ANS-C01 Network Security, Compliance and Governance Practice Test 12 — 15 Questions

Question 1

A company has a VPC with multiple subnets and uses AWS Network Firewall to inspect traffic. The security team notices that traffic to a specific IP (10.0.0.10) is being dropped unexpectedly. The firewall policy has a stateful rule group that allows all traffic. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The stateless default action is set to drop. Network Firewall evaluates stateless rules first, and a stateless default drop action would drop traffic before stateful rules are considered. Option A is wrong because stateful rules allow all. Option B is wrong because route table directs traffic to firewall. Option D is wrong because AWS Shield is for DDoS protection.

Answer

The stateful rule group has an implicit deny for that IP

Answer

AWS Shield Advanced is blocking the traffic

Answer

The subnet's route table does not have a route to the firewall endpoint

Question 2

A company needs to ensure that all outbound internet traffic from a VPC goes through a centralized inspection appliance. The VPC has multiple subnets. Which THREE steps are required to implement this?

Accepted Answer

Configure security groups to allow outbound traffic from the instances. To ensure all outbound internet traffic goes through a centralized inspection appliance, the required steps are: configure security groups to allow outbound traffic (Option A) and launch a NAT gateway in a public subnet with an Elastic IP (Option B) to provide outbound connectivity. The third step, which is not listed among the options, is to route private subnet traffic to the inspection appliance rather than directly to the NAT gateway. Option E is incorrect because routing 0.0.0.0/0 to a NAT gateway would bypass the inspection appliance, failing the requirement.

Answer

Attach an Internet Gateway to the VPC and route all traffic to it

Answer

Create VPC endpoints for all required AWS services

Answer

Configure route tables in each private subnet to send 0.0.0.0/0 traffic to a NAT gateway in a public subnet

Question 3

A company wants to encrypt all data in transit between an Application Load Balancer (ALB) and its target EC2 instances. Which TWO actions should be taken?

Accepted Answer

Configure the target group to use HTTPS as the protocol. To encrypt data in transit between an Application Load Balancer (ALB) and its target EC2 instances, only the target group protocol needs to be configured to use HTTPS (Option B). The ALB listener protocol (HTTPS) encrypts traffic between the client and the ALB, not between the ALB and targets, so Option D is not required for this specific goal. Option A is incorrect because Client Certificate Authentication is for mutual TLS between client and ALB. Option C is incorrect because adding a listener rule based on path affects traffic routing, not encryption. Option E is incorrect because security group rules control access but do not encrypt traffic.

Answer

Enable Client Certificate Authentication on the ALB

Answer

Add a listener rule to forward traffic based on path

Answer

Configure the ALB listener to use HTTPS

Answer

Configure security groups to allow only HTTPS traffic

Question 4

Refer to the exhibit. A company has attached this bucket policy to an S3 bucket. An EC2 instance in VPC vpc-12345 is trying to access the bucket but is getting access denied. The EC2 instance has a public IP of 198.51.100.10. What is the MOST likely reason?

Accepted Answer

The EC2 instance's source IP is not in the allowed IP range. The bucket policy likely contains an IpAddress condition restricting access to a specific CIDR range, and the EC2 instance's public IP 198.51.100.10 falls outside that range. Even though the instance has a public IP, the policy's IP condition is evaluated against the source IP as seen by S3, which for an EC2 instance in a VPC is typically the NAT gateway's public IP, not the instance's own public IP.

Answer

The policy does not have an explicit allow for the instance's IP

Answer

Both conditions must be met for access

Answer

The EC2 instance does not have the s3:GetObject permission

Question 5

Refer to the exhibit. A network engineer runs the above command and sees this network ACL configuration. The subnet associated with this ACL contains an EC2 instance that is failing to receive inbound HTTP traffic (TCP 80) from the internet. What is the MOST likely cause?

