ANS-C01 Network Security, Compliance and Governance Practice Test 11 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize data transfer costs and avoid exposing the private instance to inbound traffic from the internet. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and ensure the patches are hosted in S3. Route private subnet traffic to the endpoint.. A VPC Gateway Endpoint for Amazon S3 provides private connectivity to S3 without traversing the internet, eliminating data transfer costs and avoiding exposure to inbound traffic. Option D is incorrect because assigning a public IP and using an internet gateway would expose the instance to inbound traffic. Option B (NAT gateway) and Option C (NAT instance) incur data transfer costs and are not required when the patches are in S3 and can be accessed via a gateway endpoint.

Answer

Attach an internet gateway to the VPC and route the private subnet's default route to a NAT gateway in the public subnet.

Answer

Launch a NAT instance in the public subnet and route the private subnet's default route to it.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Question 2

A company wants to audit all network traffic to and from an EC2 instance for compliance. The security team needs to capture full packet contents, including headers and payload, and store them in Amazon S3 for analysis. Which AWS service should they use?

Accepted Answer

Traffic Mirroring. (Traffic Mirroring) is correct because it captures full packets, including headers and payload, and can be used to send the captured traffic to an S3 bucket via a Network Load Balancer or a monitoring appliance. Option A is incorrect because Amazon CloudWatch Logs with the EC2 agent can only capture log files, not network packets. Option C is incorrect because AWS Config records configuration changes, not traffic. Option D is incorrect because VPC Flow Logs capture metadata (IP addresses, ports, protocols) but not the full packet contents.

Answer

Amazon CloudWatch Logs with the EC2 agent

Answer

AWS Config

Answer

VPC Flow Logs

Question 3

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block a list of known malicious IP addresses from accessing the application. Which service should they use to implement this protection?

Accepted Answer

AWS WAF with an IP set rule that blocks the malicious IPs. AWS WAF is a web application firewall that can inspect HTTP/S traffic and block requests based on conditions such as IP addresses. By creating an IP set containing the malicious IPs and associating it with a web ACL on the ALB, the security team can block those IPs at the application layer. This is more granular and efficient than network-level controls. Option A (Network ACLs) are stateless and operate at the subnet level, not designed for application-layer filtering, and would require managing deny rules that conflict with the default allow. Option C (AWS Shield Advanced) provides DDoS protection and cost protection, but does not offer granular IP blocking based on a custom list. Option D (Security Groups) are stateful firewalls that only support allow rules; they cannot deny specific IP addresses.

Answer

Network ACLs on the ALB subnet with deny rules

Answer

AWS Shield Advanced with automatic IP blocking

Answer

Security Groups for the ALB with deny rules

Question 4

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team notices that the BGP session between the on-premises router and the AWS virtual private gateway (VGW) is flapping. The on-premises router is configured to advertise a specific prefix. Which configuration change is MOST likely to stabilize the BGP session?

Accepted Answer

Adjust BGP timers (keepalive and hold time) to match between the on-premises router and the VGW.. BGP timers mismatch (keepalive and hold time) can cause frequent session resets (flapping). Adjusting them to match between the on-premises router and the VGW stabilizes the session. Option A is incorrect because ASN prepending influences route preference, not session stability. Option C is incorrect because MD5 authentication is for security, not flapping. Option D is incorrect because VGW does not support route-maps for filtering prefixes (route filtering can be done via allowed prefixes but not route-maps).

Answer

Add ASN prepending to the advertised prefix.

Answer

Enable BGP MD5 authentication on both sides.

Answer

Apply a route-map on the VGW to filter the prefix.

Question 5

A security engineer needs to ensure that all traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the engineer do to meet this requirement?

Accepted Answer

No additional configuration needed; VPC peering traffic is automatically encrypted.. VPC peering traffic within the same region is automatically encrypted using AWS's physical network encryption. No additional configuration is required. Option A (VPN) adds unnecessary complexity and cost since encryption already exists. Option B (NACLs) does not encrypt traffic. Option D (Transit Gateway) uses the same underlying encryption, so it does not add extra encryption beyond what VPC peering provides.

