ANS-C01 Network Security, Compliance and Governance Practice Test 15 — 15 Questions

Question 1

Which THREE of the following are best practices for securing a VPC? (Choose three.)

Accepted Answer

Enable AWS Shield Advanced for DDoS protection.. Options A, B, and C are correct. Enabling AWS Shield Advanced provides DDoS protection for VPC resources with public endpoints. Security groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic. Network ACLs provide a stateless layer of defense at the subnet level, complementing security groups. Option D is incorrect because allowing all outbound traffic is not a security best practice; outbound traffic should be restricted to only necessary destinations. Option E is incorrect because the default security group should be restrictive, not allowing all traffic.

Answer

Allow all outbound traffic from the VPC to the internet.

Answer

Assign a default security group that allows all traffic.

Question 2

Which TWO of the following are valid ways to encrypt data in transit between an on-premises data center and an Amazon VPC? (Choose two.)

Accepted Answer

Use AWS Site-to-Site VPN.. Options A and C are correct. AWS Site-to-Site VPN creates an IPSec tunnel, encrypting all traffic. AWS Direct Connect can be combined with a VPN over the connection to encrypt traffic. Option B is incorrect because Direct Connect alone does not provide encryption. Option D is incorrect because VPC peering does not encrypt traffic. Option E is incorrect because internet gateway does not encrypt traffic.

Answer

Use AWS Direct Connect without any additional encryption.

Answer

Use VPC peering.

Answer

Use an internet gateway with a security group.

Question 3

A company has a hybrid network architecture with an AWS Direct Connect connection between its on-premises data center and an Amazon VPC. The VPC has a single private subnet with Amazon EC2 instances running a critical application. The on-premises network uses BGP to advertise a route for the VPC's CIDR (10.0.0.0/16) to the on-premises routers. Recently, the company added a new application in a second VPC (VPC-B) with CIDR 10.1.0.0/16 and peered it with the original VPC (VPC-A). After the peering, users on-premises can still reach resources in VPC-A, but cannot reach resources in VPC-B. The VPC-A route table has a route for VPC-B's CIDR pointing to the peering connection. The VPC-B route table has a route for VPC-A's CIDR pointing to the peering connection. The on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface. What is the most likely cause of the issue?

Accepted Answer

The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.. The on-premises network is not advertising VPC-B's CIDR via BGP over Direct Connect. While the on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface, this only directs traffic from on-premises to VPC-B. For return traffic from VPC-B to on-premises, VPC-B needs a route to the on-premises network. Normally, this route would be learned via BGP over Direct Connect if the on-premises network advertised the VPC-B CIDR to the VPC. Without that advertisement, VPC-B does not have a route back to on-premises, causing the connectivity failure. Option A is incorrect because the VPC peering connection is working: VPC-A and VPC-B can communicate, as the issue is only with on-premises reachability. Option C is incorrect because security groups are stateful; if traffic from on-premises reached VPC-B, the return traffic would be automatically allowed. The issue is routing, not security. Option D is incorrect because route propagation for the virtual private gateway only affects VPC-A (if it is attached to the VGW), not VPC-B, which is connected via peering.

Answer

The VPC peering connection is not properly configured.

Answer

The security group on VPC-B instances is blocking inbound traffic from on-premises IP ranges.

Answer

The virtual private gateway does not have route propagation enabled for VPC-B.

Question 4

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to implement a centralized inspection architecture where all traffic between VPCs must be inspected by a security appliance (e.g., firewall) deployed in a dedicated inspection VPC. Currently, traffic flows directly between VPCs using the Transit Gateway. Which architecture change would enforce that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

Configure the Transit Gateway to use separate route tables for each VPC attachment, with a default route pointing to the inspection VPC's attachment. Then, in the inspection VPC, route traffic back to the Transit Gateway for final delivery.. By using Transit Gateway route tables, you can create separate route tables for each VPC attachment and propagate only a default route pointing to the inspection VPC. This forces all traffic to go through the inspection VPC. Option A is incorrect because VPC peering does not integrate with Transit Gateway. Option C is incorrect because Direct Connect Gateway is for on-premises connectivity, not for inter-VPC routing. Option D is incorrect because Network Load Balancer does not provide routing control.

Answer

Create VPC peering connections between each VPC and the inspection VPC, and remove the Transit Gateway attachments.

Answer

Use AWS Direct Connect Gateway to route traffic through the inspection VPC.

Answer

Deploy a Network Load Balancer in each VPC and configure it to forward traffic to the inspection VPC.

