ANS-C01 Network Security, Compliance and Governance Practice Test 13 — 15 Questions

Question 1

A company uses AWS Certificate Manager (ACM) to provision SSL/TLS certificates for their Application Load Balancer (ALB). They want to ensure that the ALB only accepts connections using TLS 1.2 or higher. How should they configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the ALB with an appropriate security policy that enforces TLS 1.2.. The Application Load Balancer supports security policies that allow you to enforce TLS 1.2 or higher. Option A is incorrect because ACM provides certificates but does not dictate the TLS version; that is determined by the load balancer's security policy. Option C is incorrect because while CloudFront can enforce TLS policies, it is an additional service and not required; the ALB itself can enforce TLS 1.2. Option D is incorrect because Route 53 is a DNS service and does not handle TLS version enforcement.

Answer

Use ACM to generate a certificate that only supports TLS 1.2.

Answer

Configure the ALB to use a CloudFront distribution with a TLS policy.

Answer

Use AWS Route 53 to enforce TLS version at the DNS level.

Question 2

A company is designing a network security architecture for a multi-tier application. They need to ensure that the web tier can only communicate with the app tier on port 443, and the app tier can only communicate with the database tier on port 3306. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a security group for the web tier that allows outbound traffic to the app tier security group on port 443.. Options A and B are correct because security groups are stateful and allow you to reference other security groups as sources or destinations, enabling granular control of traffic between tiers. Option A allows the web tier to send outbound traffic to the app tier on port 443, and Option B allows the app tier to receive that traffic from the web tier. Options C, D, and E are incorrect: AWS Network Firewall is unnecessary for this simple requirement; network ACLs are stateless and would require complex rules; a VPC endpoint policy only applies to VPC endpoints, not inter-tier traffic.

Answer

Deploy an AWS Network Firewall to inspect inter-tier traffic.

Answer

Use network ACLs to statelessly filter traffic on the subnets.

Answer

Configure a VPC endpoint policy to deny all traffic between tiers.

Question 3

A company has a VPC with multiple subnets and uses AWS Transit Gateway to connect to on-premises via AWS Direct Connect. They want to implement network segmentation so that certain VPCs can only communicate with specific on-premises networks. Which THREE components should they use? (Choose THREE.)

Accepted Answer

Direct Connect gateway. Options B, C, and D are correct. The Direct Connect gateway (B) integrates Direct Connect with Transit Gateway. The Transit Gateway association to the Direct Connect gateway (C) enables routing between VPCs and on-premises networks. Transit Gateway route tables (D) allow separate routing domains to segment traffic. Option A (VPC peering) is not needed because Transit Gateway already handles inter-VPC routing. Option E (Site-to-Site VPN) is not required when using Direct Connect for connectivity.

Answer

VPC peering connections

Answer

Site-to-Site VPN connection

Question 4

A company is designing a security group configuration for a three-tier application. The web servers must be accessible from the internet on ports 80 and 443. The application servers must only communicate with the web servers on port 8080. The database servers must only communicate with the application servers on port 3306. Which TWO of the following are best practices for implementing this with security groups? (Choose TWO.)

Accepted Answer

Use the security group ID of the web tier as the source in the app tier inbound rule.. Options A and D are correct. Using security group IDs as source in inbound rules ensures that only instances with the specified security group can communicate, providing fine-grained control. Option A allows web servers to communicate with app servers on port 8080. Option D allows app servers to communicate with database servers on port 3306. Option B is incorrect because using CIDR blocks is less secure and less granular than using security group IDs. Option C is incorrect because network ACLs are stateless and operate at the subnet level, not at the instance level; security groups are more appropriate for this requirement. Option E is incorrect because assigning the same security group to all instances would allow all instances to communicate with each other, violating the principle of least privilege.

Answer

Use the CIDR block of the subnet for the source security group rules.

Answer

Use network ACLs to enforce rules at the subnet level instead of security groups.

Answer

Assign the same security group to all instances to simplify management.

Question 5

An IAM policy is applied to a user. The user reports that they cannot run 'aws ec2 describe-instances --region eu-west-1' but can run the same command in us-east-1. What is the most likely reason?

Accepted Answer

The policy denies ec2:Describe* when the region is not us-east-1.. The condition 'StringNotEquals' with 'aws:RequestedRegion' denies the action if the region is not us-east-1. Option A is wrong because the policy explicitly denies ec2:Describe* actions. Option B is wrong because the condition is StringNotEquals, not StringEquals. Option D is wrong because the policy does not specify resource-level conditions.

