ANS-C01 Network Security, Compliance and Governance Practice Test 14 — 15 Questions

Question 1

A company wants to audit all network traffic to and from EC2 instances for security analysis. Which AWS service should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, making them the correct choice for auditing network traffic. Option A is correct. AWS CloudTrail records API calls, not network traffic. AWS Config records resource configuration changes. Amazon GuardDuty analyzes logs and flows for threats, but it does not capture the raw traffic itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 2

A company is designing a security group configuration for a three-tier web application (web, application, database). The web tier is accessible from the internet. Which TWO rules should be applied to meet security best practices?

Accepted Answer

App tier security group: inbound from the web tier security group on port 8080.. In a three-tier architecture, the web tier should be accessible from the internet, so the web tier security group should allow inbound traffic on port 443 (HTTPS) from 0.0.0.0/0 (option D). The application tier should be accessible only from the web tier, so its security group should allow inbound traffic on port 8080 from the web tier security group (option C). The database tier should be accessible only from the application tier, not directly from the web tier or internet. Therefore, options C and D meet best practices.

Answer

App tier security group: inbound from 0.0.0.0/0 on port 8080.

Answer

Database tier security group: inbound from the web tier security group on port 3306.

Answer

Database tier security group: inbound from 0.0.0.0/0 on port 3306.

Question 3

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which THREE services should they combine to protect against common web attacks and network threats?

Accepted Answer

Amazon GuardDuty. A defense-in-depth strategy for web applications includes AWS WAF to protect against web exploits (e.g., SQL injection, cross-site scripting), AWS Shield Advanced for comprehensive DDoS protection, and Amazon GuardDuty for continuous threat detection using anomaly detection and threat intelligence. Option D (AWS Direct Connect) is for dedicated network connectivity, not security. Option E (AWS Certificate Manager) is for SSL/TLS certificate management, not direct attack protection.

Answer

AWS Direct Connect

Answer

AWS Certificate Manager (ACM)

Question 4

A company needs to encrypt data in transit between an Application Load Balancer and EC2 instances. Which TWO actions should they take?

Accepted Answer

Upload a certificate to AWS Certificate Manager (ACM).. To encrypt traffic between the ALB and EC2 instances, you need to upload a certificate to AWS Certificate Manager (ACM) for the backend HTTPS listener (Option C) and configure the ALB target group to use HTTPS protocol (Option D). Option A (TCP listener) does not support encryption. Option B (CloudFront) is a CDN and not required for backend encryption. Option E (self-signed certificate) is not recommended for production environments.

Answer

Create a TCP listener on the ALB.

Answer

Place Amazon CloudFront in front of the ALB.

Answer

Use a self-signed certificate on the EC2 instances.

Question 5

A company runs a multi-tier application on AWS. The web tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application tier runs on EC2 instances in a separate Auto Scaling group, and the database tier uses an Amazon RDS MySQL instance. All resources are in the same VPC. The security team has identified that the application tier instances are receiving traffic from unknown IP addresses on port 22 (SSH). The team wants to ensure that only the web tier instances can communicate with the application tier on the application port (8080), and only from a specific security group. Additionally, the database tier should only accept traffic from the application tier on port 3306. Currently, the security groups are configured as follows: Web-SG allows inbound from 0.0.0.0/0 on ports 80 and 443; App-SG allows inbound from 0.0.0.0/0 on port 8080 and from 0.0.0.0/0 on port 22; DB-SG allows inbound from 0.0.0.0/0 on port 3306. The team has also noticed that the web tier instances can be accessed via SSH from the internet. Which course of action should the team take to remediate the security issues?

Accepted Answer

Update Web-SG to allow SSH from a specific management CIDR. Update App-SG to allow inbound on port 8080 from Web-SG only, and remove inbound SSH from App-SG (or restrict to management CIDR). Update DB-SG to allow inbound on port 3306 from App-SG only.. This option comprehensively addresses the security issues: restrict SSH access to the web tier from a trusted management CIDR, limit application tier access (port 8080) to only the web tier security group, and restrict database access (port 3306) to only the application tier security group. Additionally, it removes the overly permissive SSH rule on the application tier or restricts it to a management CIDR. Option A is insufficient because it leaves App-SG and DB-SG open to the internet on their respective ports. Option B removes SSH entirely, which may be needed for management, and does not address application traffic restrictions between tiers. Option D suggests using network ACLs, which are stateless and more complex; security groups are stateful and more appropriate for this use case.

Answer

Update Web-SG to allow SSH from a specific management CIDR. Leave App-SG and DB-SG as is because they are not directly accessible from the internet.

