shared services VPC.

Answer

NAT gateways in each spoke VPC for outbound traffic.

Question 8

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM role can be created without an approved custom trust policy. Which SCP should be attached to the root OU to enforce this requirement?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/Approved":"true"}}}]}. Option A is correct because it uses a Deny effect with a condition that only blocks IAM role creation when the request does not include a tag with key 'Approved' set to 'true'. This enforces that every new IAM role must have an approved custom trust policy by requiring the tag as a proxy for approval, while still allowing role creation when the tag is present. The SCP is attached to the root OU to apply globally across all accounts in the organization.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"arn:aws:iam::*:role/*","Condition":{"StringNotLike":{"iam:RoleName":"approved-*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:PassRole","Resource":"*"}]}

Question 9

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The security team wants to ensure that traffic between the on-premises network and the VPC is encrypted using IPSec. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN connection over the Direct Connect public virtual interface using a customer gateway and a virtual private gateway.. Option A is correct because it establishes an IPSec VPN tunnel over a Direct Connect public virtual interface (VIF), which encrypts traffic between the on-premises network and the VPC. The customer gateway and virtual private gateway create a site-to-site VPN connection that uses IPSec to secure all data traversing the Direct Connect link, meeting the encryption requirement without relying on physical-layer security.

Answer

Use a private virtual interface (VIF) on the Direct Connect connection and enable encryption at the physical layer.

Answer

Use VPC endpoints (Gateway Endpoints) for all traffic between on-premises and the VPC.

Answer

Attach the Direct Connect virtual interface to a Transit Gateway and enable multicast.

Question 10

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

Accepted Answer

Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.. A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Answer

Establish a VPN connection to AWS and route S3 traffic through the VPN.

Answer

Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.

Question 11

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer discovers that an EC2 instance was compromised via SSH. The engineer needs to identify which IAM user created the overly permissive security group rule. Which AWS service or feature should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made within the AWS environment, including the AuthorizeSecurityGroupIngress API call that created the overly permissive security group rule. By searching CloudTrail logs for this specific API event, the engineer can identify the IAM user, source IP, and timestamp of the rule creation. VPC Flow Logs, AWS Config, and GuardDuty do not capture IAM user identity for API-level changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The security team needs to centralize inspection of all traffic between VPCs using a third-party firewall appliance in a shared services VPC. What is the most scalable and highly available design?

Accepted Answer

Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.. Option B is correct because it combines AWS Transit Gateway with separate route tables per VPC and a shared inspection route table, enabling centralized traffic steering to a fleet of firewall instances behind a Gateway Load Balancer (GWLB). GWLB transparently distributes traffic across multiple firewall instances at the network layer (GENEVE protocol), providing both horizontal scalability and high availability without introducing a single point of failure or requiring complex VPC peering meshes.

Answer

Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.

Answer

Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.

Answer

Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.

Question 13

A company has a VPC with public and private subnets. The security team wants to implement a web application firewall to protect against common web exploits. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Application Load Balancer (ALB). Option A is correct because an Application Load Balancer (ALB) operates at Layer 7 and can be associated with AWS WAF to inspect HTTP/HTTPS traffic for common web exploits. AWS WAF provides a managed rule set that blocks SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Together, they form a web application firewall (WAF) solution that protects resources in the VPC's private subnets.

Answer

Network Load Balancer (NLB)

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 14

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team requires that the web tier can only be accessed from the internet, the application tier can only be accessed from the web tier, and the database tier can only be accessed from the application tier. Additionally, the team needs to ensure that no traffic can bypass these controls. Which THREE actions should the team take?

Accepted Answer

Use security group rules that reference other security groups as sources.. Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.

Answer

Enable VPC Flow Logs on all subnets and send logs to Amazon S3.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.

Question 15

An IAM policy is attached to a user. What is the effect when the user attempts to launch an EC2 instance of type m5.large?

Accepted Answer

The action is denied because the instance type does not equal t2.micro.. Option D is correct because the IAM policy explicitly allows the `ec2:RunInstances` action only when the condition `ec2:InstanceType` equals `t2.micro`. Since the user is attempting to launch an `m5.large` instance, the condition is not satisfied, and the default implicit deny applies, resulting in the action being denied.

Answer

The action is allowed because the policy allows t2.micro instances.

Answer

The action is allowed because there is no explicit allow for RunInstances.

Answer

The action is denied because the condition is not met.

Question 16

A security engineer runs tcpdump on an EC2 instance (10.0.1.5) and sees the output above. The instance is in a private subnet with a security group that allows inbound HTTPS from 0.0.0.0/0. The instance is behind a Network Load Balancer (NLB) that has a public IP. The engineer is unable to establish an HTTPS connection from the internet. What is the most likely cause?

Accepted Answer

The NLB's target group health checks are failing, causing the NLB to consider the instance unhealthy.. The tcpdump output shows the NLB's health check traffic (SYN packets from the NLB's private IPs) reaching the instance, but the engineer cannot establish an HTTPS connection from the internet. If the target group health checks are failing, the NLB marks the instance as unhealthy and stops forwarding traffic to it, which would prevent any internet HTTPS connections from reaching the instance. This is the most likely cause because the security group allows inbound HTTPS from 0.0.0.0/0, and the NLB does not preserve source IP by default, so the security group is not blocking traffic from the internet.

Answer

The NLB is not preserving the source IP, so the security group is blocking the traffic.

Answer

The instance's operating system firewall is blocking the connection.

Answer

The security group is blocking inbound traffic from the NLB.

Question 17

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from a specific AWS Client VPN endpoint. The security team has configured the ALB security group to allow inbound traffic from the Client VPN CIDR range, but users report that they can still access the application from outside the VPN. What is the MOST likely cause of this issue?

Accepted Answer

The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.. Option A is correct because the ALB security group is configured to allow inbound traffic from the Client VPN CIDR range, but if the ALB itself is internet-facing (i.e., it has public IP addresses and is deployed in public subnets), traffic can bypass the security group rules if the security group is not actually applied to the ALB's network interfaces. The most likely cause is that the ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet, meaning the security group rules are not being enforced on the ALB's listener. This allows users outside the VPN to access the application because the ALB accepts traffic from any source unless the security group explicitly restricts it.

Answer

The network ACL is stateless and requires separate inbound and outbound rules for return traffic.

Answer

The subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0.

Answer

The EC2 instances' security group allows inbound traffic from 0.0.0.0/0.

Question 18

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?

Accepted Answer

Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.. Option A is correct because it uses separate Transit Gateway route tables to isolate the inspection VPC and other VPCs. By configuring the route table for VPC A to point to VPC B's CIDR via the inspection VPC attachment, all inter-VPC traffic is forced through the centralized firewall appliances. This leverages Transit Gateway's ability to route traffic between attachments based on route table associations and propagations, ensuring traffic flows through the inspection VPC without requiring VPC peering or additional per-VPC firewalls.

Answer

Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.

Answer

Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.

Question 19

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. The bucket policy should deny requests that do not originate from the VPC. Which condition key should be used in the bucket policy?

Accepted Answer

aws:SourceVpc. The correct condition key is `aws:SourceVpc`, which allows you to restrict access to an S3 bucket based on the VPC from which the request originates. When used in a bucket policy with a Deny effect, it ensures that only requests coming from the specified VPC ID are allowed, and all other requests are denied. This key is specifically designed for VPC-based access control in S3 bucket policies.

Answer

aws:VpcSourceIp

Answer

aws:Referer

Answer

aws:SourceIp

Question 20

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The security team needs to centrally manage and enforce network security policies across all accounts. Which TWO services or features can be used to centrally enforce network security controls? (Choose TWO.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides stateful, application-layer filtering and intrusion prevention for VPCs. It can be centrally deployed and managed across multiple accounts using AWS Firewall Manager, enabling consistent enforcement of network security policies at scale.

Answer

Network ACLs

Answer

VPC Flow Logs

Answer

VPC security groups with cross-account references