ANS-C01 Network Security, Compliance and Governance Practice Test 14 — 15 Questions

Question 1

A company has a production VPC with a public subnet and a private subnet. The private subnet hosts a database instance that should be accessible only from the application servers in the same VPC. The security team has configured the database security group to allow inbound traffic on port 3306 from the application security group. However, the application servers cannot connect to the database. The network ACLs are configured with default allow all rules. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network ACL on the private subnet has an inbound deny rule for port 3306.. The network ACL on the private subnet is explicitly denying inbound traffic on port 3306, which overrides the security group's allow rule. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and must allow both inbound and outbound traffic. Since the NACL has a deny rule for port 3306, the database cannot receive connection requests from the application servers.

Answer

The database instance does not have an IAM role assigned.

Answer

The database security group does not allow outbound traffic for the response.

Answer

The VPC is peered with another VPC that has overlapping CIDR.

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no EC2 instance in any account can be launched with a public IP address unless it is in a specific VPC. Which solution will meet this requirement?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.. An SCP applied at the root OU can deny ec2:RunInstances when the request includes a public IP address, using the ec2:AssociatePublicIpAddress condition key, and can further limit based on VPC using conditions like ec2:Vpc. This centrally prevents non-compliant EC2 launches across all accounts. Option B is incorrect because IAM policies must be attached to each user/role individually and do not scale across accounts; SCPs are designed for this purpose. Option C is incorrect because AWS Config can detect non-compliant instances but cannot prevent the initial launch. Option D is incorrect because CloudWatch Events can trigger actions after launch but does not prevent the launch itself.

Answer

Create an IAM policy that denies ec2:RunInstances if the subnet is not in the allowed VPC, and attach it to all IAM users.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to stop any instance with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 3

A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?

Accepted Answer

The database security group inbound rule is not correctly referencing the web server security group ID.. Security groups are stateful, so return traffic is automatically allowed, but the inbound rule on the database SG must correctly reference the web server's security group ID. If the rule references the wrong SG ID (or a different SG attached to the instance), the connection on 3306 is denied even though the outbound rule on the web server SG is correct.

Answer

The network ACL on the private subnet denies inbound traffic on port 3306.

Answer

Security groups are stateful, so no outbound rule is needed; the issue is something else.

Answer

The web server security group does not allow outbound traffic to the database.

Question 4

A company has a Direct Connect connection to AWS with a private VIF to a VPC. They also have a VPN connection as a backup. The BGP sessions are established. They want to ensure that traffic from on-premises to the VPC prefers the Direct Connect path over the VPN. The on-premises router is advertising the same prefix to both connections. What should the network engineer configure on the AWS side?

Accepted Answer

Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.. To prefer the Direct Connect path over the VPN for traffic from on-premises to the VPC, the on-premises router should prepend its AS number multiple times for the routes advertised over the VPN connection. This increases the AS path length, making the Direct Connect path more preferred. AWS does not allow manipulation of BGP attributes on the customer side of the Direct Connect or VPN connections, so the change must be made on the on-premises router. Option A is incorrect because local preference is a Cisco-specific feature and affects outbound traffic, not inbound. Option B is incorrect because VPC route tables only apply to traffic inside the VPC, not to BGP path selection. Option C is incorrect because MED is typically used to influence outbound traffic from AWS to on-premises and is not as effective as AS path prepending for this scenario.

Answer

Set a higher local preference value on the on-premises router for the Direct Connect route.

Answer

Update the VPC route table to give higher priority to the Direct Connect route.

Answer

Set a lower MED value on the Direct Connect virtual interface.

