ANS-C01 Network Security, Compliance and Governance Practice Test 12 — 15 Questions

Question 1

A company has a VPC with multiple subnets. They deploy a Network Firewall to inspect traffic. The firewall is configured with a stateful rule that allows outbound HTTP traffic to any destination. However, traffic from an EC2 instance in a private subnet to an external web server fails. The route table for the private subnet has a default route pointing to the firewall endpoint. What is the likely issue?

Accepted Answer

The firewall endpoint is in a different Availability Zone than the instance.. Option D is correct because the firewall endpoint is in a different Availability Zone; traffic must be routed to the firewall endpoint in the same AZ to avoid cross-AZ charges and potential routing issues. Option A is wrong because the stateful rule allows HTTP outbound. Option B is wrong because a NAT gateway is not required if using firewall. Option C is wrong because the security group allows outbound HTTP.

Answer

The stateful rule order is incorrect; a default deny rule is blocking traffic.

Answer

The EC2 instance security group does not allow outbound HTTP.

Answer

The subnet does not have a route to a NAT gateway.

Question 2

A company uses AWS Certificate Manager (ACM) to provision SSL/TLS certificates for their Application Load Balancer (ALB). They want to ensure that the ALB only accepts connections using TLS 1.2 or higher. How should they configure this?

Accepted Answer

Configure the ALB with an appropriate security policy that enforces TLS 1.2.. Option C is correct because security policies on the ALB can specify the TLS version. Option A is wrong because ACM does not control TLS version; it provides certificates. Option B is wrong because CloudFront is a different service. Option D is wrong because Route 53 does not handle TLS version enforcement.

Answer

Use ACM to generate a certificate that only supports TLS 1.2.

Answer

Configure the ALB to use a CloudFront distribution with a TLS policy.

Answer

Use AWS Route 53 to enforce TLS version at the DNS level.

Question 3

A company is designing a network security architecture for a multi-tier application. They need to ensure that the web tier can only communicate with the app tier on port 443, and the app tier can only communicate with the database tier on port 3306. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a security group for the web tier that allows outbound traffic to the app tier security group on port 443.. Options A and D are correct because security groups are stateful and can be used to control traffic between tiers by referencing the source security group. Option B is wrong because NACLs are stateless and require separate inbound/outbound rules. Option C is wrong because AWS Network Firewall is not needed for this simple traffic control. Option E is wrong because the requirement is to allow traffic on specific ports, not deny all.

Answer

Deploy an AWS Network Firewall to inspect inter-tier traffic.

Answer

Use network ACLs to statelessly filter traffic on the subnets.

Answer

Configure a VPC endpoint policy to deny all traffic between tiers.

Question 4

A company has a VPC with multiple subnets and uses AWS Transit Gateway to connect to on-premises via AWS Direct Connect. They want to implement network segmentation so that certain VPCs can only communicate with specific on-premises networks. Which THREE components should they use? (Choose THREE.)

Accepted Answer

Direct Connect gateway. Options A, C, and D are correct. Transit Gateway route tables allow separate routing domains, Direct Connect gateways route traffic to on-premises, and gateway associations link the gateways. Option B is wrong because VPC peering is not needed with Transit Gateway. Option E is wrong because VPN is not required if using Direct Connect.

Answer

VPC peering connections

Answer

Site-to-Site VPN connection

Question 5

A company is designing a security group configuration for a three-tier application. The web servers must be accessible from the internet on ports 80 and 443. The application servers must only communicate with the web servers on port 8080. The database servers must only communicate with the application servers on port 3306. Which TWO of the following are best practices for implementing this with security groups? (Choose TWO.)

Accepted Answer

Use the security group ID of the web tier as the source in the app tier inbound rule.. Options B and D are correct. Using security group IDs as source/destination ensures that only resources with that security group can communicate. Option A is wrong because using CIDR blocks is less secure. Option C is wrong because NACLs are not as fine-grained. Option E is wrong because using a single security group for all tiers violates least privilege.

Answer

Use the CIDR block of the subnet for the source security group rules.

Answer

Use network ACLs to enforce rules at the subnet level instead of security groups.

Answer

Assign the same security group to all instances to simplify management.

