ANS-C01 Network Security, Compliance and Governance Practice Test 10 — 15 Questions

Question 1

A company uses an AWS Network Firewall to inspect traffic between VPCs and the internet. They want to allow outbound HTTPS traffic only to specific domains. Which rule configuration should be used?

Accepted Answer

Create a stateful rule group with a 'pass' action for the allowed domains using domain list rule group.. Domain list rule group in AWS Network Firewall can match FQDNs. Stateful rule groups inspect traffic states. Suricata compatible rules allow custom domain matching. IP set would match by IP, not domain.

Answer

Create a stateless rule group with a 'forward' action for the allowed IP addresses.

Answer

Create a stateful rule group with a 'drop' action for all traffic and then 'pass' for the allowed domains using Suricata compatible rules.

Answer

Create an IP set rule group with the allowed domain IP addresses.

Question 2

A security engineer is designing a network security architecture for a hybrid cloud environment. The company has an AWS Direct Connect connection to its on-premises data center. They want to ensure that all traffic between on-premises and AWS is encrypted and that the encryption is enforced at the network layer. Which TWO solutions should the engineer consider?

Accepted Answer

Enable MACsec on the Direct Connect dedicated connection.. Option A is correct because MACsec (IEEE 802.1AE) on an AWS Direct Connect dedicated connection provides hop-by-hop encryption at Layer 2 between the customer router and the AWS Direct Connect endpoint, satisfying the requirement for network-layer encryption over the dedicated link. Option D is correct because running an IPsec VPN over the Direct Connect virtual interface encrypts traffic at Layer 3 end-to-end between on-premises and AWS, which is a standard AWS pattern for enforcing encryption over Direct Connect. Option B is not appropriate because an SSL VPN typically operates at the application/session layer and is not the AWS-recommended mechanism for site-to-site network-layer encryption over Direct Connect. Option C is incorrect because VPC Peering connects VPCs to each other and does not extend on-premises connectivity or provide encryption. Option E is incorrect because TLS at the application layer does not enforce encryption at the network layer as required.

Answer

Set up an SSL VPN between on-premises and AWS.

Answer

Use VPC Peering to connect on-premises to AWS.

Answer

Use TLS encryption at the application layer.

Question 3

A company has a security requirement to log and monitor all DNS queries made by EC2 instances in a VPC. Which TWO AWS solutions can meet this requirement?

Accepted Answer

Enable Amazon Route 53 Resolver Query Logging.. Option A is correct because Amazon Route 53 Resolver Query Logging captures DNS queries made by resources in a VPC, including EC2 instances, and publishes them to CloudWatch Logs, S3, or Kinesis Data Firehose for monitoring. Option C is correct because Route 53 Resolver DNS Firewall logs DNS queries and can send them to CloudWatch Logs, S3, or Kinesis Data Firehose, while also allowing filtering; its logging capability satisfies the requirement to log and monitor DNS queries. Option B is not correct because AWS CloudTrail records API activity and management events, not the DNS queries generated by EC2 instances. Option D is not correct because a custom CloudWatch Logs agent does not natively capture DNS query data from the VPC resolver. Option E is not correct because VPC Flow Logs capture IP traffic metadata for network interfaces, not DNS query names or resolver-level DNS activity.

Answer

Use AWS CloudTrail to log DNS queries.

Answer

Use Amazon CloudWatch Logs with a custom agent to capture DNS logs.

Answer

Enable VPC Flow Logs.

Question 4

A company wants to protect its web application running on Amazon EC2 behind an Application Load Balancer (ALB) from common web exploits like SQL injection and cross-site scripting (XSS). Which THREE AWS services should be used together to provide comprehensive protection?

Accepted Answer

AWS WAF. AWS WAF (A) is correct because it is the service that inspects HTTP/HTTPS requests and applies web ACL rules to block common web exploits such as SQL injection and cross-site scripting (XSS) at the ALB. AWS Shield (C) is correct because it provides managed protection against Distributed Denial of Service (DDoS) attacks, with Shield Advanced offering enhanced mitigation and 24/7 access to the AWS DDoS Response Team, complementing WAF's application-layer filtering. The Application Load Balancer (E) is correct because it is the Layer 7 entry point that integrates with AWS WAF, allowing WAF web ACLs to be associated directly with the ALB so malicious requests are filtered before reaching the EC2 instances. Amazon Route 53 (B) is not correct because it is a DNS service and does not inspect or filter web request payloads for SQLi or XSS. Amazon CloudFront (D) is not correct in this scenario because, while it can be associated with AWS WAF, the question specifies the application runs behind an ALB and asks for the three services used together for this protection, making CloudFront unnecessary here.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Question 5

A security engineer reviews the CloudTrail log entry above. What security concern does this event raise?