Accepted Answer

The inbound deny rule for TCP (port range) blocks all TCP traffic. In a network ACL, rules are evaluated in order by rule number, and the first match wins. If an inbound DENY rule for TCP appears before the ALLOW rule for port 80, all TCP traffic — including HTTP — is blocked before the allow rule is ever evaluated. This is the classic NACL ordering mistake and explains why the EC2 instance cannot receive inbound HTTP.

Answer

The inbound deny rule is associated with the wrong subnet

Answer

The outbound rule does not allow return traffic

Answer

The inbound allow rule is not wide enough

Question 6

A company is using AWS WAF to protect its web application. The security team notices that the WAF logs show a high number of requests from a specific IP address range that are being blocked by the SQL injection rule. However, the application team reports that legitimate users from that IP range are unable to access the application. Which action should the security team take to resolve this issue while maintaining security?

Accepted Answer

Create a rate-based rule to limit requests from the IP range.. Creating a rate-based rule can limit the request rate from the specific IP range, allowing legitimate traffic while still blocking excessive requests that may be part of a SQL injection attempt. This maintains security by not outright allowing the IP range or disabling protections. Option A is wrong because disabling the SQL injection rule for the IP range removes protection against actual SQL injection attacks from that range. Option B is wrong because increasing the rate limit for the entire WAF is not granular and may affect other traffic. Option C is wrong because adding the IP range to the allow list completely bypasses security, leaving the application vulnerable.

Answer

Disable the SQL injection rule for the specific IP range.

Answer

Increase the rate limit for the entire WAF.

Answer

Add the IP range to the allow list in the WAF.

Question 7

A company has deployed a VPC with public and private subnets. They have an Internet Gateway attached to the VPC and a NAT Gateway in the public subnet. The private subnet instances need to download patches from the internet. Which configuration ensures that the private instances can reach the internet while preventing inbound traffic from the internet?

Accepted Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.. Adding a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway allows private instances to initiate outbound traffic to the internet while preventing inbound connections from the internet. Option A is incorrect because a VPC Gateway Endpoint only provides access to specific AWS services (e.g., S3, DynamoDB), not general internet traffic. Option B is incorrect because routing 0.0.0.0/0 to the Internet Gateway would expose the private instances to inbound traffic from the internet (assuming the route is in the private subnet route table, it would still allow inbound traffic if the instances have public IPs, but more importantly, it bypasses the NAT Gateway's security). Option D is incorrect because VPC Peering does not provide internet access; it only connects two VPCs.

Answer

Add a VPC Gateway Endpoint for Amazon S3 to the private subnet route table.

Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

Answer

Create a VPC Peering connection to a public VPC and route traffic through it.

Question 8

A company is setting up a cross-account VPC peering connection between VPC A (account 1) and VPC B (account 2). The security team wants to ensure that only specific TCP ports are allowed between the VPCs. They have configured the route tables and the VPC peering connection is active. Which additional configuration is required to enforce the port restriction?

Accepted Answer

Update the security groups in both VPCs to allow inbound traffic only on the required ports from the peered VPC's CIDR or security group.. Security groups can reference security groups from peered VPCs across accounts when the VPC peering connection is active, allowing fine-grained control over specific TCP ports at the instance level. Option A is incorrect because modifying network ACLs is possible but they are stateless and apply at the subnet level, not instance level; also, network ACLs cannot reference security groups from peered VPCs. Option B is incorrect because network ACLs are stateless, not stateful; security groups are stateful. Option D is incorrect because route tables control the path of traffic, not port-level filtering; they cannot deny traffic based on ports.

Answer

Modify the network ACLs in both VPCs to allow inbound traffic only on the required ports.

Answer

Use network ACLs with stateful filtering to allow only the required ports.

Answer

Configure the route tables to deny traffic on all ports except the allowed ones.

Question 9

A company is using AWS Direct Connect to connect their on-premises network to AWS. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect virtual interface (VIF) configured. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures that traffic automatically uses the VPN if the Direct Connect connection fails?