Question 6

An IAM policy is applied to a user. The user reports that they cannot run 'aws ec2 describe-instances --region eu-west-1' but can run the same command in us-east-1. What is the most likely reason?

Accepted Answer

The policy denies ec2:Describe* when the region is not us-east-1.. Option C is correct because the condition 'StringNotEquals' with 'aws:RequestedRegion' denies the action if the region is not us-east-1. Option A is wrong because the policy explicitly denies ec2:Describe* actions. Option B is wrong because the condition is StringNotEquals, not StringEquals. Option D is wrong because the policy does not specify resource-level conditions.

Answer

The policy only applies to resources in us-east-1, so other regions are implicitly denied.

Answer

The policy condition uses StringEquals, which only allows requests from us-east-1.

Answer

The policy allows ec2:Describe* in all regions, but the user lacks permissions in eu-west-1.

Question 7

A network engineer is troubleshooting connectivity from an EC2 instance in subnet-12345678 to a server on the internet. The instance has a public IP and a security group allowing all outbound traffic. However, traffic fails. Based on the exhibit, what is the issue?

Accepted Answer

The inbound rule only allows TCP traffic, which blocks return traffic for other protocols.. Option A is correct because the inbound rule (egress=false) only allows TCP (protocol 6) on port unspecified (all ports), but the outbound rule allows all traffic. However, the inbound rule only allows TCP, so return traffic for non-TCP protocols (like ICMP) is blocked. But the question says connectivity fails, likely because the instance initiates outbound traffic (e.g., HTTP), which is TCP, so that should work. Actually, the issue is that the outbound rule allows all traffic, but the inbound rule only allows TCP, so return traffic for non-TCP (like UDP or ICMP) is blocked. But typical HTTP uses TCP, so maybe the issue is something else. Let's re-evaluate: The outbound rule allows all traffic (protocol -1), but the inbound rule only allows TCP. For outbound connections, the return traffic is inbound, so if the outbound connection is TCP, the return TCP packets are allowed by the inbound rule. However, if the outbound traffic is something else like ICMP (ping), the return ICMP is blocked. The question does not specify the protocol. Option A is correct because the inbound rule only allows TCP, blocking other protocols. Option B is wrong because the outbound rule allows all traffic. Option C is wrong because the security group allows outbound. Option D is wrong because the inbound rule does not restrict TCP on ephemeral ports; it allows TCP from 0.0.0.0/0.

Answer

The inbound rule blocks TCP traffic on ephemeral ports.

Answer

The outbound rule blocks all traffic.

Answer

The security group does not allow outbound traffic.

Question 8

A network engineer runs the above command and sees that VPC Flow Logs are configured for a VPC. The engineer wants to analyze rejected traffic to troubleshoot a connectivity issue. Which field in the flow log records should they examine?

Accepted Answer

action. Option B is correct because the 'action' field in VPC Flow Logs indicates ACCEPT or REJECT. Option A is wrong because 'srcaddr' is source IP. Option C is wrong because 'dstport' is destination port. Option D is wrong because 'protocol' is the protocol number.

Answer

protocol

Answer

srcaddr

Answer

dstport

Question 9

A company uses AWS Organizations with multiple accounts and wants to centrally manage VPC security group rules. They need to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which service should they use to automatically detect and remediate noncompliant security groups?

Accepted Answer

AWS Config. AWS Config with managed rules like restricted-ssh can detect noncompliant security groups, and AWS Config remediation actions can automatically remediate them. AWS Firewall Manager can also centrally manage security group rules across accounts, but it is more about enforcement and policy management. Option A is correct because AWS Config is the primary service for compliance monitoring and remediation. Option B (AWS Firewall Manager) is also a valid service but is more for policy-based management across accounts; however, the question asks for detection and automatic remediation, which AWS Config does directly. Actually, AWS Firewall Manager can also enforce security group rules, but AWS Config is the correct answer for detection and remediation. Let me re-evaluate: AWS Config can detect and remediate via SSM Automation. Option A is correct. Option C (AWS CloudTrail) is for auditing API calls, not for enforcement. Option D (Amazon GuardDuty) is for threat detection, not security group compliance.