Answer

Set up a VPN connection between the two VPCs and route traffic through it.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Transit Gateway to connect the VPCs and enable encryption.

Question 6

A network engineer is troubleshooting connectivity issues between an EC2 instance and an RDS database in the same VPC. The EC2 instance can connect to the database, but the connection is slow. Which TWO actions should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.. Options C and D are correct. Checking security group rules (C) ensures proper allow rules for communication between the EC2 instance and RDS database. Reviewing VPC Flow Logs (D) can reveal dropped packets or latency issues. Option A is wrong because the default route to the internet is not relevant to internal VPC traffic. Option B is wrong because network ACLs are stateless and require explicit rules for both inbound and outbound traffic, but statefulness is not the issue here. Option E is wrong because route propagation is for VPN/Direct Connect, not for this connectivity.

Answer

Verify the route table for the database subnet to ensure there is a default route to the internet.

Answer

Check the network ACL for the database subnet to ensure it is stateful.

Answer

Check the route propagation settings on the VPC.

Question 7

A company is designing a multi-account architecture using AWS Organizations. They want to centrally manage and enforce network security policies across all accounts. Which THREE services or features should they use together to achieve this? (Choose THREE.)

Accepted Answer

AWS Network Firewall. Options A (AWS Network Firewall), B (Service Control Policies), and E (AWS Firewall Manager) are correct. AWS Network Firewall provides stateful inspection to filter traffic across VPCs. Service Control Policies (SCPs) centrally manage permissions and enforce guardrails across all accounts in the organization. AWS Firewall Manager centrally manages firewall rules, including AWS Network Firewall policies, across accounts. Option C (Security Groups) is incorrect because security groups are per-resource and cannot be centrally managed across accounts. Option D (AWS Config) is incorrect because AWS Config is for compliance monitoring and auditing, not for enforcing network security policies.

Answer

Security Groups

Answer

AWS Config

Question 8

A security engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. The engineer wants to capture full packets and store them for later analysis. Which TWO AWS services can be used together to accomplish this? (Choose TWO.)

Accepted Answer

Amazon S3. Options A (Amazon S3) and D (Traffic Mirroring) are correct. Traffic Mirroring captures full packets and sends them to a target, such as a Network Load Balancer or an EC2 instance, which can then store the captured traffic in Amazon S3. Option B (AWS Config) is incorrect because it tracks configuration changes, not network traffic. Option C (VPC Flow Logs) is incorrect because it captures only metadata (IP headers, ports, etc.), not full packets. Option E (Amazon CloudWatch Logs) is incorrect because it is designed for log storage and monitoring, not for storing full packet captures.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 9

A company wants to restrict access to an S3 bucket so that only objects with server-side encryption using AWS KMS (SSE-KMS) can be uploaded. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. S3:x-amz-server-side-encryption-aws-kms-key-id. This condition key in an S3 bucket policy allows you to enforce that objects must be encrypted with a specific AWS KMS key when the SSE-KMS header is used. Option A (kms:ViaService) is a condition key used in KMS key policies, not in S3 bucket policies; it controls which AWS services can use the KMS key. Option B (s3:x-amz-server-side-encryption) checks the encryption header but cannot enforce a specific KMS key ID—it only checks for the value 'aws:kms' or 'AES256', but not the key ID. Option C (aws:SourceVpce) is used to restrict access to a specific VPC endpoint, not encryption settings. Therefore, only D provides the granularity to require a specific KMS key ID for SSE-KMS.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

aws:SourceVpce

Question 10

A security engineer is designing a network firewall solution for a VPC with multiple subnets. The solution must inspect traffic between instances in the same VPC, including traffic within the same subnet. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. (AWS Network Firewall) is correct because it is a managed service that can inspect traffic between subnets and within a subnet in a VPC, providing stateful and stateless rules for deep packet inspection. Option A (Security Groups) is wrong because they are stateful but cannot inspect traffic within the same subnet; they only allow or deny traffic based on rules. Option B (VPC Flow Logs) is wrong because they capture metadata about traffic but do not inspect packets. Option D (AWS WAF) is wrong because it is designed for web application layer 7 inspection, not for general network traffic inspection.

