ANS-C01 Network Security, Compliance and Governance Practice Test 11 — 15 Questions

Question 1

An application running on EC2 instances needs to access a DynamoDB table. The security team requires that traffic does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for DynamoDB.. Option B is correct because a VPC Gateway Endpoint for DynamoDB provides private access. Option A is wrong because a NAT gateway routes to the internet. Option C is wrong because an Internet Gateway provides internet access. Option D is wrong because a VPC Interface Endpoint is for services like API Gateway, but DynamoDB uses Gateway Endpoint.

Answer

Create a VPC Interface Endpoint for DynamoDB.

Answer

Attach an Internet Gateway to the VPC.

Answer

Deploy a NAT gateway and update the route table.

Question 2

A company needs to ensure that all API calls to AWS services are logged and monitored for suspicious activity. Additionally, any API call that creates a security group rule should trigger an immediate notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. Option C is correct because CloudTrail logs API calls, and CloudWatch Events (now Amazon EventBridge) can trigger notifications. Option A is wrong because AWS Config is for resource configuration, not API call monitoring. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because AWS Shield is for DDoS protection.

Answer

VPC Flow Logs and Amazon CloudWatch

Answer

AWS Config and Amazon SNS

Answer

AWS Shield and AWS WAF

Question 3

Which TWO actions should be taken to secure a VPC that hosts a web application? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for S3 to allow private access.. Options A and D are correct. Using Security Groups allows instance-level firewall rules, and using a VPC Gateway Endpoint for S3 allows private access to S3. Option B is wrong because allowing all ICMP is not secure. Option C is wrong because the default route should point to a NAT gateway or internet gateway, but not a virtual private gateway unless for VPN. Option E is wrong because allowing all outbound traffic is not a best practice.

Answer

Allow all ICMP traffic from the internet to the VPC.

Answer

Set the default route (0.0.0.0/0) to a virtual private gateway.

Answer

Allow all outbound traffic from the application instances.

Question 4

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Accepted Answer

AWS Firewall Manager. Options A, B, and C are correct. AWS Shield Advanced provides DDoS protection, AWS WAF filters web traffic, and AWS Firewall Manager centrally manages rules. Option D is wrong because VPC Flow Logs only log traffic. Option E is wrong because AWS Config tracks configuration.

Answer

AWS Config

Answer

VPC Flow Logs

Question 5

Which TWO are valid methods to encrypt data at rest in Amazon S3? (Choose TWO.)

Accepted Answer

SSE-S3. Options B and C are correct. SSE-S3 and SSE-KMS are two server-side encryption options. Option A is wrong because SSL/TLS is for data in transit. Option D is wrong because Client-Side Encryption is not server-side. Option E is wrong because SSE-C is also valid, but the question asks for TWO, and SSE-S3 and SSE-KMS are the most common.

Answer

SSE-C

Answer

Client-Side Encryption

Answer

SSL/TLS

Question 6

Refer to the exhibit. A security engineer applies this S3 bucket policy. What is the result of this policy?

Accepted Answer

All PutObject requests must use SSE-KMS encryption.. Option C is correct. The policy denies s3:PutObject if the object is not encrypted with SSE-KMS (condition StringNotEquals aws:kms). Option A is wrong because it does not require a specific KMS key, just SSE-KMS. Option B is wrong because it does not allow any encryption. Option D is wrong because the policy explicitly denies, not allows.

Answer

All objects must be encrypted with SSE-S3 or SSE-KMS.

Answer

All objects must be encrypted with a specific KMS key.

Answer

All PutObject requests are allowed regardless of encryption.

Question 7

Refer to the exhibit. A network engineer reviews the NACL entries for a subnet. What is the effect of this NACL on inbound traffic?

Accepted Answer

Only SSH from the internal network and HTTPS from any IP are allowed.. Option B is correct. Inbound rules: Rule 100 allows SSH from 10.0.0.0/16. Rule 200 allows HTTPS from anywhere. Rule 300 denies all other traffic. So only SSH from 10.0.0.0/16 and HTTPS from anywhere are allowed. Option A is wrong because SSH is not allowed from anywhere. Option C is wrong because HTTPS is allowed. Option D is wrong because the NACL is not fully open.

Answer

All inbound traffic is allowed.

Answer

Only HTTPS traffic is allowed from any IP.

Answer

All inbound traffic is denied.

Question 8

Refer to the exhibit. An EC2 instance is associated with the IAM role shown. Which action can the EC2 instance perform?

Accepted Answer

Read objects from any S3 bucket.. Option A is correct. The policy allows s3:Get* and s3:List* actions, which include GetObject. Option B is wrong because PutObject is not allowed. Option C is wrong because DeleteObject is not allowed. Option D is wrong because no write actions are allowed.

Answer

Write objects to any S3 bucket.

Answer

Delete objects from any S3 bucket.

