ANS-C01 Network Security, Compliance and Governance Practice Test 10 — 15 Questions

Question 1

A security engineer notices that a security group allows inbound SSH from 0.0.0.0/0. Which immediate action should be taken to reduce risk?

Accepted Answer

Modify the security group inbound rule to allow SSH only from the company's public IP range. The immediate action is to modify the security group inbound rule to restrict SSH access to only the company's public IP range (Option A). This reduces the attack surface by limiting exposure to trusted IPs. Option B is incorrect because adding a network ACL deny rule is not as effective since NACLs are stateless and the security group still allows inbound SSH from anywhere; also, NACLs operate at the subnet level and do not override security group rules for inbound traffic within the VPC. Option C is incorrect because moving instances to a different subnet is disruptive and does not address the current security group rule. Option D is incorrect because deleting the security group may affect running instances and is not the simplest immediate action.

Answer

Add a network ACL deny rule for SSH from 0.0.0.0/0

Answer

Move the instances to a different subnet with a restrictive NACL

Answer

Delete the security group and create a new one with the correct rules

Question 2

A company uses AWS Direct Connect to connect its on-premises network to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which solution should be used?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect link. An IPsec VPN tunnel over Direct Connect encrypts all traffic traversing the link, providing encryption while maintaining low latency. Option A is wrong because Direct Connect does not natively encrypt data; encryption must be added separately. Option B is wrong because TLS only protects application-layer traffic, not all traffic at the network level. Option D is wrong because VPC endpoints only protect traffic to specific AWS services, not all traffic across the Direct Connect link.

Answer

Enable encryption on the Direct Connect virtual interface

Answer

Use TLS on all applications that communicate across the link

Answer

Use VPC endpoints for all AWS services accessed

Question 3

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution meets this requirement?

Accepted Answer

Create a VPC gateway endpoint for S3 and attach an endpoint policy that restricts access to the specific bucket. A VPC gateway endpoint for S3 allows private subnet instances to access S3 without traversing the internet. Option B is wrong because a VPN connection is used to connect to on-premises networks, not to access S3 privately. Option C is wrong because a NAT gateway still routes traffic through the internet. Option D is wrong because a proxy server also introduces internet connectivity.

Answer

Establish a VPN connection to the on-premises network and route through it

Answer

Set up a NAT gateway in the public subnet and route private subnet traffic to it

Answer

Deploy a proxy server in the public subnet and configure the instance to use it

Question 4

Which AWS service can be used to centrally manage and enforce security group rules across multiple accounts in AWS Organizations?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager (Option B) is the correct answer because it provides centralized management of security group rules across accounts in AWS Organizations, allowing you to enforce a common set of security rules. Option A (IAM) manages user permissions, not security groups. Option C (AWS Config) evaluates resource compliance but does not enforce rules. Option D (AWS Shield Advanced) is a DDoS protection service.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Config

Answer

AWS Shield Advanced

Question 5

A company is designing a multi-VPC architecture with VPC peering. They need to ensure that traffic between VPCs is encrypted. What should they do?

Accepted Answer

Use a third-party VPN appliance in each VPC to create an IPsec tunnel between them. VPC peering does not encrypt traffic natively. To ensure encryption between VPCs, you need to establish an IPsec tunnel, which can be achieved by deploying a third-party VPN appliance in each VPC. Option B is incorrect because a VPN connection using virtual private gateways is typically used to connect a VPC to an on-premises network, not directly between VPCs. Option C is incorrect because VPC peering does not support enabling encryption on the peering connection itself; encryption must be added via an overlay. Option D is incorrect because AWS Direct Connect is used for dedicated connections to on-premises data centers, not for inter-VPC traffic.

Answer

Establish a VPN connection between the VPCs using virtual private gateways

Answer

Enable encryption on the VPC peering connection

Answer

Use AWS Direct Connect to connect the VPCs

Question 6

A security engineer is troubleshooting connectivity issues. An EC2 instance cannot access the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in a public subnet with an Elastic IP. The security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The network ACL in the public subnet is blocking inbound traffic to the NAT gateway. The network ACL in the public subnet must allow inbound traffic from the internet to the NAT gateway's Elastic IP. Option B is wrong because the route table in the private subnet is correct. Option C is wrong because the NAT gateway's security group is not a thing; it uses security groups for instances. Option D is wrong because the internet gateway is required and assumed attached.