Accepted Answer

The root user is being used to perform administrative actions.. The CloudTrail log entry shows that the root user performed an administrative action (e.g., creating a security group). Using the root account for day-to-day operations is a security best practice violation because the root user has unrestricted access and cannot be limited by IAM policies. This increases the risk of accidental or malicious changes and makes it harder to audit actions.

Answer

The security group was created with a permissive name.

Answer

The event took place in a region that is not used by the company.

Answer

The event originated from an external IP address.

Question 6

A security engineer reviews the NACL entries above for a subnet. Which statement about incoming SSH traffic (port 22) is correct?

Accepted Answer

SSH traffic is allowed from all IP addresses.. NACLs are stateless and rules are evaluated in order by rule number. Rule 100 allows SSH from all IPs. Rule 200 denies SSH from all IPs, but it is not evaluated because rule 100 already allowed. Rule 300 allows SSH from 10.0.0.0/8 but is not reached. Since rule 100 allows all, SSH is allowed from all IPs. Therefore, option B is correct.

Answer

SSH traffic is allowed only from the 10.0.0.0/8 range.

Answer

SSH traffic is allowed from 10.0.0.0/8 and denied from all others.

Answer

SSH traffic is denied from all IP addresses.

Question 7

A security engineer is configuring Network Access Control Lists (NACLs) for a VPC with multiple subnets. The engineer wants to block SSH access (port 22) from a specific IP range 10.0.0.0/8 to the entire VPC CIDR (172.16.0.0/16). What is the most effective approach?

Accepted Answer

Add inbound and outbound NACL rules denying SSH from 10.0.0.0/8. NACLs are stateless and operate at the subnet boundary, so to effectively block SSH bidirectionally you must add both inbound rules (to block incoming SSH from 10.0.0.0/8) and outbound rules (to block return traffic to 10.0.0.0/8). Because NACLs evaluate rules in numbered order and support explicit DENY, this is the correct mechanism for blocking a CIDR range across an entire VPC. Security groups cannot deny traffic, only allow it.

Answer

Add a security group rule to deny inbound SSH from 10.0.0.0/8

Answer

Add an inbound NACL rule denying SSH from 10.0.0.0/8

Answer

Add an outbound security group rule denying SSH to 10.0.0.0/8

Question 8

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They require that the encryption keys are managed by AWS and rotated automatically. Which encryption option should they choose?

Accepted Answer

SSE-S3. SSE-S3 uses AES-256 encryption with keys fully managed by AWS, and AWS automatically rotates the underlying keys without any customer action. This matches the requirement that keys be AWS-managed and rotated automatically. SSE-KMS also provides server-side encryption, but key rotation is customer-configured (via KMS rotation settings) and keys live in KMS, so it doesn't strictly satisfy 'managed by AWS and rotated automatically' as cleanly as SSE-S3.

Answer

SSE-C

Answer

Client-side encryption

Answer

SSE-KMS

Question 9

A company has a VPC with a VPN connection to an on-premises data center. They want to ensure that traffic between the VPC and on-premises is encrypted and authenticated. Which two components are required to establish the VPN tunnel?

Accepted Answer

Virtual Private Gateway and Customer Gateway. A Virtual Private Gateway (VPG) is the AWS-side endpoint, and a Customer Gateway (CGW) represents the on-premises router. Option A (Internet Gateway) is for internet traffic. Option C (Direct Connect) is a different service. Option D (Transit Gateway) is optional.

Answer

AWS Direct Connect and Direct Connect Gateway

Answer

Internet Gateway and NAT Gateway

Answer

Transit Gateway and VPN Attachment

Question 10

A company wants to securely store secrets such as database credentials and API keys. Which TWO AWS services can be used for this purpose? (Choose two.)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (A) is correct because it provides a centralized, hierarchical store for configuration data and secrets, supporting SecureString parameters that are encrypted with AWS KMS, which is exactly designed for holding database credentials and API keys. AWS Secrets Manager (D) is correct because it is purpose-built for storing, rotating, and retrieving secrets such as database credentials and API keys, with native KMS encryption and automatic rotation via Lambda. Amazon S3 (B) is not a secrets-management service; it stores objects and would require custom encryption and access controls rather than providing managed secret storage or rotation. AWS CloudFormation (C) is an infrastructure-as-code provisioning service, not a secret store, and AWS IAM (E) manages identities, policies, and permissions rather than storing secret values.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS Identity and Access Management (IAM)

Question 11

Which TWO statements about AWS Key Management Service (KMS) are correct? (Choose two.)

Accepted Answer

Customer master keys (CMKs) can be automatically rotated every year.. Option A is correct because AWS KMS supports automatic annual rotation of customer master keys (CMKs) with a rotation period of one year, configurable via the console or the enable-key-rotation API. Option D is correct because AWS KMS is a regional service: keys, policies, and grants are scoped to a single AWS Region, and keys must be used in the Region where they were created (or via multi-Region keys). Option B is incorrect because KMS supports both symmetric keys (AES-256-GCM) and asymmetric key pairs (RSA and ECC) for encryption, signing, and verification. Option C is incorrect because KMS does not store customer data; it only stores and manages key material and performs cryptographic operations. Option E is incorrect because KMS does support importing your own key material into a CMK using the ImportKeyMaterial API.

Answer

KMS uses symmetric encryption only.

Answer

KMS can store encrypted data.

Answer

You cannot import your own key material into KMS.

Question 12

A company is deploying a web application that must be accessible over the internet from specific IP addresses only. The application runs behind an Application Load Balancer (ALB) in a VPC. Which AWS service should be used to restrict access to the ALB based on source IP addresses?

Accepted Answer

Security groups attached to the ALB. Security groups are stateful firewalls that can be attached to ALBs to allow traffic from specific IP addresses. Option B is wrong because AWS WAF is a web application firewall that inspects HTTP requests, not simply IP filtering. Option C is wrong because network ACLs are stateless and operate at the subnet level, not directly on the ALB. Option D is wrong because AWS Shield Advanced is a DDoS protection service, not for IP-based access control.

Answer

AWS WAF with IP set rules

Answer

Network ACLs on the ALB's subnets

Answer

AWS Shield Advanced

Question 13

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that all outbound traffic is logged and that only specific destinations are allowed. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in a public subnet and enable VPC Flow Logs. A NAT gateway in a public subnet allows private-subnet instances to reach the internet while remaining unreachable inbound, and VPC Flow Logs capture all traffic metadata for auditing. Together they satisfy both the outbound-only requirement and the logging requirement. Restricting destinations can be layered with security groups or NACLs on the NAT path.

Answer

Deploy a proxy server in a public subnet and configure the EC2 instance to use it

Answer

Deploy a NAT instance in a public subnet and enable VPC Flow Logs

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance

Question 14

A security engineer is designing a network architecture for a multi-account AWS environment using AWS Organizations. The company requires that all inter-VPC traffic be inspected by a centralized firewall appliance. Which solution provides the most scalable and maintainable inspection architecture?

Accepted Answer

Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall. Using a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall provides a scalable and maintainable architecture. Transit Gateway allows all VPCs to connect through a central hub, and AWS Network Firewall provides managed, scalable deep packet inspection. Option B is incorrect because VPC peering does not scale well and requires complex routing. Option C is incorrect because Network ACLs are stateless and cannot perform deep packet inspection. Option D is incorrect because third-party firewall appliances in a single VPC can become a bottleneck and are less scalable than the managed AWS Network Firewall solution.

Answer

Create VPC peering connections between all VPCs and route traffic through a security VPC with a firewall

Answer

Use Network ACLs in each VPC to filter traffic between subnets

Answer

Use a Transit Gateway and attach all VPCs to a centralized inspection VPC that hosts a third-party firewall

Question 15

Which TWO actions can be used to improve the security of an Amazon S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS). Options A and C are correct. Enabling S3 server-side encryption with AWS KMS (SSE-KMS) protects data at rest, and enabling S3 Block Public Access prevents public exposure of the bucket. Option B (MFA Delete) is incorrect because it protects against accidental deletion but does not improve confidentiality. Option D (S3 Versioning) is incorrect as it aids in data recovery, not security. Option E (S3 Cross-Region Replication) is incorrect because it enhances durability and availability, not security.

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Versioning

Answer

Enable S3 Cross-Region Replication