ANS-C01 Network Security, Compliance and Governance Practice Test 1 — 15 Questions

Question 1

A company wants to enforce that all outbound traffic from its VPC flows through a centralized inspection VPC for security monitoring. The VPCs are connected via Transit Gateway. Which set of actions should a network engineer take to ensure that traffic from application VPCs is routed to the inspection VPC before reaching the internet?

Accepted Answer

Create a TGW route table with a blackhole route for 0.0.0.0/0 and associate it with application VPC attachments; attach the inspection VPC to a different TGW route table that has a route to the internet via an egress VPC.. Option D is correct because it uses separate Transit Gateway route tables to enforce traffic isolation: the application VPC attachments use a route table with a blackhole for 0.0.0.0/0, preventing direct internet access, while the inspection VPC uses a different route table with a route to an egress VPC that has an internet gateway. This ensures all outbound traffic from application VPCs must first traverse the inspection VPC for security monitoring before reaching the internet.

Answer

Create VPC peering connections between each application VPC and the inspection VPC, and add routes pointing to the peering connection.

Answer

Attach an internet gateway to each application VPC and add a default route pointing to the inspection VPC's NAT gateway.

Answer

Attach an internet gateway to each application VPC and add default route pointing to it.

Question 2

A security engineer is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The company requires that all VPC flow logs be delivered to a central S3 bucket in the security account. The security engineer has created a bucket policy that grants the necessary permissions. However, flow logs from member accounts are failing to be delivered. What is the most likely cause?

Accepted Answer

The bucket policy does not include a condition that restricts access to the flow log delivery service using aws:SourceArn or aws:SourceAccount.. Option B is correct because the VPC Flow Logs delivery service uses a service-linked role to write to the destination S3 bucket. Without a condition in the bucket policy that restricts access using `aws:SourceArn` or `aws:SourceAccount`, the policy is vulnerable to the confused deputy problem, where a different AWS service or account could potentially write to the bucket. The missing condition causes the delivery to fail because the service cannot verify that the request originated from the expected source.

Answer

The member accounts have not created an IAM role with permissions to write to the central bucket.

Answer

The bucket policy does not grant write access to the member accounts' root user.

Answer

The central S3 bucket has not been configured with ACLs enabled.

Question 3

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. Option B is correct because AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet for software updates. The company wants to ensure that all outbound traffic goes through a single, highly available IP address for whitelisting purposes. Which solution should be used?

Answer

Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.

Answer

Create an internet gateway and attach it to the private subnet, then configure the route table.

Answer

Create a VPC endpoint for Amazon S3 and route software update traffic through that endpoint.

Answer

Create a NAT gateway in each Availability Zone and assign the same Elastic IP to both.

Question 5

A company wants to audit all changes made to security groups and network ACLs in its AWS account. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those that modify security groups and network ACLs. By enabling CloudTrail, you can capture CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, CreateNetworkAclEntry, and similar API calls, providing an audit trail of who made the change, when, and from which IP address.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 6

A security engineer is designing a security group configuration for a web application that consists of an Application Load Balancer (ALB), Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS database. Which TWO actions should the engineer take to follow security best practices? (Choose TWO.)

Accepted Answer

Configure the EC2 instance security group to allow inbound traffic on port 443 from the ALB security group.. Option B is correct because referencing the ALB security group as the source in the EC2 security group rule ensures that only traffic originating from the ALB (and not any other source) is allowed on port 443. This follows the security best practice of using security group references instead of IP ranges, providing a tighter, more dynamic access control that automatically scales with the ALB's elastic network interfaces.

Answer

Configure the RDS security group to allow inbound traffic on port 3306 from 0.0.0.0/0.

Answer

Configure the ALB security group to allow inbound traffic on port 443 from the security group of the EC2 instances.

Answer

Configure the ALB security group to allow inbound traffic on port 80 from the security group of the EC2 instances.

Question 7

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Accepted Answer

A shared services VPC containing the security appliances.. Option A is correct because the shared services VPC hosts the centralized security appliances (e.g., firewalls, intrusion detection systems) that must inspect all inter-VPC traffic. This VPC acts as a hub for traffic inspection, ensuring that both ingress and egress traffic flows through the appliances before reaching its destination.

Answer

VPC peering connections between each spoke VPC and the shared services VPC.