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Answer

AWS CloudTrail

Question 10

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must only accept traffic from known corporate IP addresses, but the company also needs to allow healthy traffic from AWS health checkers. Which architecture meets these requirements securely?

Accepted Answer

Configure the Application Load Balancer's security group to allow inbound from corporate IPs, and the EC2 instances' security group to allow inbound from the ALB's security group.. The correct approach is to use security groups. The ALB security group should allow inbound from corporate IPs, and the EC2 security group should allow inbound only from the ALB security group. AWS health checkers come from the ALB's private IPs, so they are covered. Option B is correct. Option A (NACL) is incorrect because NACLs are stateless and would require complex rules. Option C (WAF) can filter by IP but also needs to allow health checks, and it adds complexity. Option D (dedicated ALB for health checks) is overkill and unnecessary.

Answer

Create two target groups: one for corporate traffic and one for health check traffic, each with different security groups.

Answer

Use AWS WAF on the ALB to create an IP set containing corporate IPs, and allow all traffic from ALB to instances.

Answer

Use a network ACL on the VPC subnet to allow inbound traffic from corporate IPs and AWS health checker IP ranges.

Question 11

A security engineer needs to audit all API calls that modify security group rules in a VPC. Which AWS service should be used to record these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS API, including modifications to security group rules. Option B is correct. AWS Config records resource configuration changes but not API calls. VPC Flow Logs capture network traffic logs, not API calls. Amazon Inspector is for vulnerability assessment.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs

Question 12

A company is designing a multi-account AWS environment using AWS Organizations. They want to restrict the use of certain instance types across all accounts. Which approach should they use to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action for noncompliant instance types and attach it to the root organizational unit.. Service control policies (SCPs) in AWS Organizations can be used to restrict the use of specific instance types across member accounts. Option A is correct. IAM policies are account-specific and cannot be applied across all accounts from a central location. AWS Config can detect noncompliant instances but cannot prevent them from being launched. AWS CloudTrail is for auditing, not enforcement.

Answer

Create an IAM policy that denies the ec2:RunInstances action for noncompliant instance types and attach it to each IAM user.

Answer

Set up AWS Config rules to detect noncompliant instances and trigger an AWS Lambda function to terminate them.

Answer

Use AWS CloudTrail to monitor ec2:RunInstances events and send alerts.

Question 13

A company has deployed a web application on an EC2 instance that needs to access an S3 bucket and a DynamoDB table. The instance is in a private subnet. Which approach meets the security best practice of avoiding long-lived credentials on the instance?

Accepted Answer

Create an IAM role with policies granting access to S3 and DynamoDB, and attach the role to the EC2 instance profile.. The best practice is to attach an IAM role with the necessary permissions to the EC2 instance. The instance will automatically obtain temporary credentials via the instance metadata service. Option C is correct. Option A (IAM user credentials) is not recommended as they are long-lived. Option B (AWS Systems Manager Parameter Store) still requires credentials to access the parameters. Option D (security groups) does not grant access to S3 or DynamoDB.

Answer

Store IAM user access keys in the application configuration file.

Answer

Configure security group rules to allow outbound traffic to S3 and DynamoDB endpoints.

Answer

Use AWS Systems Manager Parameter Store to store credentials and retrieve them at runtime using the instance's IAM role.

Question 14

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can manage the encryption keys if the company wants to use server-side encryption with AWS KMS?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the service that manages encryption keys for server-side encryption (SSE-KMS). Option B is correct. AWS Certificate Manager (ACM) manages SSL/TLS certificates. AWS CloudHSM provides dedicated hardware security modules but is not required for SSE-KMS. AWS Secrets Manager manages secrets like database credentials.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Question 15

A company has a VPC with public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which solution provides internet access while keeping the instance private?

Accepted Answer

Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic while preventing inbound traffic from the internet. Option B is correct. Option A (internet gateway) would expose the instance to inbound traffic if assigned a public IP. Option C (VPC peering) does not provide internet access. Option D (VPC endpoint) only provides access to specific AWS services, not general internet.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Answer

Use an AWS PrivateLink VPC endpoint for the software update service.

Answer

Set up a VPC peering connection with another VPC that has internet access.