Answer

The policy only applies to resources in us-east-1, so other regions are implicitly denied.

Answer

The policy condition uses StringEquals, which only allows requests from us-east-1.

Answer

The policy allows ec2:Describe* in all regions, but the user lacks permissions in eu-west-1.

Question 6

A network engineer is troubleshooting connectivity from an EC2 instance in subnet-12345678 to a server on the internet. The instance has a public IP and a security group allowing all outbound traffic. However, traffic fails. Based on the exhibit, what is the issue?

Accepted Answer

The inbound rule only allows TCP traffic, which blocks return traffic for other protocols.. The inbound rule (egress=false) only allows TCP (protocol 6) on port unspecified (all ports), but the outbound rule allows all traffic. However, the inbound rule only allows TCP, so return traffic for non-TCP protocols (like ICMP) is blocked. But the question says connectivity fails, likely because the instance initiates outbound traffic (e.g., HTTP), which is TCP, so that should work. Actually, the issue is that the outbound rule allows all traffic, but the inbound rule only allows TCP, so return traffic for non-TCP (like UDP or ICMP) is blocked. But typical HTTP uses TCP, so maybe the issue is something else. Let's re-evaluate: The outbound rule allows all traffic (protocol -1), but the inbound rule only allows TCP. For outbound connections, the return traffic is inbound, so if the outbound connection is TCP, the return TCP packets are allowed by the inbound rule. However, if the outbound traffic is something else like ICMP (ping), the return ICMP is blocked. The question does not specify the protocol. Option A is correct because the inbound rule only allows TCP, blocking other protocols. Option B is wrong because the outbound rule allows all traffic. Option C is wrong because the security group allows outbound. Option D is wrong because the inbound rule does not restrict TCP on ephemeral ports; it allows TCP from 0.0.0.0/0.

Answer

The inbound rule blocks TCP traffic on ephemeral ports.

Answer

The outbound rule blocks all traffic.

Answer

The security group does not allow outbound traffic.

Question 7

A network engineer runs the above command and sees that VPC Flow Logs are configured for a VPC. The engineer wants to analyze rejected traffic to troubleshoot a connectivity issue. Which field in the flow log records should they examine?

Accepted Answer

action. The 'action' field in VPC Flow Logs indicates ACCEPT or REJECT. Option A is wrong because 'srcaddr' is source IP. Option C is wrong because 'dstport' is destination port. Option D is wrong because 'protocol' is the protocol number.

Answer

protocol

Answer

srcaddr

Answer

dstport

Question 8

A company uses AWS Organizations with multiple accounts and wants to centrally manage VPC security group rules. They need to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which service should they use to automatically detect and remediate noncompliant security groups?

Accepted Answer

AWS Config. AWS Config with managed rules like restricted-ssh can detect noncompliant security groups, and AWS Config remediation actions can automatically remediate them. AWS Firewall Manager can also centrally manage security group rules across accounts, but it is more about enforcement and policy management. Option A is correct because AWS Config is the primary service for compliance monitoring and remediation. Option C (AWS Firewall Manager) is also a valid service but is more for policy-based management across accounts; however, the question asks for detection and automatic remediation, which AWS Config does directly. Option D (AWS CloudTrail) is for auditing API calls, not for enforcement. Option B (Amazon GuardDuty) is for threat detection, not security group compliance.

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Answer

AWS CloudTrail

Question 9

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must only accept traffic from known corporate IP addresses, but the company also needs to allow healthy traffic from AWS health checkers. Which architecture meets these requirements securely?

Accepted Answer

Configure the Application Load Balancer's security group to allow inbound from corporate IPs, and the EC2 instances' security group to allow inbound from the ALB's security group.. The correct approach is to use security groups. The ALB security group should allow inbound from corporate IPs, and the EC2 instances' security group should allow inbound only from the ALB's security group. This ensures that traffic from the internet first passes through the ALB, which performs health checks using its private IPs (which are part of the ALB's security group). Option B is incorrect because having multiple target groups does not control traffic filtering. Option C (WAF) can filter by IP but still requires allowing health check traffic, and it adds unnecessary complexity. Option D (NACL) is stateless and would require complex rules to allow return traffic and health checks, making it less secure and manageable.

Answer

Create two target groups: one for corporate traffic and one for health check traffic, each with different security groups.

Answer

Use AWS WAF on the ALB to create an IP set containing corporate IPs, and allow all traffic from ALB to instances.

Answer

Use a network ACL on the VPC subnet to allow inbound traffic from corporate IPs and AWS health checker IP ranges.