Question 5

A company hosts a multi-tier web application in a VPC. The web servers are in a public subnet, and the application servers are in a private subnet. The application servers need to access a third-party API over the internet. The company wants to ensure that the application servers' IP addresses are not exposed to the internet, and that all outbound traffic to the internet is logged. Additionally, the company wants to restrict outbound traffic to only the specific API endpoints. Which solution should be used?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT gateway. Use security groups on the application servers to restrict outbound traffic to the API endpoints. Enable logs on the NAT gateway using VPC Flow Logs or NAT gateway logs.. A NAT gateway in a public subnet allows instances in private subnets to access the internet while hiding their private IPs. By controlling the outbound rules in the security group or using a network firewall, you can restrict traffic to specific API endpoints. AWS CloudWatch Logs or VPC Flow Logs can capture the NAT gateway logs. Option A is incorrect because a VPC endpoint is used for accessing AWS services privately and cannot be used for internet API access. Option B is incorrect because attaching an internet gateway directly to the private subnet would expose the instances' private IPs to the internet. Option C is incorrect because while a proxy server could work, it adds unnecessary complexity and management overhead compared to a NAT gateway.

Answer

Use a VPC endpoint for the third-party API service.

Answer

Attach an internet gateway directly to the private subnet and configure the route table to send default traffic to the internet gateway. Use security groups to restrict outbound traffic to the API endpoints. Enable VPC Flow Logs for logging.

Answer

Deploy a proxy server in the public subnet and configure the application servers to use the proxy. Restrict outbound traffic from the proxy using security groups. Log proxy access logs.

Question 6

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which policy type should be used?

Accepted Answer

Attach an S3 bucket policy with a condition for aws:SourceVpc. S3 bucket policies support condition keys like `aws:SourceVpc` to restrict access to traffic originating from a specific VPC. Option D is correct because attaching a bucket policy with this condition directly limits access to the desired VPC. Option A is incorrect because a VPC endpoint policy controls actions allowed via the endpoint, but does not replace the need for a bucket policy. Option B is incorrect because network ACLs operate at the subnet level and cannot enforce S3 access restrictions. Option C is incorrect because while S3 access points can have policies, they are not the primary method for restricting access by VPC; a bucket policy with the `aws:SourceVpc` condition is the appropriate approach.

Answer

Configure a VPC endpoint policy

Answer

Configure a network ACL to block all traffic except from the VPC CIDR

Answer

Use an S3 access point with a network origin condition

Question 7

A security engineer is designing a hybrid network with an AWS Site-to-Site VPN. The company requires that all traffic between the on-premises network and VPC be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Use AWS Site-to-Site VPN with IPsec tunnels. AWS Site-to-Site VPN inherently uses IPsec tunnels to encrypt all traffic. Option A is wrong because VPC peering does not provide encryption; it uses the AWS network without encryption. Option B is wrong because Direct Connect does not encrypt by default; MACsec is an optional encryption layer but not the standard Site-to-Site VPN. Option C is wrong because Transit Gateway itself is a network transit hub and does not provide encryption; it can route encrypted VPN traffic but does not encrypt.

Answer

Use VPC peering instead of VPN

Answer

Use AWS Direct Connect with MACsec

Answer

Deploy a Transit Gateway with route tables

Question 8

A company has multiple AWS accounts under AWS Organizations. The security team wants to centrally log all network traffic that is denied by security group rules across all accounts. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Enable VPC Flow Logs with organization-level aggregation and publish to a central S3 bucket. VPC Flow Logs can capture rejected traffic, and publishing to a central S3 bucket using Organization-level aggregation simplifies management. Option D is correct because it uses VPC Flow Logs with organization-level aggregation. Option A is wrong because AWS Config does not log network traffic. Option B is wrong because it requires per-account setup. Option C is wrong because CloudTrail does not capture network flows.

Answer

Enable AWS Config rules for security group changes and send logs to a central account

Answer

Create VPC Flow Logs in each account and publish to a central S3 bucket

Answer

Use AWS CloudTrail to log all API calls and filter for security group events

Question 9

A company uses AWS Direct Connect to connect its data center to a VPC. The security team wants to ensure that only the on-premises network can initiate connections to EC2 instances in the VPC, but the EC2 instances should be allowed to initiate outbound connections to the internet. Which configuration should be implemented?

Accepted Answer

Configure a security group with inbound allow from on-premises CIDR and outbound allow to 0.0.0.0/0. Security groups are stateful, so allowing inbound from on-premises and outbound to 0.0.0.0/0 works. Option B is correct because security groups automatically allow return traffic. Option A is wrong because NACLs are stateless and require explicit rules for return traffic; allowing inbound from on-premises and outbound to 0.0.0.0/0 would not automatically allow return traffic, so responses from EC2 instances to on-premises would be blocked. Option C is wrong because it would allow all inbound traffic from any source, not limiting to on-premises. Option D is wrong because it would deny all inbound traffic, blocking necessary connections from on-premises.

Answer

Configure a network ACL with inbound allow from on-premises CIDR and outbound allow to 0.0.0.0/0

Answer

Configure a network ACL with inbound allow from 0.0.0.0/0 and outbound allow to 0.0.0.0/0

Answer

Configure a security group with inbound deny from 0.0.0.0/0 and outbound allow to 0.0.0.0/0

Question 10

A company has a VPC with public and private subnets. The public subnet hosts a web server that must be accessible from the internet. The private subnet hosts a database that should only be accessible from the web server. Which security group configuration should be used?

Accepted Answer

Database security group: inbound rule allowing traffic from the web server security group on the database port. Security groups can reference other security groups as sources. Option A is correct because it allows traffic from the web server's security group, which ensures only the web server can access the database. Option B is wrong because it allows all traffic from the VPC CIDR, which is too permissive. Option C is wrong because it allows traffic from a specific private IP, but that IP might change and is less flexible than using the security group. Option D is wrong because it allows traffic from 0.0.0.0/0, which permits inbound traffic from any IP address, making the database publicly accessible.

Answer

Database security group: inbound rule allowing traffic from the VPC CIDR on the database port

Answer

Database security group: inbound rule allowing traffic from the web server's private IP on the database port

Answer

Database security group: inbound rule allowing traffic from 0.0.0.0/0 on the database port

Question 11

A company is deploying a multi-tier web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that the web servers only accept traffic from the ALB and that the ALB only accepts traffic from the internet on ports 80 and 443. Additionally, the web servers should be able to make outbound connections to the internet for updates. Which combination of security group rules meets these requirements?

Accepted Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from ALB SG on app port, outbound to 0.0.0.0/0 on ephemeral. The ALB security group should allow inbound from 0.0.0.0/0 on ports 80 and 443, and outbound to the web server security group on the application port. The web server security group should allow inbound from the ALB security group on the application port, and outbound to 0.0.0.0/0 on ephemeral ports to allow outbound internet access for updates. Option B correctly describes these rules. Option A is incorrect because it suggests using NACLs instead, which are stateless and less granular for security group requirements. Option C is incorrect because the ALB outbound rule should allow traffic to web servers, not deny all. Option D is incorrect because the web server inbound should be from the ALB security group, not the VPC CIDR, to ensure only ALB traffic is received.

Answer

Use network ACLs instead: public subnet NACL allow 80/443 inbound, private subnet NACL allow from ALB on app port

Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound deny all; Web SG: inbound from ALB SG on app port, outbound allow all

Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from VPC CIDR on app port, outbound to 0.0.0.0/0 on ephemeral

Question 12

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region and the peering connection is in the 'active' state. Security groups in both VPCs allow all traffic. However, instances in VPC A cannot reach instances in VPC B. What is the most likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes pointing to the peering connection. VPC peering requires route table entries in both VPCs to direct traffic to the peering connection. Option C is correct because missing routes are a common issue. Option A is wrong because security groups allow all traffic. Option B is wrong because the peering connection is active. Option D is wrong because network ACLs are not mentioned as blocking, and they are stateless but the issue is more likely routing.

Answer

Security groups are blocking traffic between the VPCs

Answer

The VPC peering connection is in the 'pending-acceptance' state

Answer

Network ACLs are blocking traffic between the VPCs

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket for backups. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach a bucket policy allowing access from the VPC. A VPC Gateway Endpoint for S3 provides private connectivity to S3 from within the VPC without needing an internet gateway, NAT gateway, or VPN. This minimizes data transfer costs and avoids internet traversal. Option A (Gateway Endpoint) is the correct solution. Option B (proxy server) introduces additional complexity and cost, and does not avoid internet traversal. Option C (Interface Endpoint) is more expensive and is not necessary because S3 supports Gateway Endpoints. Option D (public subnet with NAT) requires the instance to have a public IP and uses a NAT gateway, which incurs costs and uses the internet.

Answer

Set up a proxy server in the public subnet and configure the EC2 instance to use it

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Place the EC2 instance in a public subnet with a public IP and use a NAT gateway

Question 14

A company uses AWS WAF to protect its web application from common exploits. The security team notices that a specific IP address is generating a high volume of requests and should be blocked immediately. Which action should be taken?

Accepted Answer

Update the AWS WAF IP set rule to block the IP address. AWS WAF allows creating IP set rules to block specific IP addresses. Therefore, the correct action is to update the IP set rule to include the problematic IP. Option A is correct. Option B is wrong because security groups operate at the network layer and are not integrated with WAF. Option C is wrong because NACLs are stateless and not suitable for application-layer blocking. Option D is wrong because CloudFront geo-restriction blocks based on geographic location, not individual IPs.

Answer

Add a rule to the security group to deny traffic from that IP

Answer

Add a network ACL rule to deny traffic from that IP in the subnet

Answer

Use AWS CloudFront geo-restriction to block the IP

Question 15

A company wants to encrypt all data in transit between its on-premises data center and AWS. Which two services or features can provide encryption for data in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN uses IPsec to encrypt traffic between on-premises and AWS, providing encryption in transit. AWS Direct Connect with MACsec provides encryption at Layer 2. Options C and E are correct. Option A is wrong because AWS PrivateLink does not encrypt traffic between on-premises and AWS; it only provides private connectivity within AWS. Option B is wrong because VPC peering does not inherently encrypt traffic. Option D is wrong because AWS Transit Gateway is a network transit hub and does not provide encryption by itself.

Answer

AWS PrivateLink

Answer

VPC peering

Answer

AWS Transit Gateway