ANS-C01 Network Security, Compliance and Governance Practice Test 12 — 15 Questions

Question 1

A company needs to ensure that all API calls to AWS services are logged and monitored for suspicious activity. Additionally, any API call that creates a security group rule should trigger an immediate notification. Which combination of services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail records all API calls to AWS services, enabling logging and monitoring. Amazon CloudWatch Events (now Amazon EventBridge) can be configured to trigger notifications based on specific API events, such as creating a security group rule via the ec2:AuthorizeSecurityGroupIngress API call. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because AWS Config evaluates resource configuration and compliance, not API call logging; Amazon SNS alone does not provide monitoring capabilities. Option D is incorrect because AWS Shield provides DDoS protection and AWS WAF is a web application firewall, neither of which log API calls.

Answer

VPC Flow Logs and Amazon CloudWatch

Answer

AWS Config and Amazon SNS

Answer

AWS Shield and AWS WAF

Question 2

Which TWO actions should be taken to secure a VPC that hosts a web application? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for S3 to allow private access.. To secure a VPC hosting a web application, you should use Security Groups to allow only required inbound traffic (Option D) and use a VPC Gateway Endpoint for S3 to allow private access to S3 without traversing the internet (Option C). Option A is incorrect because allowing all ICMP from the internet increases attack surface. Option B is incorrect because the default route should point to an Internet Gateway for internet access, not a virtual private gateway unless for VPN. Option E is incorrect because allowing all outbound traffic may permit unauthorized data exfiltration.

Answer

Allow all ICMP traffic from the internet to the VPC.

Answer

Set the default route (0.0.0.0/0) to a virtual private gateway.

Answer

Allow all outbound traffic from the application instances.

Question 3

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Accepted Answer

AWS Firewall Manager. Options A, C, and D are correct. AWS Shield Advanced provides DDoS protection, AWS WAF filters web traffic, and AWS Firewall Manager centrally manages rules. Option B is wrong because AWS Config tracks configuration changes, not DDoS detection. Option E is wrong because VPC Flow Logs only log traffic.

Answer

AWS Config

Answer

VPC Flow Logs

Question 4

Which TWO encryption methods for data at rest in Amazon S3 use AWS-managed or customer-managed keys? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 uses AWS-managed keys, and SSE-KMS uses customer-managed keys via AWS KMS. Both are valid methods to encrypt data at rest in Amazon S3. SSE-C uses customer-provided keys, which is not a managed key service. Client-side encryption is performed by the client before upload and does not use AWS-managed or customer-managed keys. SSL/TLS encrypts data in transit, not at rest.

Answer

SSE-C

Answer

Client-Side Encryption

Answer

SSL/TLS

Question 5

Refer to the exhibit. A security engineer applies this S3 bucket policy. What is the result of this policy?

Accepted Answer

All PutObject requests must use SSE-KMS encryption.. The S3 bucket policy denies s3:PutObject unless the request uses SSE-KMS encryption (condition StringNotEquals 'aws:kms'). This forces all PutObject requests to use SSE-KMS. Option A is incorrect because the policy does not allow SSE-S3; only SSE-KMS is permitted. Option C is incorrect because the policy does not require a specific KMS key; it only checks that encryption is SSE-KMS. Option D is incorrect because the policy explicitly denies requests without SSE-KMS, not allows all.

Answer

All objects must be encrypted with SSE-S3 or SSE-KMS.

Answer

All objects must be encrypted with a specific KMS key.

Answer

All PutObject requests are allowed regardless of encryption.

Question 6

Refer to the exhibit. A network engineer reviews the NACL entries for a subnet. What is the effect of this NACL on inbound traffic?

Accepted Answer

Only SSH from the internal network and HTTPS from any IP are allowed.. Inbound rules: Rule 100 allows SSH from 10.0.0.0/16 (internal network). Rule 200 allows HTTPS from 0.0.0.0/0 (any IP). Rule 300 (implicit deny) denies all other inbound traffic. Therefore, only SSH from the internal network and HTTPS from any IP are allowed. Option B is incorrect because not all inbound traffic is allowed; SSH from external networks is denied. Option C is incorrect because HTTPS is allowed from anywhere. Option D is incorrect because the NACL does not deny all traffic; it allows specific traffic.

Answer

All inbound traffic is allowed.

Answer

Only HTTPS traffic is allowed from any IP.

Answer

All inbound traffic is denied.

Question 7

Refer to the exhibit. An EC2 instance is associated with the IAM role shown. Which action can the EC2 instance perform?

Accepted Answer

Read objects from any S3 bucket.. The policy allows s3:Get* and s3:List* actions, which include GetObject. Option B is wrong because PutObject is not allowed. Option C is wrong because DeleteObject is not allowed. Option D is wrong because no write actions are allowed.

Answer

Write objects to any S3 bucket.

Answer

Delete objects from any S3 bucket.

Answer

Upload objects to any S3 bucket.

Question 8

A company uses AWS Organizations with SCPs to restrict access. The security team notices that users in the 'Developers' account can launch EC2 instances with public IP addresses, even though the SCP denies ec2:AssociateAddress. What is the most likely reason?

Accepted Answer

The users logged in as the root user of the account.. SCPs do not apply to the root user of a member account. The root user can perform any action, including launching EC2 instances with public IP addresses, regardless of SCP restrictions. Option A is incorrect because SCPs apply to all IAM users and roles in the target OU, not just specific OUs; the issue here is the use of root user. Option C is incorrect because SCPs apply to IAM users and roles, not just the root user; the root user is explicitly exempt. Option D is incorrect because IAM roles are subject to SCPs; they cannot bypass SCPs. The correct reason is that the users logged in as the root user, which is not bound by SCPs.