Accepted Answer

Configure the VPN connection but attach it to a separate VGW, and use a transit gateway with failover routing.. By attaching the VPN to a separate VGW and using a transit gateway with failover routing (using route table priorities), the TGW can automatically route traffic to the Direct Connect VIF as primary and fail over to the VPN when the Direct Connect connection fails. This provides automatic failover without relying on static routes or BGP attribute manipulation. Option B is incorrect because adding a static route pointing to the VPN would always send traffic to the VPN, overriding any BGP propagated routes and preventing the use of Direct Connect when available. Option C is incorrect because not propagating routes means there are no dynamic routes; static routes would not provide automatic failover. Option D is incorrect because VPC route tables do not support metrics on static routes; a static route for Direct Connect would take precedence over propagated VPN routes and would not fail over to VPN when Direct Connect fails; additionally, static routes always have higher precedence than propagated routes, so the traffic would not automatically use VPN.

Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the VPN.

Answer

Configure the VPN connection but do not propagate routes; use static routes in the route table.

Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the Direct Connect VIF with a higher metric.

Question 10

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3 or SSE-KMS. Which THREE steps should they take to implement this policy?

Accepted Answer

Attach the SCP to the root organizational unit (OU) to apply to all accounts.. Option B is correct because attaching the SCP to the root OU in AWS Organizations makes the policy apply to every account in the organization, which is the required scope for an organization-wide enforcement. Option E is correct because an SCP that denies s3:CreateBucket when the request lacks the required encryption headers (for example, x-amz-server-side-encryption with AES256 or aws:kms) prevents creation of unencrypted buckets at the API level. Option D is correct because AWS Config rules can detect S3 buckets that are not encrypted with SSE-S3 or SSE-KMS and trigger automatic remediation, providing continuous compliance monitoring and correction. Option A is not correct because a bucket policy in each account is per-bucket and per-account, so it does not scale or guarantee organization-wide enforcement. Option C is not correct because a VPC endpoint policy only controls S3 access that traverses that endpoint and does not enforce encryption for all S3 access across the organization.

Answer

Apply a bucket policy in each account that denies PutObject without encryption.

Answer

Use a VPC endpoint policy to enforce encryption for all S3 access from the VPC.

Question 11

A company is deploying a web application that must be accessible over HTTPS only. They are using an Application Load Balancer (ALB) with an SSL certificate from AWS Certificate Manager (ACM). Which TWO configurations are necessary to ensure that only HTTPS traffic reaches the application?

Accepted Answer

Configure the security group for the ALB to allow inbound traffic on port 443 from 0.0.0.0/0.. Option C is correct because the ALB's security group must permit inbound TCP 443 from 0.0.0.0/0 so that HTTPS clients can reach the load balancer; without this rule, no HTTPS traffic would be allowed in. Option E is correct because the ALB requires a listener on port 443 configured with the ACM SSL certificate to terminate TLS and forward the decrypted requests to the target group. Together, these two configurations ensure the application is reachable over HTTPS. Option A is wrong because opening port 80 would allow unencrypted HTTP traffic, contradicting the HTTPS-only requirement. Option B is wrong because an HTTP listener on port 80 would accept plaintext traffic rather than enforcing HTTPS. Option D is wrong because a redirect rule is not strictly necessary to ensure only HTTPS reaches the application; the requirement is met by exposing only the HTTPS listener, and a redirect would still require an HTTP listener to exist.

Answer

Configure the security group for the ALB to allow inbound traffic on port 80 from 0.0.0.0/0.

Answer

Configure the ALB listener to accept traffic on port 80.

Answer

Configure the ALB to redirect HTTP traffic to HTTPS.

Question 12

A company has a VPC with CIDR 10.0.0.0/16. They have public subnets (10.0.1.0/24, 10.0.2.0/24) and private subnets (10.0.3.0/24, 10.0.4.0/24) in two Availability Zones. An Internet Gateway is attached to the VPC, and a NAT Gateway is in public subnet 10.0.1.0/24. The private subnets route 0.0.0.0/0 to the NAT Gateway. The security team notices that instances in private subnet 10.0.3.0/24 can reach the internet, but instances in private subnet 10.0.4.0/24 cannot. Both private subnets have the same route table configuration. The network ACLs for both private subnets are set to allow all inbound and outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet 10.0.1.0/24 does not have a route to the Internet Gateway.. The NAT Gateway is in the public subnet 10.0.1.0/24. For the NAT Gateway to reach the internet, the route table associated with that public subnet must have a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, the NAT Gateway cannot forward traffic from private subnets to the internet. Since both private subnets have the same route table configuration pointing to the NAT Gateway, the issue is isolated to the NAT Gateway's inability to reach the internet due to the missing route in the public subnet's route table. Options B, C, and D are incorrect: security groups and network ACLs are configured to allow traffic, and the private subnet route tables are correctly set to route to the NAT Gateway.

Answer

The security group on the instances in private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The network ACL for private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The route table for private subnet 10.0.4.0/24 does not have a route to the NAT Gateway.

Question 13

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application stores files in an S3 bucket. The security team wants to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. They have created an IAM role for the EC2 instances with a policy that grants s3:PutObject and s3:GetObject on the specific bucket. They have also attached a VPC endpoint for S3 to the VPC and added a bucket policy that allows access only from the VPC endpoint. Despite this, the EC2 instances can still access other S3 buckets. What is the most likely reason?

Accepted Answer

The VPC endpoint policy does not restrict access to the specific S3 bucket.. The most likely reason is that the VPC endpoint policy is not restricting access to the specific S3 bucket (Option C). Even though the IAM role only grants permissions on the specific bucket, the VPC endpoint policy defaults to allowing access to all S3 resources. Without a restrictive endpoint policy, the EC2 instances can access other S3 buckets if they have any IAM permissions that allow it (e.g., from another attached policy). Option A is incorrect because the VPC endpoint does not require a route table association to function; rather, the route table must have a route pointing to the endpoint for traffic to use it. Option B is incorrect because the security group on the endpoint controls network traffic, not access to S3 buckets. Option D is incorrect because the IAM role must have a trust policy allowing EC2 to assume it, but that is a prerequisite and would not cause the described issue by itself.

Answer

The VPC endpoint does not have a route table associated with the private subnets.

Answer

The security group on the VPC endpoint is allowing all traffic.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 14

A company is designing a VPC with private subnets for databases and public subnets for web servers. They need to allow the web servers to make outbound internet requests for software updates but prevent inbound traffic from the internet. Which configuration should they use?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.. Deploying a NAT Gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while blocking unsolicited inbound traffic from the internet. Option B is incorrect because a NAT Gateway must be in a public subnet to access the internet. Option C is incorrect because an Internet Gateway allows both inbound and outbound traffic, which would expose the private subnets to inbound internet traffic. Option D is incorrect because while a proxy server could work, it is more complex and not the simplest or recommended AWS solution.

Answer

Deploy a NAT Gateway in the private subnet and route the private subnet traffic through it.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through it.

Answer

Deploy a proxy server in the private subnet and configure the web servers to use it.

Question 15

A security engineer is troubleshooting connectivity issues between two VPCs connected via a VPC Peering connection. The VPCs are in different accounts. The security groups in both VPCs allow traffic between the CIDRs. The route tables have the appropriate entries. However, instances in VPC A cannot communicate with instances in VPC B. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.. VPC peering is strictly non-transitive: a peering connection only enables direct routing between the two peered VPCs. If traffic must traverse a third VPC, a transit gateway, or an on-premises network, peering alone will not carry it. Given that security groups and route tables are correct, the most likely cause is a transitive routing expectation that peering does not support.

Answer

The VPC Peering connection requires an IAM role to be assumed for cross-account communication.

Answer

The security group in VPC A does not allow inbound traffic from VPC B's CIDR.

Answer

The network ACL in VPC A does not allow return traffic from VPC B.