Answer

Remove inbound SSH rules from all security groups and rely on AWS Systems Manager Session Manager for administrative access.

Answer

Use network ACLs on the subnets to restrict traffic between tiers instead of security groups.

Question 6

A security engineer must ensure that all traffic between an application running on Amazon EC2 and an Amazon RDS database is encrypted in transit. The VPC has a public subnet for the EC2 instance and a private subnet for the RDS database. What is the MOST secure way to enforce encryption for this traffic?

Accepted Answer

Configure the RDS DB instance to require SSL/TLS connections and configure the application to connect using SSL.. Configuring the RDS DB instance to require SSL/TLS connections ensures that the application encrypts data in transit when connecting to the database. This is the most secure way to enforce encryption for traffic between EC2 and RDS. Option A is incorrect because IAM database authentication controls access, not encryption. Option B is incorrect because a security group rule allowing only port 443 does not enforce encryption; it only restricts traffic to that port. Option D is incorrect because placing both resources in the same subnet does not enforce encryption, and a network ACL is stateless and cannot enforce encryption.

Answer

Enable IAM database authentication for the RDS instance.

Answer

Use a security group rule that allows traffic only on port 443.

Answer

Place both the EC2 instance and the RDS database in the same subnet and use a network ACL to enforce encryption.

Question 7

A company is designing a VPC with a public subnet for web servers and a private subnet for database servers. The web servers must be able to access the internet for software updates, but the database servers must not have direct internet access. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route to it in the private subnet's route table.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is incorrect because a VPC endpoint for Amazon S3 only provides private access to S3, not general internet access. Option C is incorrect because a VPN connection to an on-premises data center does not provide internet access; it connects to the on-premises network. Option D is incorrect because attaching an internet gateway to a private subnet's route table would allow direct inbound internet traffic, violating the requirement that database servers must not have direct internet access.

Answer

Use a VPC endpoint for Amazon S3 to provide internet access to the database servers.

Answer

Set up a VPN connection to an on-premises data center and route traffic through it.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet's route table.

Question 8

A company is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets across the organization are encrypted with AWS KMS. Which approach should be used to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) at the root level that denies S3 bucket creation unless encryption is configured.. A service control policy (SCP) can be applied to the root organizational unit in AWS Organizations to centrally deny creating or modifying S3 buckets without KMS encryption across all accounts. Option A is incorrect because bucket policies are per-bucket and cannot enforce encryption at the organizational level. Option C is incorrect because AWS Config rules detect non-compliance after the fact but do not prevent creation; they require additional remediation. Option D is incorrect because IAM policies are account-specific and cannot be enforced across the entire organization.

Answer

Configure each S3 bucket with a bucket policy that denies access if encryption is not used.

Answer

Use AWS Config rules to detect unencrypted S3 buckets and automatically remediate them.

Answer

Create an IAM policy that denies creating S3 buckets without encryption and attach it to all users.

Question 9

Refer to the exhibit. A company has an S3 bucket policy that denies PutObject if the object is not encrypted with SSE-KMS. However, uploads are still being allowed without encryption. What is the most likely reason?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' is not present in the upload request, so the condition is not evaluated and the Deny is not applied.. The bucket policy uses a condition key 's3:x-amz-server-side-encryption' to deny uploads that are not encrypted with SSE-KMS. However, if the upload request does not include the 'x-amz-server-side-encryption' header at all, the condition key is not present in the request, so the condition is not evaluated. As a result, the Deny effect is not applied, and the upload is allowed. Option A is incorrect because the policy is valid JSON and would be enforced if the condition were met. Option B is incorrect because an explicit Allow in an IAM policy cannot override a Deny in a bucket policy; the Deny would still apply. Option D is incorrect because bucket policies are evaluated regardless of region as long as the bucket is in the same region as the request's endpoint; the region is not the issue here.

Answer

The bucket policy has a syntax error and is not being enforced.

Answer

The IAM user has an explicit Allow that overrides the Deny in the bucket policy.

Answer

The bucket policy must be attached to the bucket in the same region as the request.