Answer

The NAT gateway does not have a security group allowing outbound traffic

Answer

The internet gateway is not attached to the VPC

Answer

The route table in the private subnet has no route to the NAT gateway

Question 7

A company wants to use AWS Certificate Manager (ACM) to provide a TLS certificate for a website hosted on an ALB. The domain is example.com, and the certificate must be renewed automatically. Which type of certificate should be requested?

Accepted Answer

A public certificate issued by ACM with DNS validation. ACM automatically renews public certificates if DNS validation is used. Option A is incorrect because private certificates issued by ACM Private CA are not trusted by public browsers. Option B is incorrect because self-signed certificates are not trusted by browsers and must be manually renewed. Option C is incorrect because imported certificates from third-party CAs must be manually renewed.

Answer

A private certificate issued by ACM Private CA

Answer

A self-signed certificate generated with OpenSSL

Answer

A certificate imported into ACM from a third-party CA

Question 8

Which TWO actions should be taken to secure an EC2 instance that is used as a bastion host? (Choose 2)

Accepted Answer

Use a security group that only allows necessary inbound ports. A bastion host should only expose necessary inbound ports (typically TCP 22 for SSH) to minimize the attack surface. By using a security group that restricts inbound traffic to only required ports, you enforce the principle of least privilege at the network layer, preventing unauthorized access to other services that might be running on the instance.

Answer

Use HTTPS instead of SSH for administration

Answer

Place the bastion host in a private subnet

Answer

Allow all inbound traffic on port 22 in the network ACL

Question 9

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose 3)

Accepted Answer

A VPN tunnel between the customer gateway and the virtual private gateway. Options A, D, E are correct. A site-to-site VPN requires a VPN tunnel between the on-premises customer gateway and the AWS virtual private gateway (or transit gateway). The customer gateway device (hardware or software) is deployed on-premises to terminate the VPN tunnel. Option B is incorrect because VPC endpoints are used for private access to AWS services, not for VPN connections. Option C is incorrect because AWS Direct Connect is a dedicated physical connection, not a requirement for a VPN connection.

Answer

A VPC endpoint for the VPN service

Answer

An AWS Direct Connect dedicated line

Question 10

Which TWO statements about AWS WAF are accurate? (Choose 2)

Accepted Answer

AWS WAF can block or allow web requests based on conditions such as IP addresses, HTTP headers, and URI strings. Options D and E are correct statements about AWS WAF. AWS WAF is a web application firewall that can block or allow web requests based on conditions such as IP addresses, HTTP headers, and URI strings (D). It can be deployed on Application Load Balancers, Amazon CloudFront distributions, and Amazon API Gateway APIs (E). Option A is incorrect because network-layer DDoS protection is provided by AWS Shield, not WAF. Option B is incorrect because WAF does not inspect VPC Flow Logs; it inspects HTTP/HTTPS traffic at the application layer. Option C is incorrect because while WAF can be configured to automatically respond to certain conditions, it does not automatically mitigate DDoS attacks; AWS Shield Advanced provides automatic DDoS mitigation.

Answer

AWS WAF provides protection against network-layer DDoS attacks

Answer

AWS WAF can inspect traffic at the VPC level using VPC Flow Logs

Answer

AWS WAF automatically mitigates DDoS attacks without manual intervention

Question 11

An IAM policy is created and attached to a user. The user reports they cannot stop a production EC2 instance. What is the most likely reason?

Accepted Answer

The EC2 instance does not have the tag Environment=production. The IAM policy likely includes a condition key such as ec2:ResourceTag/Environment requiring the instance to have the tag 'Environment=production'. If the instance lacks that tag, the action is denied, even if the user has the permission to stop instances. Options B, C, and D are incorrect because the issue is specifically due to the missing tag, not a region condition, group attachment, or missing action.

