ANS-C01 Network Security, Compliance and Governance Practice Test 15 — 15 Questions

Question 1

A company wants to encrypt all data in transit between its on-premises data center and AWS. Which two services or features can provide encryption for data in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN uses IPsec to encrypt traffic. AWS Direct Connect with MACsec provides encryption at Layer 2. Option B and D are correct. Option A is wrong because Transit Gateway does not encrypt. Option C is wrong because VPC peering does not encrypt. Option E is wrong because PrivateLink encrypts traffic within AWS but not between on-premises and AWS.

Answer

AWS PrivateLink

Answer

VPC peering

Answer

AWS Transit Gateway

Question 2

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team wants to implement defense in depth. Which three layers of security should be configured?

Accepted Answer

Security groups. Security groups act as virtual firewalls at the instance level. Network ACLs provide stateless filtering at the subnet level. AWS WAF protects web applications at the application layer. Option A, C, and D are correct. Option B is wrong because IAM is identity and access management, not network security. Option E is wrong because VPC Flow Logs are for monitoring, not blocking traffic.

Answer

AWS Identity and Access Management (IAM) policies

Answer

VPC Flow Logs

Question 3

A company has a VPC with multiple subnets and is using Network Access Analyzer to identify unintended network access. It reports that an EC2 instance in a private subnet has a route to an internet gateway. Which two actions should be taken to remediate this?

Accepted Answer

Ensure the EC2 instance does not have a public IP address. The instance should not have a route to the internet. Removing the route from the subnet's route table and ensuring the instance does not have a public IP are correct. Option A and D are correct. Option B is wrong because a NAT gateway would still allow outbound internet. Option C is wrong because security groups do not affect routing. Option E is wrong because the instance may not have a public IP already.

Answer

Assign a public IP address to the instance

Answer

Update the security group to deny outbound traffic to 0.0.0.0/0

Answer

Attach a NAT gateway to the private subnet

Question 4

Refer to the exhibit. A company has attached the IAM policy to an S3 bucket named example-bucket. Users report they cannot access objects in the bucket even when coming from the allowed IP range. What is the most likely cause?

Accepted Answer

S3 Block Public Access settings are enabled, overriding the policy. The policy allows anonymous access (Principal: "*"). However, S3 bucket policies require explicit context; if the bucket is not configured for public access, the policy is ignored. Option C is correct because S3 Block Public Access settings can override the policy. Option A is wrong because the policy does allow from that range. Option B is wrong because the condition is correct. Option D is wrong because the policy is valid.

Answer

The policy syntax is invalid because of the Principal element

Answer

The IP address range in the condition does not match the users' IP

Answer

The condition uses aws:SourceIp incorrectly

Question 5

Refer to the exhibit. A network engineer is analyzing a VPC Flow Log record from a VPC with CIDR 10.0.0.0/16. The record indicates a REJECT action. Which component is most likely blocking the traffic?

Accepted Answer

The destination instance's security group. Flow logs record traffic after security group and NACL evaluation. A REJECT indicates the traffic was dropped by a security group or NACL. Since the destination port is 80 (HTTP), a security group is likely blocking inbound HTTP. Option C is correct. Option A is wrong because the source IP is within the VPC. Option B is wrong because there is no indication of a missing route. Option D is wrong because NACL rules are stateless and would show REJECT if they block, but security groups are more common for instance-level blocking.

Answer

The destination instance's operating system firewall

Answer

A missing route in the route table

Answer

The network ACL of the destination subnet

Question 6

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains several EC2 instances that need to download software updates from the internet. The security team has configured the following: - A security group on the EC2 instances allows outbound traffic to 0.0.0.0/0 on ports 443 and 80. - The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT gateway. - The NAT gateway is in the public subnet with an Elastic IP and its security group allows inbound traffic from the private subnet CIDR on ports 443 and 80, and outbound to 0.0.0.0/0 on all ports. Despite this, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group inbound rule is too restrictive. Option B is correct because the NAT gateway's security group inbound rule should allow traffic from the private subnet on ephemeral ports (1024-65535), not just ports 443 and 80. The outbound connection from the EC2 instance uses a random source port, and the NAT gateway must receive that return traffic. Option A is wrong because the route is correct. Option C is wrong because the NAT gateway is in the public subnet with an EIP, so it can reach the internet. Option D is wrong because the security group on the EC2 instances allows outbound traffic.

Answer

The NAT gateway does not have an Elastic IP associated

Answer

The route table of the private subnet does not have a route to the NAT gateway

Answer

The EC2 instances' security group does not allow inbound traffic from the NAT gateway

Question 7

A company has a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The security team requires that all traffic between VPCs must be inspected by a centralized firewall appliance deployed in a security VPC. They have configured a Transit Gateway with a route table that has blackhole routes for all VPC CIDRs except the security VPC, and the security VPC appliance performs inspection and returns traffic to the Transit Gateway. Recently, they added a new VPC for a critical application. After configuration, some traffic from the new VPC to other VPCs is being dropped. The network engineer verifies that the Transit Gateway route table includes a blackhole route for the new VPC's CIDR and that the security VPC's firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.

Answer

The security VPC's network ACLs are blocking return traffic from the firewall appliance back to the Transit Gateway.

Answer

The new VPC's route table does not have a default route pointing to the Transit Gateway attachment.

Answer

The Transit Gateway route table propagates the new VPC's CIDR, overriding the static blackhole route.

Question 8

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS and that bucket policies restrict access to specific IAM roles. They have created an SCP that denies s3:PutBucketPolicy unless the bucket is encrypted with KMS (using a condition) and restricts the PutBucketPolicy action to a specific role. After applying the SCP, the development team reports that they cannot update bucket policies even when using the allowed role. The SCP is attached to the root OU. The allowed role is in the dev account and has full S3 permissions via an IAM policy. What is the most likely reason for the failure?

Accepted Answer

The SCP denies s3:PutBucketPolicy for all principals except the allowed role, but the SCP is applied at the root OU and affects all accounts, so the allowed role is still denied because SCPs are deny-by-default and the allow list in the SCP does not override the implicit deny.

Answer

The SCP must be applied to the dev account specifically, not the root OU, because SCPs attached to OUs do not affect member accounts unless explicitly inherited.

Answer

The SCP condition key for KMS encryption is incorrect because the s3:PutBucketPolicy action does not support condition keys for encryption.

Answer

The IAM policy attached to the allowed role does not include s3:PutBucketPolicy permission, even though it has full S3 access.

Question 9

A company is using AWS Client VPN for remote access. They want to ensure that only clients with a valid client certificate can connect, and that traffic is routed through a centralized inspection VPC. The VPN endpoint is configured with mutual authentication using server and client certificates. The route table in the VPN VPC has a default route pointing to an AWS Network Firewall endpoint in the inspection VPC. Users report that they can connect to the VPN but cannot access any internal resources. The network engineer checks the Client VPN endpoint configuration and confirms that the authorization rules allow access to the internal CIDR (10.0.0.0/8). What is the most likely cause?

Accepted Answer

The route table in the VPN VPC has a default route (0.0.0.0/0) pointing to the Network Firewall, but the Network Firewall's route table needs a route back to the VPN VPC for the client CIDR, which is missing.

Answer

The client certificate is not associated with the same CA as the server certificate, causing TLS handshake failure.

Answer

The subnet route table in the VPN VPC does not have a route for the client CIDR (assigned by the VPN) pointing to the VPN endpoint's network interface.

Answer

The AWS Network Firewall in the inspection VPC is blocking traffic from the VPN client CIDR because it does not have a rule allowing it.

Question 10

A company uses AWS Network Firewall to inspect traffic between VPCs in a transit gateway setup. They have a rule group that allows HTTP and HTTPS traffic to a web server in a production VPC. Recently, the security team added a new Suricata IPS rule to block traffic from a specific IP address. After deploying the updated rule group, they notice that all traffic to the web server is being dropped, even from allowed IPs. The firewall logs show the new rule is triggering for all traffic, not just the specific IP. What is the most likely cause?

Accepted Answer

The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.

Answer

The web server's security group is blocking traffic from the firewall's IP range after the firewall adds its source IP.

Answer

The new Suricata rule uses the 'drop' action instead of 'reject', causing all packets to be dropped.

Answer

The rule group is attached to the firewall policy in the wrong direction (e.g., outbound instead of inbound).

Question 11

A company uses AWS Shield Advanced to protect their web application against DDoS attacks. They have configured automatic application layer DDoS mitigation with AWS WAF. During a recent attack, the application experienced increased latency, and some legitimate users were blocked. The security team reviews the WAF logs and finds that many requests from legitimate IPs were rate-limited. The team had set a rate-based rule with a threshold of 100 requests per 5 minutes. What is the most likely reason legitimate users were blocked?

Accepted Answer

The rate-based rule uses the source IP address as the aggregation key, and legitimate users behind a NAT gateway share the same public IP, causing the aggregate rate to exceed the threshold.

Answer

The rate-based rule is set to block requests for 24 hours after the threshold is exceeded, and once triggered, all requests from that IP are blocked indefinitely.

Answer

The WAF web ACL is associated with an Application Load Balancer that is not configured for sticky sessions, causing requests from the same user to be distributed across multiple IPs.

Answer

The rate-based rule is evaluating requests before the WAF allows them, and the threshold is too low, but the rule action is set to 'count' instead of 'block', so it should not block traffic.

Question 12

A company wants to securely store and manage secrets such as database passwords and API keys. They need to automatically rotate secrets every 30 days and ensure that only specific IAM roles can access them. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating secrets such as database passwords and API keys. It supports native rotation with AWS Lambda, enforces fine-grained access control via IAM roles, and can rotate secrets on a schedule (e.g., every 30 days) without custom scripting.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Question 13

A company has an S3 bucket that stores sensitive documents. They need to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, they want to prevent any uploads that do not specify the required KMS key. Which combination of bucket policy and default encryption should they implement?

Accepted Answer

Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.

Answer

Enable default encryption with SSE-S3, and add a bucket policy that denies s3:PutObject unless the request uses the required KMS key.

Answer

Use a bucket policy that requires the kms:Encrypt permission for the required key, but do not enable default encryption.

Answer

Enable default encryption with SSE-KMS using the required key, and rely on IAM policies to enforce encryption, not bucket policies.

Question 14

A company wants to allow their employees to access internal web applications hosted on EC2 instances in a private subnet. The employees are outside the corporate network and connect via the internet. Which AWS service would provide secure, managed remote access without requiring a VPN client on each employee's device?

Accepted Answer

AWS Application Load Balancer with AWS WAF and Cognito authentication

Answer

AWS Direct Connect

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 15

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is encrypted in transit. They also want to minimize changes to existing VPC route tables. Which solution should they use?

Accepted Answer

Use a transit VPC architecture with EC2-based VPN appliances in a security VPC that encrypt traffic between VPCs.

Answer

Enable Transit Gateway VPN attachments between each VPC and the Transit Gateway with IPsec VPN.

Answer

Use AWS Network Firewall to inspect and encrypt traffic between VPCs.

Answer

Implement VPC peering with encryption enabled.