Answer

The SCP was applied to the wrong organizational unit.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The users assumed an IAM role that bypasses the SCP.

Question 9

A company has a VPC with public and private subnets. They launch an Application Load Balancer (ALB) in the public subnets and targets in private subnets. Security requirements dictate that the targets should only accept traffic from the ALB. Which security group configuration meets this requirement?

Accepted Answer

Set the target security group inbound rule to allow HTTP from the ALB security group ID.. Referencing the ALB security group by ID in the target security group inbound rule allows traffic only from that specific security group, ensuring that only the ALB can reach the targets. This is a best practice for securing traffic between an ALB and its targets. Option A is incorrect because allowing HTTP from 0.0.0.0/0 would permit traffic from any source, not just the ALB. Option C is incorrect because the ALB's traffic originates from its elastic network interfaces (ENIs), which are associated with the ALB security group, not a fixed public IP. Option D is incorrect because allowing traffic from the entire VPC CIDR would permit any resource in the VPC to reach the targets, not just the ALB.

Answer

Set the target security group inbound rule to allow HTTP from 0.0.0.0/0.

Answer

Set the target security group inbound rule to allow HTTP from the ALB's public IP address.

Answer

Set the target security group inbound rule to allow HTTP from the VPC CIDR.

Question 10

A company is designing a network security architecture for a multi-account AWS environment. They need to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which AWS service should they use to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway allows centralized routing and can forward traffic to a central inspection VPC for firewall inspection. Option A is wrong because VPC Peering does not support transitive routing and is not centralized. Option B is wrong because AWS Direct Connect is for on-premises connectivity, not inter-VPC routing. Option D is wrong because VPC Endpoints are for private access to AWS services, not for routing inter-VPC traffic.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPC Endpoints

Question 11

A security engineer is troubleshooting connectivity between an EC2 instance in a private subnet and an S3 bucket. The instance has a VPC gateway endpoint for S3, and the route table has a route to the endpoint. The security group for the instance allows all outbound traffic. However, the instance cannot access the S3 bucket. What is the most likely cause?

Accepted Answer

The security group outbound rule does not allow traffic to the S3 prefix list.. Although the security group allows all outbound traffic to 0.0.0.0/0, this rule does not apply to traffic destined for the S3 prefix list when using a VPC gateway endpoint. Gateway endpoints require a security group rule that explicitly allows HTTPS traffic to the S3 prefix list ID. Without this rule, traffic is blocked. Option A is correct. Option B is incorrect because the VPC endpoint is indeed associated with the route table. Option C is incorrect because a NAT gateway is not needed for S3 access via the endpoint. Option D is incorrect because the bucket policy is not the issue; the security group rule is missing.

Answer

The VPC endpoint is not associated with the route table.

Answer

The route table does not have a route to a NAT gateway.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Question 12

A company has a requirement to encrypt all data in transit between EC2 instances and an RDS database. The database is in a private subnet, and the application connects using an SSL connection. The security team wants to ensure that even if the network is compromised, the data remains confidential. What additional measure should be taken?

Accepted Answer

Use a client-side encryption library to encrypt data before sending.. Client-side encryption adds an additional layer of security beyond SSL. Even if the network is compromised and SSL is bypassed, the data remains encrypted, ensuring confidentiality. Option D is incorrect: IAM database authentication provides authentication, not encryption; it does not enhance data confidentiality beyond what SSL already offers. Option A is wrong: a VPN between EC2 and RDS adds unnecessary complexity and does not replace or augment SSL encryption. Option C is wrong: encryption at rest protects stored data, not data in transit.

Answer

Deploy a VPN connection between the EC2 instances and the RDS database.

Answer

Enable encryption at rest on the RDS instance.

Answer

Use IAM database authentication with SSL.

Question 13

A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?

Accepted Answer

Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.. AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF. Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.

Answer

Add the partner IPs to a Network ACL allow rule in the VPC.

Answer

Remove the blocking WAF rules and rely on Shield Advanced only.

Answer

Add the partner IPs to an AWS Shield Advanced IP whitelist.

Question 14

A company wants to audit all changes to security groups in their AWS account. Which AWS service should they use to track API calls that modify security groups?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the account, including those that modify security groups. A (AWS Config) tracks resource configuration changes but not API calls. C (CloudWatch Logs) can store logs but does not capture API calls natively. D (VPC Flow Logs) captures network traffic metadata, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 15

A company has a VPC with multiple subnets. They deploy a Network Firewall to inspect traffic. The firewall is configured with a stateful rule that allows outbound HTTP traffic to any destination. However, traffic from an EC2 instance in a private subnet to an external web server fails. The route table for the private subnet has a default route pointing to the firewall endpoint. What is the likely issue?

Accepted Answer

The firewall endpoint is in a different Availability Zone than the instance.. The firewall endpoint must be in the same Availability Zone as the subnet's route table target. If the endpoint is in a different AZ, traffic is not properly routed to it. The stateful rule allows HTTP, so A is incorrect. Security groups do not affect outbound traffic unless explicitly blocked, and default outbound is allow, so B is incorrect. A NAT gateway is not needed when using a firewall, so D is incorrect.

Answer

The stateful rule order is incorrect; a default deny rule is blocking traffic.

Answer

The EC2 instance security group does not allow outbound HTTP.

Answer

The subnet does not have a route to a NAT gateway.