Question 10

A company is using AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. AWS WAF provides a SQL injection match condition that inspects incoming requests for patterns indicative of SQL injection attacks. This condition can be used in a rule to block or allow requests. Option B is incorrect because geographic match rules block based on the geographic origin of the request, not SQL injection. Option C is incorrect because IP set rules block based on source IP addresses. Option D is incorrect because rate-based rules limit the rate of requests from an IP, not detect SQL injection.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 11

A network engineer is troubleshooting connectivity issues between an on-premises network and an Amazon VPC over an AWS Direct Connect connection. The on-premises network uses BGP to advertise routes to the VPC. The VPC is associated with a virtual private gateway (VGW). The on-premises network can reach resources in the VPC, but VPC resources cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.. For traffic from the VPC to reach on-premises resources, the VPC route tables must contain a route for the on-premises CIDR block that points to the virtual private gateway (VGW). Since on-premises can reach the VPC, the BGP session is established (so B is incorrect) and the VGW is attached (so A is incorrect). Security groups are stateful and allow return traffic; they do not block outbound-initiated traffic (so C is incorrect).

Answer

The virtual private gateway is not attached to the VPC.

Answer

The BGP session is not established.

Answer

The security group associated with the VPC resources is blocking inbound traffic from on-premises.

Question 12

Refer to the exhibit. An IAM role ARN is shown. A security engineer wants to allow an EC2 instance to assume this role. What is required for the EC2 instance to successfully assume the role?

Accepted Answer

The role's trust policy must allow the EC2 service principal to assume the role, and the EC2 instance must be launched with an instance profile that includes this role.. To allow an EC2 instance to assume an IAM role, two conditions must be met: 1) The role's trust policy must allow the EC2 service principal (ec2.amazonaws.com) to assume the role, 2) The EC2 instance must be launched with an instance profile that includes that role. This is correctly described in option B. Option A is incorrect because the trust policy specifies the service principal, not an IP address. Option C is incorrect because the permissions policy defines what the role can do, not who can assume it; the trust policy controls who can assume the role. Option D is incorrect because the EC2 instance can access the IAM endpoint via private IP as long as it has network connectivity (e.g., through a VPC endpoint or NAT), and a public IP is not required.

Answer

The trust policy must specify the EC2 instance's private IP address.

Answer

The role's permissions policy must include an Allow for the EC2 instance's security group.

Answer

The EC2 instance must have a public IP address to access the IAM endpoint.

Question 13

A company is deploying a web application in a VPC and wants to protect it from common web exploits like cross-site scripting (XSS). Which AWS service should be used to filter and monitor HTTP requests?

Accepted Answer

AWS WAF. AWS WAF, is the correct choice because it is a web application firewall specifically designed to filter and monitor HTTP/HTTPS requests to protect against common web exploits like cross-site scripting (XSS), SQL injection, and other OWASP Top 10 threats. Option A is incorrect because Security Groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic based on IP addresses and ports, not at the application layer. Option B is incorrect because Network ACLs are stateless subnet-level firewalls that also operate at the network layer, not the application layer. Option D is incorrect because AWS Shield Advanced provides DDoS protection, not web application filtering or monitoring of HTTP requests.

Answer

Security Group

Answer

Network ACL

Answer

AWS Shield Advanced

Question 14

A company has a VPC with an internet gateway and wants to restrict outbound traffic from a private subnet to only allow traffic to specific AWS services, such as S3 and DynamoDB. Which solution should be used?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.. VPC endpoints (Gateway endpoints for S3 and DynamoDB) allow private subnet instances to access these AWS services without traversing the internet, and endpoint policies can restrict access to specific services and actions. Option A is incorrect because security groups cannot filter by destination service; they filter by IP address, and AWS services use dynamic IP ranges. Option B is incorrect because a NAT gateway allows all outbound traffic to the internet, not just to specific services, and would not restrict to only S3 and DynamoDB. Option C is incorrect because an internet gateway would allow unrestricted outbound traffic to the internet, not just to specific AWS services.

Answer

Configure a security group on the instances in the private subnet to allow outbound traffic only to the IP ranges of the AWS services.

Answer

Use a NAT gateway in the public subnet and add a route to it in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet.

Question 15

Which TWO of the following are valid methods to secure data at rest in Amazon S3? (Choose two.)

Accepted Answer

Use SSE-S3 (Server-Side Encryption with S3 managed keys).. Options A and C are correct. SSE-S3 (Server-Side Encryption with S3 managed keys) encrypts data at rest on S3. Client-side encryption, where the customer encrypts data before uploading, also protects data at rest. Option B (SSL/TLS) encrypts data in transit, not at rest. Option D (VPC endpoint) restricts network access but does not encrypt. Option E (network ACL) controls traffic but does not encrypt data.

Answer

Use SSL/TLS to encrypt data during transfer.

Answer

Use a VPC endpoint to restrict access to the bucket.

Answer

Configure a network ACL to block unauthorized access.