Answer

The policy is missing a region condition

Answer

The policy is not attached to the user's group

Answer

The policy does not include ec2:StopInstances

Question 12

A security group is configured as shown. An EC2 instance in the same VPC with IP 10.0.1.50 can connect to the instance on port 443. An on-premises client with IP 203.0.113.5 cannot connect. What is the most likely reason?

Accepted Answer

The security group only allows traffic from the 10.0.0.0/16 CIDR. The security group inbound rule only allows traffic from the 10.0.0.0/16 CIDR block. The on-premises client IP (203.0.113.5) is outside that range, so the connection is implicitly denied. Option A is incorrect because security groups are stateful, so return traffic is allowed automatically. Option B is incorrect because HTTPS uses TCP, not UDP. Option D is incorrect because security groups do not support explicit deny rules; they only have allow rules, and any traffic not matching an allow rule is implicitly denied.

Answer

The security group's outbound rules block return traffic

Answer

The protocol is incorrect; HTTPS uses UDP

Answer

The security group has a deny rule for the on-premises IP

Question 13

A company wants to securely connect an on-premises data center to a VPC using AWS Site-to-Site VPN. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the VPN tunnel be highly available. Which design BEST meets these requirements?

Accepted Answer

Create two VPN tunnels to the same virtual private gateway for redundancy.. AWS Direct Connect with a private VIF does not inherently encrypt traffic; a VPN overlay would be required, and a single Direct Connect connection is not highly available. Option B is incorrect because a single VPN tunnel provides encryption but not high availability; if the tunnel fails, connectivity is lost. Option C is correct because a VPN connection with two tunnels to the same virtual private gateway provides redundancy for the tunnels, and the virtual private gateway is a highly available service within a region. Option D is incorrect because an AWS VPC can only have one virtual private gateway; you cannot attach two virtual private gateways to the same VPC. The recommended design for high availability is to use a single VPN connection with two tunnels (Option C) or multiple VPN connections to different VPCs.

Answer

Use AWS Direct Connect with a private VIF and enable encryption on the connection.

Answer

Create a single VPN tunnel with a virtual private gateway and enable encryption.

Answer

Create a VPN connection with two tunnels, each terminating on a different virtual private gateway in the same VPC.

Question 14

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3. Which control mechanism should they use?

Accepted Answer

Create a service control policy (SCP) that denies PutBucketEncryption if the encryption is not SSE-S3.. A service control policy (SCP) in AWS Organizations can deny PutBucketEncryption unless SSE-S3 is specified, enforcing encryption across all accounts. Option A is wrong because IAM policies are account-level and cannot enforce across all accounts in an organization. Option B is wrong because bucket policies are per-bucket and would require manual configuration on each bucket. Option D is wrong because CloudTrail is a logging service that does not enforce compliance; it only provides monitoring after the fact.

Answer

Assign an IAM policy to all users that requires SSE-S3.

Answer

Configure a bucket policy on each bucket to deny writes without SSE-S3.

Answer

Use AWS CloudTrail to monitor and alert on non-compliant bucket creations.

Question 15

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized security appliance running in a security VPC. Which configuration should be used?

Accepted Answer

Attach the VPCs to the Transit Gateway and configure route tables to send inter-VPC traffic to the security VPC via a route pointing to the security VPC's attachment.. AWS Transit Gateway enables centralized traffic inspection by attaching VPCs and configuring route tables to route inter-VPC traffic to the security VPC's attachment. Note that the route must point to the security VPC attachment, not a blackhole route (which drops traffic). Option A is incorrect because network ACLs control traffic at the subnet level and cannot route traffic to another VPC. Option C is incorrect because VPC peering does not provide a centralized inspection point without complex routing. Option D is incorrect because NAT gateways are for outbound internet traffic, not inter-VPC inspection.

Answer

Configure network ACLs in each VPC to deny traffic directly between VPCs.

Answer

Create VPC peering connections between each VPC and the security VPC, then update route tables.

Answer

Use NAT gateways in each VPC to route traffic through the security VPC.