ANS-C01 Network Security, Compliance and Governance Practice Test 10 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize data transfer costs and avoid exposing the private instance to inbound traffic from the internet. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and ensure the patches are hosted in S3. Route private subnet traffic to the endpoint.. Option D is correct because a VPC Gateway Endpoint for S3 allows private access to S3 for patches without NAT costs. Option A is wrong because a NAT gateway incurs costs and allows inbound traffic. Option B is wrong because a NAT instance similarly costs and allows inbound. Option C is wrong because an internet gateway would expose the instance.

Answer

Attach an internet gateway to the VPC and route the private subnet's default route to a NAT gateway in the public subnet.

Answer

Launch a NAT instance in the public subnet and route the private subnet's default route to it.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Question 2

A company wants to audit all network traffic to and from an EC2 instance for compliance. The security team needs to capture full packet contents, including headers and payload, and store them in Amazon S3 for analysis. Which AWS service should they use?

Accepted Answer

Traffic Mirroring. Option B is correct because VPC Flow Logs capture metadata, not full packets. Option A is wrong because CloudWatch Logs can capture logs but not packets. Option C is correct because Traffic Mirroring captures full packets. Option D is wrong because AWS Config records configuration changes, not traffic.

Answer

Amazon CloudWatch Logs with the EC2 agent

Answer

AWS Config

Answer

VPC Flow Logs

Question 3

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block a list of known malicious IP addresses from accessing the application. Which service should they use to implement this protection?

Accepted Answer

AWS WAF with an IP set rule that blocks the malicious IPs. Option A is correct because AWS WAF with IP set rules can block malicious IPs. Option B is wrong because Shield Advanced provides DDoS protection, not IP blocking. Option C is wrong because Network ACLs are stateless and less efficient for this use case. Option D is wrong because Security Groups are stateful but not designed for IP blocking at the ALB level.

Answer

Network ACLs on the ALB subnet with deny rules

Answer

AWS Shield Advanced with automatic IP blocking

Answer

Security Groups for the ALB with deny rules

Question 4

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team notices that the BGP session between the on-premises router and the AWS virtual private gateway (VGW) is flapping. The on-premises router is configured to advertise a specific prefix. Which configuration change is MOST likely to stabilize the BGP session?

Accepted Answer

Adjust BGP timers (keepalive and hold time) to match between the on-premises router and the VGW.. Option C is correct because BGP timers mismatch can cause flapping; adjusting them to match stabilizes the session. Option A is wrong because MD5 authentication is for security, not flapping. Option B is wrong because ASN prepending affects route selection, not stability. Option D is wrong because VGW does not support route-maps.

Answer

Add ASN prepending to the advertised prefix.

Answer

Enable BGP MD5 authentication on both sides.

Answer

Apply a route-map on the VGW to filter the prefix.

Question 5

A security engineer needs to ensure that all traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the engineer do to meet this requirement?

Accepted Answer

No additional configuration needed; VPC peering traffic is automatically encrypted.. Option A is correct because VPC peering traffic is already encrypted automatically. Option B is wrong because VPN is not needed. Option C is wrong because Transit Gateway does not add encryption beyond what VPC peering provides. Option D is wrong because NACLs do not encrypt traffic.

Answer

Set up a VPN connection between the two VPCs and route traffic through it.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Transit Gateway to connect the VPCs and enable encryption.

Question 6

A network engineer is troubleshooting connectivity issues between an EC2 instance and an RDS database in the same VPC. The EC2 instance can connect to the database, but the connection is slow. Which TWO actions should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.. Options A and B are correct. Checking security group rules (A) ensures proper allow rules. Reviewing VPC Flow Logs (B) can reveal dropped packets or latency. Option C is wrong because NACLs are stateless and may drop return traffic. Option D is wrong because the default route is not relevant to internal traffic. Option E is wrong because route propagation is for VPN/Direct Connect.

Answer

Verify the route table for the database subnet to ensure there is a default route to the internet.

Answer

Check the network ACL for the database subnet to ensure it is stateful.

Answer

Check the route propagation settings on the VPC.

Question 7

A company is designing a multi-account architecture using AWS Organizations. They want to centrally manage and enforce network security policies across all accounts. Which THREE services or features should they use together to achieve this? (Choose THREE.)

Accepted Answer

AWS Network Firewall. Options A, C, and D are correct. AWS Firewall Manager (A) centrally manages firewall rules. AWS Network Firewall (C) provides stateful inspection. Service Control Policies (D) enforce guardrails. Option B is wrong because AWS Config is for compliance monitoring, not enforcement. Option E is wrong because Security Groups are per-resource.

Answer

Security Groups

Answer

AWS Config

Question 8

A security engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. The engineer wants to capture full packets and store them for later analysis. Which TWO AWS services can be used together to accomplish this? (Choose TWO.)

Accepted Answer

Amazon S3. Options A and C are correct. Traffic Mirroring (A) captures full packets and sends them to a target. Amazon S3 (C) can store the captured traffic. Option B is wrong because VPC Flow Logs capture metadata only. Option D is wrong because CloudWatch Logs is not designed for packet storage. Option E is wrong because AWS Config does not capture traffic.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 9

A company wants to restrict access to an S3 bucket so that only objects with server-side encryption using AWS KMS (SSE-KMS) can be uploaded. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. Option B is correct because the s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce a specific KMS key ID. Option A is wrong because s3:x-amz-server-side-encryption checks for AES256 or aws:kms but does not enforce a specific key. Option C is wrong because kms:ViaService is a KMS condition, not an S3 condition. Option D is wrong because aws:SourceVpce restricts VPC endpoint, not encryption.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

aws:SourceVpce

Question 10

A security engineer is designing a network firewall solution for a VPC with multiple subnets. The solution must inspect traffic between instances in the same VPC, including traffic within the same subnet. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. Option A is correct because AWS Network Firewall can inspect traffic between subnets and within a subnet when deployed in a VPC. Option B is wrong because AWS WAF is for web application layer 7 inspection, not for general network traffic. Option C is wrong because Security Groups are stateless and cannot perform deep packet inspection. Option D is wrong because VPC Flow Logs only capture metadata, not inspect packets.

Answer

Security Groups

Answer

VPC Flow Logs

Answer

AWS WAF

Question 11

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have block public access enabled. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) that denies bucket creation without block public access.. Option C is correct because a service control policy (SCP) can deny the s3:PutBucketPublicAccessBlock action or enforce the block public access settings. Option A is wrong because IAM roles in each account would require manual management. Option B is wrong because CloudTrail only logs, does not enforce. Option D is wrong because AWS Config can detect noncompliance but not enforce automatically in real-time.

Answer

Use AWS CloudTrail to monitor bucket creation and alert.

Answer

Use AWS Config rules to detect and remediate noncompliant buckets.

Answer

Create an IAM role in each account that restricts bucket permissions.

Question 12

A company has a requirement to encrypt all data in transit between its on-premises network and AWS over a VPN connection. Which solution provides encryption in transit?

Accepted Answer

AWS Site-to-Site VPN. Option A is correct because AWS Site-to-Site VPN uses IPsec tunnels to encrypt data in transit. Option B is wrong because Direct Connect does not natively encrypt traffic; encryption must be added at the application layer. Option C is wrong because VPC Peering does not encrypt traffic. Option D is wrong because Transit Gateway alone does not provide encryption.

Answer

AWS Transit Gateway

Answer

VPC Peering

Answer

AWS Direct Connect

Question 13

A security engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option C is correct because a VPC Gateway Endpoint for S3 allows private connectivity. Option A is wrong because a NAT gateway would route traffic over the internet. Option B is wrong because an Internet Gateway would expose the instance. Option D is wrong because Direct Connect is for on-premises connectivity, not for EC2 to S3.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use AWS Direct Connect to connect to S3.

Answer

Deploy a NAT gateway in a public subnet and update the route table.

Question 14

A company uses AWS CloudFormation to deploy resources. The security team wants to ensure that no IAM user can modify the stack set if they are not authorized via a specific IAM policy. Which feature should be used?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Option D is correct because a service control policy (SCP) can be used to deny CloudFormation actions at the organization level. Option A is wrong because stack policies protect resources within a stack, not who can update the stack. Option B is wrong because IAM policies are account-specific and can be overridden by administrators. Option C is wrong because AWS Config does not prevent modifications.

Answer

AWS Config rule with remediation

Answer

CloudFormation stack policy

Answer

IAM permissions boundary

Question 15

A company wants to centrally manage and enforce security rules for all VPCs in a multi-account environment. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization. It allows you to enforce a common set of security policies, such as AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules, ensuring consistent governance across all VPCs in the multi-account environment.

Answer

Amazon GuardDuty

Answer

AWS Shield

Answer

AWS WAF