Question 10

A security engineer needs to audit all API calls that modify security group rules in a VPC. Which AWS service should be used to record these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to the AWS API, including modifications to security group rules. Option A is correct. AWS Config records resource configuration changes but not API calls. VPC Flow Logs capture network traffic logs, not API calls. Amazon Inspector is for vulnerability assessment.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs

Question 11

A company is designing a multi-account AWS environment using AWS Organizations. They want to restrict the use of certain instance types across all accounts. Which approach should they use to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action for noncompliant instance types and attach it to the root organizational unit.. Service control policies (SCPs) in AWS Organizations can be used to restrict the use of specific instance types across all member accounts from a central location. Option B is correct. IAM policies are account-specific and cannot be applied across all accounts from a central location. AWS Config can detect noncompliant instances but cannot prevent them from being launched. AWS CloudTrail is for auditing, not enforcement.

Answer

Create an IAM policy that denies the ec2:RunInstances action for noncompliant instance types and attach it to each IAM user.

Answer

Set up AWS Config rules to detect noncompliant instances and trigger an AWS Lambda function to terminate them.

Answer

Use AWS CloudTrail to monitor ec2:RunInstances events and send alerts.

Question 12

A company has deployed a web application on an EC2 instance that needs to access an S3 bucket and a DynamoDB table. The instance is in a private subnet. Which approach meets the security best practice of avoiding long-lived credentials on the instance?

Accepted Answer

Create an IAM role with policies granting access to S3 and DynamoDB, and attach the role to the EC2 instance profile.. The best practice is to attach an IAM role with the necessary permissions to the EC2 instance. The instance automatically obtains temporary credentials via the instance metadata service, avoiding long-lived credentials. Option D is correct. Option A (IAM user access keys) is not recommended as they are long-lived. Option B (security group rules) controls network traffic but does not grant access to S3 or DynamoDB. Option C (AWS Systems Manager Parameter Store) still requires credentials to access the parameters, which would not eliminate long-lived credentials.

Answer

Store IAM user access keys in the application configuration file.

Answer

Configure security group rules to allow outbound traffic to S3 and DynamoDB endpoints.

Answer

Use AWS Systems Manager Parameter Store to store credentials and retrieve them at runtime using the instance's IAM role.

Question 13

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can manage the encryption keys if the company wants to use server-side encryption with AWS KMS?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the service that manages encryption keys for server-side encryption (SSE-KMS). Option D is correct. AWS Certificate Manager (ACM) manages SSL/TLS certificates. AWS CloudHSM provides dedicated hardware security modules but is not required for SSE-KMS. AWS Secrets Manager manages secrets like database credentials.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Question 14

A company has a VPC with public and private subnets. They have an EC2 instance in a private subnet that needs to access the internet for software updates. Which solution provides internet access while keeping the instance private?

Accepted Answer

Create a NAT gateway in a public subnet, and update the private subnet's route table to point 0.0.0.0/0 to the NAT gateway.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic while preventing inbound traffic from the internet. Option B is correct. Option A (internet gateway) would expose the instance to inbound traffic if assigned a public IP. Option C (VPC peering) does not provide internet access. Option D (VPC endpoint) only provides access to specific AWS services, not general internet.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Answer

Use an AWS PrivateLink VPC endpoint for the software update service.

Answer

Set up a VPC peering connection with another VPC that has internet access.

Question 15

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect. They want to ensure that only traffic from specific on-premises IP ranges is allowed into the production VPC. Which approach should they use?

Accepted Answer

Deploy AWS Network Firewall in the production VPC and configure stateful rule groups to allow only the on-premises IP ranges.. The company wants to allow only specific on-premises IP ranges into the production VPC. Transit Gateway handles routing between attachments, but it does not filter traffic based on IP addresses. AWS Network Firewall is a managed firewall service that can be deployed in a VPC to inspect and filter traffic. By deploying Network Firewall in the production VPC and configuring stateful rule groups, the company can allow only traffic from the specified on-premises IP ranges and deny all other traffic. This approach provides granular control and is a recommended practice. Option A is incorrect because a Direct Connect gateway only advertises routes; it does not filter traffic. Option C is incorrect because Transit Gateway route tables control routing, not filtering; they cannot blackhole traffic based on source IP. Option D is incorrect because VPC peering is used for connecting VPCs, not for connecting on-premises networks via Direct Connect.

Answer

Configure the Direct Connect gateway to only advertise specific prefixes to the Transit Gateway.

Answer

Use Transit Gateway route tables to blackhole traffic from other IP ranges.

Answer

Create a VPC peering connection between the on-premises network and the production VPC.