Answer

Security Groups

Answer

VPC Flow Logs

Answer

AWS WAF

Question 11

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have block public access enabled. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) that denies bucket creation without block public access.. A service control policy (SCP) can deny the s3:PutBucketPublicAccessBlock action or enforce the block public access settings across all accounts in the organization. Option A (CloudTrail) is incorrect because CloudTrail only logs API calls for auditing, it does not enforce compliance. Option B (AWS Config) is incorrect because although AWS Config can detect noncompliant buckets, it requires additional automation for remediation and is not a direct enforcement mechanism like an SCP. Option D (IAM role) is incorrect because IAM roles grant permissions to principals and cannot enforce bucket-level settings across accounts; SCPs are the appropriate tool for organization-wide policy enforcement.

Answer

Use AWS CloudTrail to monitor bucket creation and alert.

Answer

Use AWS Config rules to detect and remediate noncompliant buckets.

Answer

Create an IAM role in each account that restricts bucket permissions.

Question 12

A security engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows private connectivity between EC2 instances in a private subnet and S3 without traversing the internet. Option A is incorrect because an Internet Gateway provides internet access, not private connectivity to S3. Option B is incorrect because Direct Connect is typically used for hybrid connectivity between on-premises and AWS, not for EC2 to S3 within the same region. Option D is incorrect because a NAT gateway allows outbound internet traffic from private subnets, but traffic would still go over the internet, not privately.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use AWS Direct Connect to connect to S3.

Answer

Deploy a NAT gateway in a public subnet and update the route table.

Question 13

A company uses AWS CloudFormation to deploy resources. The security team wants to ensure that no IAM user can modify the stack set if they are not authorized via a specific IAM policy. Which feature should be used?

Accepted Answer

Service control policy (SCP) in AWS Organizations. Service control policies (SCPs) in AWS Organizations can be used to centrally deny CloudFormation stack set modifications at the organization, OU, or account level, ensuring that only authorized IAM policies can allow such actions. Option A is wrong because AWS Config rules with remediation only detect and automatically fix noncompliant resources, not prevent modifications. Option B is wrong because CloudFormation stack policies protect resources within a stack (e.g., prevent deletion), not control who can update the stack set. Option D is wrong because IAM permissions boundaries set the maximum permissions for an IAM user or role, but they do not provide a global deny across accounts like SCPs do.

Answer

AWS Config rule with remediation

Answer

CloudFormation stack policy

Answer

IAM permissions boundary

Question 14

A company wants to centrally manage and enforce security rules for all VPCs in a multi-account environment. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization. It allows you to enforce a common set of security policies, such as AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules, ensuring consistent governance across all VPCs in the multi-account environment.

Answer

Amazon GuardDuty

Answer

AWS Shield

Answer

AWS WAF

Question 15

An application running on EC2 instances needs to access a DynamoDB table. The security team requires that traffic does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for DynamoDB.. A VPC Gateway Endpoint for DynamoDB provides private connectivity without traversing the internet. Option B is incorrect because VPC Interface Endpoints are typically used for services like API Gateway, but DynamoDB does not support Interface Endpoints in the same way; DynamoDB uses Gateway Endpoints. Option C is incorrect because an Internet Gateway provides internet access, which violates the security requirement. Option D is incorrect because a NAT Gateway also enables internet outbound traffic, not private access to DynamoDB.

Answer

Create a VPC Interface Endpoint for DynamoDB.

Answer

Attach an Internet Gateway to the VPC.

Answer

Deploy a NAT gateway and update the route table.