Question 5

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a security requirement that all traffic between VPCs must be inspected by a third-party firewall deployed in a central inspection VPC. The Transit Gateway has route tables configured with blackhole routes for inter-VPC traffic, and the inspection VPC has the firewall. However, traffic is not being inspected; it is being dropped. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route table for inter-VPC traffic has blackhole routes instead of pointing to the inspection VPC attachment.. The correct answer is D: the Transit Gateway route table for inter-VPC traffic has blackhole routes instead of pointing to the inspection VPC attachment. Blackhole routes in a TGW route table explicitly discard matching traffic, so any VPC-to-VPC packets that match those routes are dropped rather than forwarded to the inspection VPC's firewall attachment. To achieve central inspection, the TGW route table must instead route inter-VPC traffic to the inspection VPC attachment, where the firewall can inspect and forward it onward. Option A is not the cause because route propagation from the inspection VPC would not fix blackhole routes that are already dropping traffic. Option B is a possible secondary issue but not the most likely cause given the explicitly configured blackhole routes. Option C is incorrect because the problem is the blackhole routes, not a missing static route to the inspection VPC.

Answer

The inspection VPC is not propagating its routes to the Transit Gateway.

Answer

The firewall appliance is not configured to forward traffic back to the Transit Gateway.

Answer

The Transit Gateway route tables do not have static routes for the inspection VPC.

Question 6

A company has a VPC with a public subnet hosting a web server and a private subnet hosting a database. The web server must connect to the database on port 3306. Security groups are configured: Web SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to DB SG on port 3306. DB SG allows inbound from Web SG on port 3306. Network ACLs are default. The web server can connect to the database, but the security team notices that the database is also receiving connections from an unexpected IP address. What is the MOST likely cause?

Accepted Answer

An unauthorized EC2 instance has been launched with the same Web security group attached.. The most likely cause is that an unauthorized EC2 instance has been launched with the same Web security group attached. Security groups are stateful and allow traffic based on the source security group, so any instance with the Web SG can connect to the DB on port 3306. If an attacker launches an instance with that SG, it can access the database, appearing as an unexpected IP.

Answer

The network ACL on the private subnet allows inbound traffic from all IPs.

Answer

The DB security group has an inbound rule allowing traffic from 0.0.0.0/0 on port 3306.

Answer

Security groups are stateful, so the DB SG automatically allows inbound responses.

Question 7

A company uses AWS Shield Advanced to protect their web application against DDoS attacks. They have a CloudFront distribution and an Application Load Balancer (ALB) as origins. They want to receive notifications when a DDoS attack is detected. What is the MOST comprehensive way to set up notifications?

Accepted Answer

Create a CloudWatch alarm on the AWS Shield Advanced metric DDoSDetected and configure an SNS notification.. AWS Shield Advanced provides DDoSDetected metrics in CloudWatch. You can create a CloudWatch alarm on this metric and configure an SNS notification to alert when a DDoS attack is detected. Option A is incorrect because Shield Advanced does not have automatic notification settings; it relies on CloudWatch alarms. Option B is incorrect because AWS Config monitors configuration changes, not DDoS events. Option D is incorrect because Route 53 health checks monitor endpoint health, not DDoS attacks.

Answer

Enable Shield Advanced automatic notifications in the AWS Shield console.

Answer

Set up AWS Config rules to detect changes in the Shield Advanced configuration and send alerts.

Answer

Use Amazon Route 53 health checks to monitor the application and send notifications on failure.

Question 8

A media company runs a VPC with a CIDR of 10.20.0.0/16. A third-party analytics vendor requires read access to a specific S3 bucket via a VPC endpoint. The security team must ensure that traffic to S3 stays entirely within the AWS network and that only the vendor's VPC endpoint can access the bucket. The vendor's VPC CIDR is 192.168.50.0/24. Which combination of configurations should the network engineer implement?

Accepted Answer

Create a gateway VPC endpoint for S3, attach it to the route table, and add a bucket policy that allows access only from the vendor's VPC endpoint ID using the aws:SourceVpce condition key.. A gateway VPC endpoint for S3 keeps traffic on the AWS network and supports the aws:SourceVpce condition key, which restricts bucket access to a specific endpoint. Combining the endpoint with a bucket policy that names the vendor's endpoint ID satisfies both the network-path and least-privilege requirements without exposing the bucket to other sources.

Answer

Create an interface VPC endpoint for S3, attach a security group allowing 192.168.50.0/24, and add a bucket policy restricting access to the vendor's account ID.

Answer

Create a gateway VPC endpoint for S3 and rely on the default route table entry to restrict access, since gateway endpoints automatically enforce source VPC restrictions.

Answer

Create an interface VPC endpoint for S3 in the vendor's VPC, share it via AWS Resource Access Manager, and reference the shared endpoint in the bucket policy using aws:SourceVpce.

Question 9

A company runs a three-tier web application in a VPC. The security team wants to inspect all traffic entering and leaving the VPC, including traffic between subnets, for intrusion detection and prevention. They need to deploy a third-party appliance that can inspect traffic at the VPC level and also inspect traffic between instances in different subnets. Which solution meets these requirements?

Accepted Answer

Deploy AWS Network Firewall in a dedicated inspection VPC and route all traffic through it using a transit gateway.. AWS Network Firewall is a managed service that provides VPC-level traffic inspection and filtering. By deploying it in a dedicated inspection VPC and routing traffic through a transit gateway, you can inspect traffic between VPCs and subnets, including east-west traffic. This satisfies the requirement for intrusion detection and prevention at the VPC level without managing third-party appliances.

Answer

Deploy a third-party firewall appliance on an EC2 instance in each subnet and configure route tables to redirect traffic.

Answer

Configure VPC Flow Logs to capture all traffic and analyze them with Amazon Detective.

Answer

Use AWS PrivateLink to create endpoints for each subnet and apply security groups to filter traffic.

Question 10

A company runs a three-tier web application in a VPC. The database tier resides in private subnets and must only accept connections from the application tier. A security engineer wants to restrict database access at the network layer so that even if an application instance is compromised, it cannot initiate outbound connections to the internet. The engineer decides to use security groups and network ACLs. Which combination of security group and network ACL rules will achieve this?

Accepted Answer

Security group on database instances allows inbound from the application security group; network ACL on the database subnet denies all outbound traffic except to the application subnet CIDR.. The database tier must only accept connections from the application tier and must not initiate internet connections. A security group referencing the application security group enforces the inbound restriction. A network ACL that denies all outbound except to the application subnet prevents the database from reaching the internet, while still allowing responses to the application tier.

Answer

Security group on database instances allows inbound from the application subnet CIDR; network ACL on the database subnet denies all outbound traffic.

Answer

Security group on database instances allows inbound from the application security group; network ACL on the database subnet allows all outbound traffic to 0.0.0.0/0.

Answer

Security group on database instances allows inbound from 0.0.0.0/0; network ACL on the database subnet allows outbound only to the application subnet CIDR.

Question 11

A company has a VPC with a subnet that hosts a critical application. The security team wants to restrict inbound traffic to only allow HTTPS (TCP port 443) from a specific IP range, and block all other inbound traffic. They also want to log all denied traffic. Which AWS service should they use to meet these requirements with the least operational overhead?

Accepted Answer

Network ACLs with inbound rules allowing TCP 443 from the specific IP range and denying all other traffic, and VPC Flow Logs to capture denied traffic.. Network ACLs are stateless and can explicitly deny traffic, making them suitable for subnet-level restrictions. By allowing only TCP 443 from the specified IP range and denying all other inbound traffic, they meet the security requirement. VPC Flow Logs can capture denied traffic, providing the necessary logging. This combination offers a simple, low-overhead solution.

Answer

Security groups with inbound rules allowing TCP 443 from the specific IP range, and VPC Flow Logs to capture denied traffic.

Answer

AWS WAF with a rule that allows TCP 443 from the specific IP range and blocks all other traffic, and logging enabled on the web ACL.

Answer

AWS Network Firewall with a stateless rule group that allows TCP 443 from the specific IP range and drops all other traffic, and logging enabled on the firewall.

Question 12

A company needs to ensure that all network traffic between their on-premises data center and their AWS VPC is encrypted and authenticated. They are using AWS Site-to-Site VPN. Which two configuration steps are required to meet these requirements? (Choose two.)

Accepted Answer

Use a customer gateway with a public IP address and configure the VPN connection to use pre-shared keys for authentication.. To encrypt and authenticate Site-to-Site VPN traffic, you must configure the VPN tunnels with strong encryption and integrity algorithms (such as AES-256 and SHA-256) and use authentication methods like pre-shared keys. The customer gateway must have a public IP to establish the VPN. These steps ensure that data is encrypted and endpoints are authenticated.

Answer

Attach an AWS WAF web ACL to the VPN connection to filter malicious traffic.

Answer

Enable AWS PrivateLink for the VPN connection to encrypt traffic.

Answer

Configure the VPN connection to use a static route instead of BGP for routing.

Question 13

A network security team is deploying AWS Network Firewall in a centralized inspection VPC that is attached to a transit gateway. Traffic from multiple spoke VPCs must be inspected before reaching the internet. The team needs to ensure that return traffic is handled correctly and that the firewall can inspect traffic in both directions. Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Enable appliance mode on the transit gateway attachment for the inspection VPC so that flow affinity is maintained for traffic traversing the firewall endpoint.. Centralized inspection with AWS Network Firewall and a transit gateway requires symmetric routing and appliance mode. Spoke route tables must point to the inspection VPC, the inspection VPC must route back to spoke CIDRs, and appliance mode keeps each flow on the same attachment and Availability Zone so the stateful firewall sees both directions of the connection.

Answer

Deploy the Network Firewall endpoint in a subnet that has a route table entry directing 0.0.0.0/0 to an internet gateway, and associate the firewall policy with the transit gateway attachment directly.

Answer

Attach an internet gateway directly to each spoke VPC and use Network Firewall in a distributed deployment to inspect traffic locally within each spoke.

Answer

Create a Network Firewall rule group with stateless rules only, since stateless rules automatically handle return traffic without requiring symmetric routing.

Question 14

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that all VPCs in the organization cannot be configured with a security group rule that allows unrestricted inbound access on port 22 from the internet. They need a preventive control that applies to all existing and future accounts. Which solution should be used?

Accepted Answer

Create a service control policy (SCP) in AWS Organizations that denies the ec2:AuthorizeSecurityGroupIngress action when the request includes port 22 and source 0.0.0.0/0.. Service control policies (SCPs) in AWS Organizations provide preventive guardrails that apply to all accounts. By denying the ec2:AuthorizeSecurityGroupIngress action when the request matches port 22 and source 0.0.0.0/0, the SCP blocks the creation of such rules at the API level. This is a preventive control that works across all accounts and does not rely on remediation.

Answer

Configure AWS Network Firewall in each VPC to block inbound SSH traffic from the internet.

Answer

Create an AWS Config rule in each account that checks for unrestricted SSH access and automatically remediates with a Lambda function.

Answer

Use AWS Firewall Manager to create a security group policy that audits and remediates security groups with unrestricted SSH access across all accounts.

Question 15

A security team needs every VPC in an AWS Organizations member account to send both accepted and rejected traffic logs to a central S3 bucket owned by the security account. They want new VPCs created by any account in the organization to be automatically covered without per-account manual configuration. Which combination of actions should a network engineer take to meet these requirements with the LEAST operational effort?

Accepted Answer

Create an AWS CloudFormation StackSet with service-managed permissions that deploys a VPC flow log to every VPC, and target it at the organizational unit in AWS Organizations.. A service-managed StackSet is the only mechanism listed that deploys resources across an AWS Organizations structure and automatically applies to accounts added to the target OU later. Placing the flow log creation in the template means every VPC in scope receives an ALL-traffic flow log delivering to the central S3 bucket, minimizing ongoing operational effort.

Answer

Enable VPC Flow Logs at the organization level from the AWS Organizations management account, choosing ALL traffic and the central S3 bucket as the destination.

Answer

Use AWS Config with a managed rule in each account to detect VPCs without flow logs, and rely on the rule's automatic remediation to create the flow log in every VPC.

Answer

Create a VPC flow log in the shared services account and share the resulting log group with all member accounts by using AWS Resource Access Manager.