Answer

NAT gateways in each spoke VPC for outbound traffic.

Question 8

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM role can be created without an approved custom trust policy. Which SCP should be attached to the root OU to enforce this requirement?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/Approved":"true"}}}]}. Option A is correct because it uses a Deny effect with a condition that only blocks IAM role creation when the request does not include a tag with key 'Approved' set to 'true'. This enforces that every new IAM role must have an approved custom trust policy by requiring the tag as a proxy for approval, while still allowing role creation when the tag is present. The SCP is attached to the root OU to apply globally across all accounts in the organization.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"arn:aws:iam::*:role/*","Condition":{"StringNotLike":{"iam:RoleName":"approved-*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:PassRole","Resource":"*"}]}

Question 9

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The security team wants to ensure that traffic between the on-premises network and the VPC is encrypted using IPSec. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN connection over the Direct Connect public virtual interface using a customer gateway and a virtual private gateway.. Option A is correct because it establishes an IPSec VPN tunnel over a Direct Connect public virtual interface (VIF), which encrypts traffic between the on-premises network and the VPC. The customer gateway and virtual private gateway create a site-to-site VPN connection that uses IPSec to secure all data traversing the Direct Connect link, meeting the encryption requirement without relying on physical-layer security.

Answer

Use a private virtual interface (VIF) on the Direct Connect connection and enable encryption at the physical layer.

Answer

Use VPC endpoints (Gateway Endpoints) for all traffic between on-premises and the VPC.

Answer

Attach the Direct Connect virtual interface to a Transit Gateway and enable multicast.

Question 10

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

Accepted Answer

Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.. A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Answer

Establish a VPN connection to AWS and route S3 traffic through the VPN.

Answer

Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.

Question 11

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer discovers that an EC2 instance was compromised via SSH. The engineer needs to identify which IAM user created the overly permissive security group rule. Which AWS service or feature should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made within the AWS environment, including the AuthorizeSecurityGroupIngress API call that created the overly permissive security group rule. By searching CloudTrail logs for this specific API event, the engineer can identify the IAM user, source IP, and timestamp of the rule creation. VPC Flow Logs, AWS Config, and GuardDuty do not capture IAM user identity for API-level changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The security team needs to centralize inspection of all traffic between VPCs using a third-party firewall appliance in a shared services VPC. What is the most scalable and highly available design?

Accepted Answer

Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.. Option B is correct because it combines AWS Transit Gateway with separate route tables per VPC and a shared inspection route table, enabling centralized traffic steering to a fleet of firewall instances behind a Gateway Load Balancer (GWLB). GWLB transparently distributes traffic across multiple firewall instances at the network layer (GENEVE protocol), providing both horizontal scalability and high availability without introducing a single point of failure or requiring complex VPC peering meshes.

Answer

Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.

Answer

Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.

Answer

Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.

Question 13

A company has a VPC with public and private subnets. The security team wants to implement a web application firewall to protect against common web exploits. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Application Load Balancer (ALB). Option A is correct because an Application Load Balancer (ALB) operates at Layer 7 and can be associated with AWS WAF to inspect HTTP/HTTPS traffic for common web exploits. AWS WAF provides a managed rule set that blocks SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Together, they form a web application firewall (WAF) solution that protects resources in the VPC's private subnets.

Answer

Network Load Balancer (NLB)

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 14

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team requires that the web tier can only be accessed from the internet, the application tier can only be accessed from the web tier, and the database tier can only be accessed from the application tier. Additionally, the team needs to ensure that no traffic can bypass these controls. Which THREE actions should the team take?

Accepted Answer

Use security group rules that reference other security groups as sources.. Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.

Answer

Enable VPC Flow Logs on all subnets and send logs to Amazon S3.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.

Question 15

An IAM policy is attached to a user. What is the effect when the user attempts to launch an EC2 instance of type m5.large?

Accepted Answer

The action is denied because the instance type does not equal t2.micro.. Option D is correct because the IAM policy explicitly allows the `ec2:RunInstances` action only when the condition `ec2:InstanceType` equals `t2.micro`. Since the user is attempting to launch an `m5.large` instance, the condition is not satisfied, and the default implicit deny applies, resulting in the action being denied.

Answer

The action is allowed because the policy allows t2.micro instances.

Answer

The action is allowed because there is no explicit allow for RunInstances.

Answer

The action is denied because the condition is not met.