Answer

Upload objects to any S3 bucket.

Question 9

A company uses AWS Organizations with SCPs to restrict access. The security team notices that users in the 'Developers' account can launch EC2 instances with public IP addresses, even though the SCP denies ec2:AssociateAddress. What is the most likely reason?

Accepted Answer

The users logged in as the root user of the account.. Option C is correct because SCPs do not affect the root user of a member account; root user actions are not restricted by SCPs. Option A is wrong because SCPs apply to all IAM users and roles, not just root. Option B is wrong because SCPs are not bypassed by IAM roles. Option D is wrong because SCPs apply to all accounts, but root user is exempt.

Answer

The SCP was applied to the wrong organizational unit.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The users assumed an IAM role that bypasses the SCP.

Question 10

A company has a VPC with public and private subnets. They launch an Application Load Balancer (ALB) in the public subnets and targets in private subnets. Security requirements dictate that the targets should only accept traffic from the ALB. Which security group configuration meets this requirement?

Accepted Answer

Set the target security group inbound rule to allow HTTP from the ALB security group ID.. Option D is correct because referencing the ALB security group by ID in the target security group rule allows traffic from that specific SG, which is the best practice. Option A is wrong because that would allow traffic from any resource in the VPC. Option B is wrong because that would allow traffic from any source, not just ALB. Option C is wrong because the ALB is not a source by its own IP; its traffic comes from its ENIs which belong to the ALB SG.

Answer

Set the target security group inbound rule to allow HTTP from 0.0.0.0/0.

Answer

Set the target security group inbound rule to allow HTTP from the ALB's public IP address.

Answer

Set the target security group inbound rule to allow HTTP from the VPC CIDR.

Question 11

A company is designing a network security architecture for a multi-account AWS environment. They need to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which AWS service should they use to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. Option B is correct because AWS Transit Gateway with a central inspection VPC allows routing traffic through a firewall appliance. Option A is wrong because VPC Peering does not support transitive routing. Option C is wrong because Direct Connect is for on-premises connectivity. Option D is wrong because VPC Endpoints are for private access to AWS services, not inter-VPC traffic.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPC Endpoints

Question 12

A security engineer is troubleshooting connectivity between an EC2 instance in a private subnet and an S3 bucket. The instance has a VPC gateway endpoint for S3, and the route table has a route to the endpoint. The security group for the instance allows all outbound traffic. However, the instance cannot access the S3 bucket. What is the most likely cause?

Accepted Answer

The security group outbound rule does not allow traffic to the S3 prefix list.. Option A is correct because VPC gateway endpoints use prefix lists, and the security group outbound rule must allow traffic to the S3 prefix list ID. Option B is wrong because the instance is in a private subnet; internet traffic would go through NAT, but S3 access should use the gateway endpoint. Option C is wrong because S3 buckets are accessed via the endpoint, not via the internet. Option D is wrong because the route is present, but security group may still block.

Answer

The VPC endpoint is not associated with the route table.

Answer

The route table does not have a route to a NAT gateway.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Question 13

A company has a requirement to encrypt all data in transit between EC2 instances and an RDS database. The database is in a private subnet, and the application connects using an SSL connection. The security team wants to ensure that even if the network is compromised, the data remains confidential. What additional measure should be taken?

Accepted Answer

Use IAM database authentication with SSL.. Option C is correct because enabling IAM database authentication with SSL ensures that the connection uses a certificate that is validated. Option A is wrong because RDS does not support client-side encryption of connections natively; SSL is the standard. Option B is wrong because encryption at rest does not protect data in transit. Option D is wrong because a VPN adds complexity but does not replace SSL encryption between app and DB.

Answer

Deploy a VPN connection between the EC2 instances and the RDS database.

Answer

Use a client-side encryption library to encrypt data before sending.

Answer

Enable encryption at rest on the RDS instance.

Question 14

A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?

Accepted Answer

Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.. Option B is correct because creating an IP set in WAF and adding a rule to allow traffic from that IP set with higher priority than blocking rules will whitelist partner IPs. Option A is wrong because Shield Advanced does not have IP whitelisting; it's for DDoS protection. Option C is wrong because Network ACLs operate at the subnet level, not at the application layer. Option D is wrong because removing blocking rules entirely would weaken security.

Answer

Add the partner IPs to a Network ACL allow rule in the VPC.

Answer

Remove the blocking WAF rules and rely on Shield Advanced only.

Answer

Add the partner IPs to an AWS Shield Advanced IP whitelist.

Question 15

A company wants to audit all changes to security groups in their AWS account. Which AWS service should they use to track API calls that modify security groups?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records API calls, including those that modify security groups. Option B is wrong because CloudWatch Logs can store logs but not capture API calls directly. Option C is wrong because AWS Config tracks resource configuration changes but not API calls. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs