ANS-C01 Network Security, Compliance and Governance Practice Test 13 — 15 Questions

Question 1

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. They want to ensure that only traffic from specific on-premises IP ranges is allowed into the production VPC. Which approach should they use?

Accepted Answer

Deploy AWS Network Firewall in the production VPC and configure stateful rule groups to allow only the on-premises IP ranges.. AWS Transit Gateway supports route tables and can propagate routes from Direct Connect virtual interfaces. To filter traffic, you can use a network firewall appliance or AWS Network Firewall. However, the simplest approach is to use security groups and network ACLs within the VPC, but the question is about Transit Gateway. The best practice is to use AWS Network Firewall to inspect and filter traffic between attachments. Option C is correct. Option A (VPC peering) is not relevant. Option B (Direct Connect gateway) does not filter traffic. Option D (Transit Gateway route tables) does not filter by IP; they only determine routing.

Answer

Configure the Direct Connect gateway to only advertise specific prefixes to the Transit Gateway.

Answer

Use Transit Gateway route tables to blackhole traffic from other IP ranges.

Answer

Create a VPC peering connection between the on-premises network and the production VPC.

Question 2

A company wants to audit all network traffic to and from EC2 instances for security analysis. Which AWS service should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC. Option D is correct. AWS CloudTrail records API calls, not network traffic. AWS Config records resource configuration changes. Amazon GuardDuty analyzes logs and flows for threats, but it does not capture the raw traffic itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

A company is designing a security group configuration for a three-tier web application (web, application, database). The web tier is accessible from the internet. Which TWO rules should be applied to meet security best practices?

Accepted Answer

App tier security group: inbound from the web tier security group on port 8080.. For a three-tier architecture, the web tier security group should allow inbound from the internet (0.0.0.0/0 on HTTP/HTTPS). The app tier security group should allow inbound only from the web tier security group. The database tier should allow inbound only from the app tier security group. Options A and C are correct. Option B (app tier from 0.0.0.0/0) is wrong. Option D (database tier from web tier) bypasses the app tier. Option E (database tier from 0.0.0.0/0) is wrong.

Answer

App tier security group: inbound from 0.0.0.0/0 on port 8080.

Answer

Database tier security group: inbound from the web tier security group on port 3306.

Answer

Database tier security group: inbound from 0.0.0.0/0 on port 3306.

Question 4

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which THREE services should they combine to protect against common web attacks and network threats?

Accepted Answer

Amazon GuardDuty. A defense-in-depth strategy for web applications includes AWS WAF to protect against web exploits, AWS Shield Advanced for DDoS protection, and Amazon GuardDuty for threat detection. Option A, C, and E are correct. Option B (AWS Certificate Manager) is for SSL/TLS certificates, not security. Option D (AWS Direct Connect) is for dedicated network connectivity, not security.

Answer

AWS Direct Connect

Answer

AWS Certificate Manager (ACM)

Question 5

A company needs to encrypt data in transit between an Application Load Balancer and EC2 instances. Which TWO actions should they take?

Accepted Answer

Upload a certificate to AWS Certificate Manager (ACM).. To encrypt traffic between ALB and EC2 instances, you need to upload a certificate to AWS Certificate Manager (ACM) and configure the ALB listener to use HTTPS for the backend. Option B and D are correct. Option A (TCP listener) does not support encryption. Option C (self-signed certificate) is not recommended for production. Option E (CloudFront) is a CDN, not required for backend encryption.

Answer

Create a TCP listener on the ALB.

Answer

Place Amazon CloudFront in front of the ALB.

Answer

Use a self-signed certificate on the EC2 instances.

Question 6

A company runs a multi-tier application on AWS. The web tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application tier runs on EC2 instances in a separate Auto Scaling group, and the database tier uses an Amazon RDS MySQL instance. All resources are in the same VPC. The security team has identified that the application tier instances are receiving traffic from unknown IP addresses on port 22 (SSH). The team wants to ensure that only the web tier instances can communicate with the application tier on the application port (8080), and only from a specific security group. Additionally, the database tier should only accept traffic from the application tier on port 3306. Currently, the security groups are configured as follows: Web-SG allows inbound from 0.0.0.0/0 on ports 80 and 443; App-SG allows inbound from 0.0.0.0/0 on port 8080 and from 0.0.0.0/0 on port 22; DB-SG allows inbound from 0.0.0.0/0 on port 3306. The team has also noticed that the web tier instances can be accessed via SSH from the internet. Which course of action should the team take to remediate the security issues?

Accepted Answer

Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.. The correct action is to update the security groups to restrict inbound traffic: Web-SG should allow SSH only from a trusted management IP, not from 0.0.0.0/0. App-SG should allow inbound on port 8080 only from Web-SG, and not allow SSH from 0.0.0.0/0. DB-SG should allow inbound on port 3306 only from App-SG. Option A achieves this. Option B only addresses the web tier SSH issue. Option C removes SSH entirely, which might be needed for management. Option D uses network ACLs but NACLs are stateless and would require complex rules; security groups are more appropriate for this use case.

Answer

Update Web-SG to allow SSH from a specific management CIDR. Leave App-SG and DB-SG as is because they are not directly accessible from the internet.

Answer

Remove inbound SSH rules from all security groups and rely on AWS Systems Manager Session Manager for administrative access.

Answer

Use network ACLs on the subnets to restrict traffic between tiers instead of security groups.

Question 7

A security engineer must ensure that all traffic between an application running on Amazon EC2 and an Amazon RDS database is encrypted in transit. The VPC has a public subnet for the EC2 instance and a private subnet for the RDS database. What is the MOST secure way to enforce encryption for this traffic?

Accepted Answer

Configure the RDS DB instance to require SSL/TLS connections and configure the application to connect using SSL.. Option D is correct because enabling IAM database authentication does not enforce encryption in transit; it only controls access. Option A is incorrect because requiring SSL/TLS for the database connection ensures encryption between the client and the database. Option B is incorrect because a security group cannot enforce encryption; it only controls traffic at the network layer. Option C is incorrect because a network ACL is stateless and cannot enforce encryption.

Answer

Enable IAM database authentication for the RDS instance.

Answer

Use a security group rule that allows traffic only on port 443.

Answer

Place both the EC2 instance and the RDS database in the same subnet and use a network ACL to enforce encryption.

Question 8

A company is designing a VPC with a public subnet for web servers and a private subnet for database servers. The web servers must be able to access the internet for software updates, but the database servers must not have direct internet access. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route to it in the private subnet's route table.. Option B is correct because a NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is incorrect because an internet gateway in the private subnet would allow direct inbound traffic. Option C is incorrect because a VPC endpoint is for accessing AWS services privately, not for general internet access. Option D is incorrect because a VPN connection does not provide internet access.

Answer

Use a VPC endpoint for Amazon S3 to provide internet access to the database servers.

Answer

Set up a VPN connection to an on-premises data center and route traffic through it.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet's route table.

Question 9

A company is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets across the organization are encrypted with AWS KMS. Which approach should be used to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) at the root level that denies S3 bucket creation unless encryption is configured.. Option C is correct because a service control policy (SCP) can be applied to the root organizational unit to deny creation or modification of S3 buckets without KMS encryption. Option A is incorrect because an SCP cannot be applied to individual S3 buckets; it applies to accounts. Option B is incorrect because IAM policies are account-specific and cannot enforce across the organization. Option D is incorrect because bucket policies are per-bucket and not centrally enforced.

Answer

Configure each S3 bucket with a bucket policy that denies access if encryption is not used.

Answer

Use AWS Config rules to detect unencrypted S3 buckets and automatically remediate them.

Answer

Create an IAM policy that denies creating S3 buckets without encryption and attach it to all users.

Question 10

Refer to the exhibit. A company has an S3 bucket policy that denies PutObject if the object is not encrypted with SSE-KMS. However, uploads are still being allowed without encryption. What is the most likely reason?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' is not present in the upload request, so the condition is not evaluated and the Deny is not applied.. Option D is correct because bucket policies are attached to the bucket, not explicitly attached to the bucket resource; however, the policy is evaluated based on the principal's permissions. The issue is that the condition key 's3:x-amz-server-side-encryption' is missing from the request header, so the condition is not met and the Deny is not applied. Option A is incorrect because IAM permissions are separate; the Deny in the bucket policy should override an Allow. Option B is incorrect because the condition uses StringNotEquals, which would deny if the header is present but not equal to 'aws:kms', but if the header is absent, the condition evaluates to false, and the Deny is not applied. Option C is incorrect because the policy is valid JSON.

Answer

The bucket policy has a syntax error and is not being enforced.

Answer

The IAM user has an explicit Allow that overrides the Deny in the bucket policy.

Answer

The bucket policy must be attached to the bucket in the same region as the request.

Question 11

A company is using AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. Option B is correct because AWS WAF has a managed rule group for SQL injection that can be added to the web ACL. Option A is incorrect because rate-based rules are for DDoS protection. Option C is incorrect because geo-match rules block based on geographic location. Option D is incorrect because IP set rules block based on source IP addresses.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 12

A network engineer is troubleshooting connectivity issues between an on-premises network and an Amazon VPC over an AWS Direct Connect connection. The on-premises network uses BGP to advertise routes to the VPC. The VPC is associated with a virtual private gateway (VGW). The on-premises network can reach resources in the VPC, but VPC resources cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.. Option C is correct because if the VPC's route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR, traffic from the VPC will not be sent over the Direct Connect. Option A is incorrect because BGP is used for route exchange; if on-premises can reach VPC, BGP is working. Option B is incorrect because security groups are stateful and allow return traffic. Option D is incorrect because the virtual private gateway needs to propagate routes to VPC route tables.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The BGP session is not established.

Answer

The security group associated with the VPC resources is blocking inbound traffic from on-premises.

Question 13

Refer to the exhibit. An IAM role ARN is shown. A security engineer wants to allow an EC2 instance to assume this role. What is required for the EC2 instance to successfully assume the role?

Accepted Answer

The role's trust policy must allow the EC2 service principal to assume the role, and the EC2 instance must be launched with an instance profile that includes this role.. Option A is correct because the trust policy of the role must allow the EC2 service to assume it. Additionally, the EC2 instance must have an instance profile with the role attached. Option B is incorrect because the role's permissions policy defines what the role can do, not who can assume it. Option C is incorrect because the EC2 instance does not need a public IP. Option D is incorrect because the trust policy must allow ec2.amazonaws.com, not the instance's IP address.

Answer

The trust policy must specify the EC2 instance's private IP address.

Answer

The role's permissions policy must include an Allow for the EC2 instance's security group.

Answer

The EC2 instance must have a public IP address to access the IAM endpoint.

Question 14

A company is deploying a web application in a VPC and wants to protect it from common web exploits like cross-site scripting (XSS). Which AWS service should be used to filter and monitor HTTP requests?

Accepted Answer

AWS WAF. Option A is correct because AWS WAF is a web application firewall that helps protect web applications from common exploits. Option B is incorrect because AWS Shield Advanced is for DDoS protection. Option C is incorrect because Network ACLs are stateless and at the subnet level. Option D is incorrect because Security Groups are stateful firewalls at the instance level.

Answer

Security Group

Answer

Network ACL

Answer

AWS Shield Advanced

Question 15

A company has a VPC with an internet gateway and wants to restrict outbound traffic from a private subnet to only allow traffic to specific AWS services, such as S3 and DynamoDB. Which solution should be used?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.. Option C is correct because VPC endpoints (Gateway or Interface) allow private subnet instances to access AWS services without traversing the internet, and they can be combined with bucket/endpoint policies to restrict access. Option A is incorrect because a NAT gateway allows all outbound traffic, not just to specific services. Option B is incorrect because security groups cannot filter by destination service. Option D is incorrect because an internet gateway would allow unrestricted outbound traffic.

Answer

Configure a security group on the instances in the private subnet to allow outbound traffic only to the IP ranges of the AWS services.

Answer

Use a NAT gateway in the public subnet and add a route to it in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet.