ANS-C01 Network Security, Compliance and Governance Practice Test 15 — 15 Questions

Question 1

A company uses AWS Organizations with several accounts. The security team wants to ensure that all VPCs in all accounts have flow logs enabled and that any attempt to disable flow logs is automatically detected and remediated. The team also wants to receive alerts when remediation occurs. Which combination of AWS services should be used to meet these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail, Amazon EventBridge, and AWS Lambda. CloudTrail records API activity, including attempts to delete or stop flow logs. EventBridge can match these events and invoke a Lambda function to re-enable flow logs and send an alert via SNS. This serverless, event-driven approach requires no servers to manage and scales across accounts when CloudTrail is enabled organization-wide. It provides both detection and automatic remediation with minimal operational effort.

Answer

Amazon GuardDuty, AWS Security Hub, and AWS Trusted Advisor

Answer

AWS Config, AWS Systems Manager Automation, and Amazon CloudWatch Logs

Answer

AWS CloudFormation StackSets, AWS Service Catalog, and Amazon SNS

Question 2

A media company runs a three-tier web application in a VPC. The security team must ensure that all traffic between the public web tier and the private application tier is inspected by AWS Network Firewall, including traffic that stays inside the VPC. The web tier instances currently route directly to the application tier through the subnet's default route. Which deployment approach will force intra-VPC traffic through the firewall while keeping the application tier's return path symmetric?

Accepted Answer

Create a firewall subnet with a route table that sends all traffic to the Network Firewall endpoint, and update the application subnet's route table to point to the firewall endpoint for return traffic.. Symmetric routing through a Network Firewall endpoint is required so that stateful inspection sees both directions of a flow. A dedicated firewall subnet with route table entries in both the source and destination subnets ensures traffic is inspected and return traffic traverses the same firewall, preventing asymmetric flows that would break stateful rules.

Answer

Enable VPC Flow Logs on the web and application subnets and configure a CloudWatch Logs subscription to alert on unexpected traffic.

Answer

Attach an AWS Network Firewall firewall policy directly to the application tier EC2 instances using the AWS Network Firewall agent.

Answer

Associate a Network ACL on the application subnet that denies all traffic except from the Network Firewall elastic network interface IP address.

Question 3

A network engineer is designing inspection for traffic that flows between two VPCs attached to the same AWS Transit Gateway. A security appliance VPC is also attached to the transit gateway, and all inter-VPC traffic must pass through the appliance for deep packet inspection. The engineer plans to use a transit gateway route table associated with the appliance VPC attachment. Which configuration will force traffic from VPC-A to VPC-B through the appliance while avoiding a routing loop?

Accepted Answer

Associate VPC-A and VPC-B with the same transit gateway route table, add a static route for VPC-B's CIDR pointing to the appliance attachment, and enable appliance mode on the appliance VPC attachment.. Centralized inspection requires a route table where spoke VPC prefixes resolve to the appliance attachment, plus appliance mode on that attachment so the transit gateway pins flows to a single Availability Zone. Combining a shared route table with a static route to the appliance and appliance mode yields deterministic inspection without loops.

Answer

Associate only VPC-A with a route table that has a default route to the appliance attachment, and leave VPC-B in the default transit gateway route table with propagation enabled.

Answer

Associate VPC-A and VPC-B with the same route table, add a static route for VPC-B's CIDR to the appliance attachment, and enable transit gateway route table propagation from the appliance VPC.

Answer

Associate VPC-A and VPC-B with separate transit gateway route tables, propagate both VPC attachments into each table, and enable appliance mode on both spoke attachments.

Question 4

A network engineer manages a VPC that contains an EC2 instance hosting a database. Only application servers in the same VPC should reach the database on TCP port 3306, and no other traffic should be permitted to or from the instance. The engineer wants a stateless, subnet-level control that evaluates every packet independently, including return traffic. Which approach should the engineer implement to meet these requirements?

Accepted Answer

Create a network ACL on the database subnet that allows inbound TCP 3306 from the application subnet CIDR and allows outbound TCP source ports 1024-65535 to that CIDR, denying all other traffic.. Because the requirement is stateless packet-by-packet evaluation at the subnet boundary, a network ACL is the correct control. Network ACLs require explicit rules for both directions of a flow, so the inbound TCP 3306 rule must be paired with an outbound rule covering the ephemeral return ports toward the application subnet. Security groups, Network Firewall, and WAF do not match the required stateless subnet-level behavior.

Answer

Configure an AWS WAF web ACL on the instance's network interface to allow only TCP 3306 from the application servers.

Answer

Attach an AWS Network Firewall policy to the subnet with a stateless rule group that permits TCP 3306 and drops all other protocols.

Answer

Create a security group that allows inbound TCP 3306 only from the application servers' security group, and remove the default outbound allow rule.

Question 5

A healthcare company runs a VPC with a CIDR of 10.0.0.0/16. The security team needs to ensure that only traffic from the organization's on-premises network (192.168.0.0/16) and a specific partner VPC (172.31.0.0/16) can reach the VPC's private subnets. They decide to use a network ACL on the private subnets to enforce this. Which combination of inbound rules should they add to the network ACL to meet this requirement?

Accepted Answer

Allow 192.168.0.0/16 and 172.31.0.0/16 inbound; allow outbound traffic to 192.168.0.0/16 and 172.31.0.0/16.. Network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules. To restrict access to only the on-premises network and the partner VPC, the inbound rules must allow those CIDRs, and the outbound rules must allow traffic back to those same CIDRs. This ensures that only the desired sources can initiate connections and receive responses, while all other traffic is implicitly denied.

Answer

Allow 192.168.0.0/16 and 172.31.0.0/16; allow all outbound traffic.

Answer

Allow 192.168.0.0/16 and 172.31.0.0/16 inbound; allow outbound traffic to 0.0.0.0/0.

Answer

Deny all inbound traffic except from 192.168.0.0/16 and 172.31.0.0/16; allow all outbound traffic.

Question 6

A network engineer is configuring a VPC endpoint for Amazon S3 to allow instances in a private subnet to access S3 without traversing the internet. The engineer creates a gateway endpoint and associates it with the route table of the private subnet. However, instances still cannot access S3. Which of the following is the most likely cause?

Accepted Answer

The security group for the instances does not allow outbound traffic to the S3 prefix list.. Gateway endpoints for S3 rely on route table entries to direct traffic to the endpoint. However, the instances' security groups must also permit outbound traffic to the S3 prefix list. If the security group lacks this rule, traffic is blocked even though the route exists. This is a frequent mistake because engineers focus on the endpoint and route table but forget that security groups still filter traffic.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Answer

The route table does not have a route to the S3 prefix list.

Answer

The VPC endpoint policy does not allow the required S3 actions.

Question 7

A healthcare company runs a three-tier application in a VPC. The security team must ensure that no EC2 instance in the private application subnet can initiate outbound connections to any destination in the 10.20.0.0/16 range belonging to a peered VPC, while still allowing the instances to receive inbound connections from that peered VPC. The subnet's network ACL currently has default allow-all rules for both directions. Which change to the network ACL achieves this requirement with the LEAST operational overhead?

Accepted Answer

Add an outbound rule with rule number 100 that denies 10.20.0.0/16, and add a later outbound rule with rule number 200 that allows 0.0.0.0/0.. A network ACL is stateless and processes rules in ascending numeric order, applying the first rule that matches and ignoring the rest. Placing a deny for the peered VPC CIDR at a low rule number and an allow-all for 0.0.0.0/0 at a higher number blocks only outbound-initiated traffic to the peered range while preserving all other outbound flows. Inbound connections from the peered VPC are unaffected because inbound and outbound rule sets are evaluated independently.

Answer

Add an inbound rule with rule number 100 that denies 10.20.0.0/16, and retain the default inbound allow-all rule.

Answer

Add an outbound rule with rule number 100 that denies 10.20.0.0/16, and remove the default outbound allow-all rule.

Answer

Add an outbound rule with rule number 100 that allows 10.20.0.0/16, and add an outbound rule with rule number 200 that denies 0.0.0.0/0.

Question 8

A company has a VPC with a subnet that hosts a web application. The security team wants to restrict inbound HTTP traffic to only a specific IP range. They have configured a network ACL on the subnet to allow HTTP from that range and deny all other HTTP traffic. However, they find that HTTP traffic from other IPs is still reaching the application. What is the most likely explanation?

Accepted Answer

The security group attached to the instance allows HTTP from all IPs.. In AWS, both network ACLs and security groups must allow traffic for it to reach an instance. Network ACLs are stateless and act as a firewall for the subnet, while security groups are stateful and act at the instance level. If a security group allows HTTP from anywhere, it permits traffic that the network ACL might deny. Therefore, the security group is the likely culprit.

Answer

The route table for the subnet does not have a route to the internet gateway.

Answer

The network ACL is not associated with the subnet.

Answer

The network ACL rules are evaluated in reverse order.

Question 9

A company uses AWS Site-to-Site VPN over a private virtual interface on AWS Direct Connect to reach on-premises workloads. Compliance requires that all traffic between the VPC and on-premises be encrypted in transit, and the network team wants a resilient design where traffic automatically fails over to the internet-based VPN if the Direct Connect link degrades. Which configuration meets these requirements?

Accepted Answer

Create a Site-to-Site VPN connection whose target gateway is a virtual private gateway, and associate the VPN connection with a private virtual interface on the Direct Connect connection.. Attaching a Site-to-Site VPN connection to a private virtual interface carries the IPsec tunnel over the dedicated Direct Connect link, satisfying in-transit encryption without exposing traffic to the internet. Adding a second internet-based VPN with BGP gives a resilient, automatically failing-over path when the Direct Connect connection degrades.

Answer

Use AWS PrivateLink to connect the VPC to the on-premises network and enable encryption with a VPC endpoint policy that requires TLS.

Answer

Deploy a third-party firewall appliance in the VPC and build an IPsec tunnel to the on-premises firewall over the private virtual interface, using static routes for failover.

Answer

Configure a transit virtual interface on the Direct Connect connection and run a Site-to-Site VPN over the public internet as a backup, using BGP for failover between the two paths.

Question 10

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses dynamic routing with BGP. The security team wants to ensure that all traffic from the on-premises network to the VPC is encrypted and that the VPC can only accept traffic from the specific on-premises CIDR. They have configured the VPN with a static route for the on-premises CIDR in the VPC route table. However, they notice that traffic from a different on-premises subnet is also reaching the VPC. What is the most likely cause and how to fix it?

Accepted Answer

The VPN connection is configured with BGP, and the on-premises router is advertising additional subnets. Filter the advertised routes on the on-premises router or use a route table with more specific routes.. With dynamic routing, the on-premises router controls which routes are advertised to AWS via BGP. If it advertises additional subnets, the VPC route table will learn them, even if a static route exists for a specific CIDR. To restrict traffic to only the desired CIDR, you must filter the BGP advertisements on the on-premises router or use more specific static routes in the VPC route table that override the learned routes. Disabling route propagation would break all connectivity.

Answer

The on-premises network is using a different BGP ASN than the VPC. Update the customer gateway to use the same ASN as the virtual private gateway.

Answer

The VPN tunnel is using IKEv2 instead of IKEv1, which allows multiple subnets. Recreate the VPN with IKEv1.

Answer

The VPC route table has a static route for the on-premises CIDR, but the VPN connection also propagates routes. Disable route propagation for the VPN connection in the VPC route table.

Question 11

A company is deploying a multi-tier web application in a VPC. The security team requires that all traffic to and from the application be inspected by a firewall, and that the firewall logs be retained for 7 years for compliance. The company also wants to minimize latency for the application. Which TWO actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Deploy AWS Network Firewall in a centralized inspection VPC and route all traffic through it using AWS Transit Gateway.. To inspect all traffic and retain logs for 7 years, deploy AWS Network Firewall in a centralized inspection VPC and route traffic through it using AWS Transit Gateway. This ensures all traffic is inspected and simplifies management. Then, configure Network Firewall logging to Amazon S3 with a lifecycle policy for 7-year retention. This combination meets both inspection and compliance requirements while minimizing latency through centralized, efficient routing.

Answer

Configure VPC Flow Logs to capture all traffic and deliver to Amazon S3 with a lifecycle policy to retain for 7 years.

Answer

Deploy a third-party firewall appliance on EC2 instances in each subnet and configure security groups to redirect traffic to the appliance.

Answer

Use AWS PrivateLink to connect the application tiers and enable security groups to inspect traffic.

Question 12

A company runs a three-tier web application in a VPC. The database tier resides in private subnets and must only accept traffic from the application tier's security group. A network engineer needs to verify that no other resources in the VPC can reach the database. The engineer has already confirmed that the database security group references the application security group as its only inbound source. Which additional check should the engineer perform to ensure that the database is truly isolated?

Accepted Answer

Review the network ACLs associated with the database subnets to confirm they do not allow inbound traffic from the VPC CIDR on the database port.. Security groups are stateful and allow traffic based on references, but network ACLs are stateless and evaluated separately. A permissive NACL on the database subnet could allow traffic from any VPC CIDR, bypassing the security group's restrictions for new connections. Therefore, reviewing the NACLs is the correct additional check to ensure the database is isolated from all other VPC resources.

Answer

Verify that the database instances have been assigned Elastic IP addresses to prevent direct inbound access from the internet.

Answer

Check that the VPC flow logs are enabled for the database subnets and that all traffic is being captured.

Answer

Confirm that the database subnet route table does not have a route to the internet gateway.

Question 13

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses BGP for dynamic routing. The company wants to ensure that all traffic from on-premises to the VPC is encrypted and that the VPN tunnel is highly available. They have configured two VPN tunnels on the virtual private gateway. However, they notice that traffic is only flowing through one tunnel, and the other tunnel is not being used. What could be the reason?

Accepted Answer

AWS Site-to-Site VPN with a virtual private gateway uses active/standby tunnels, so only one tunnel carries traffic at a time.. AWS Site-to-Site VPN connections that terminate on a virtual private gateway use an active/standby configuration for the two tunnels. Only one tunnel is active at a time, and the other serves as a backup. This design ensures high availability but does not provide load balancing. To use both tunnels simultaneously, you must use a transit gateway, which supports Equal-Cost Multi-Path (ECMP) routing and allows active/active VPN connections.

Answer

The on-premises router is not configured to use ECMP for the two BGP sessions.

Answer

The two tunnels are not in the same Availability Zone.

Answer

The BGP configuration on the on-premises router is incorrect, causing one tunnel to be preferred.

Question 14

A company uses AWS Transit Gateway to connect 40 VPCs across three AWS Regions. The security team must centrally inspect all east-west traffic between VPCs and enforce domain-based filtering for outbound traffic. They deploy AWS Network Firewall in a central inspection VPC in each Region. Which two configurations are required to ensure traffic is inspected and that the firewall can identify the original source? (Choose two.)

Accepted Answer

Enable Transit Gateway Appliance Mode on the inspection VPC attachment to preserve flow symmetry.. Centralized inspection with a transit gateway requires a dedicated route table that steers inter-VPC traffic to the inspection VPC attachment, plus Appliance Mode on that attachment to keep flows symmetric. Together these ensure Network Firewall sees both directions and can apply domain-based filtering without breaking stateful inspection.

Answer

Create a Network Firewall rule group that references the source IP addresses of all spoke VPC CIDRs to identify the original source.

Answer

Enable VPC Flow Logs on all spoke VPCs and stream them to a central S3 bucket for analysis.

Answer

Configure each spoke VPC route table to send 0.0.0.0/0 directly to the Network Firewall endpoint in its own subnet.

Question 15

A regulated company must ensure that all VPC flow logs across every account in AWS Organizations are delivered to a central, tamper-evident location, and that any account attempting to disable flow logs is automatically remediated. Which two actions should the network security team take to meet these requirements? (Choose two.)

Accepted Answer

Use AWS CloudFormation StackSets with service-managed permissions to deploy flow log resources and required IAM roles across all accounts in the organization.. Deploying flow log resources at scale across an organization is best handled with CloudFormation StackSets using service-managed permissions, which automatically covers new accounts. Detecting and repairing disabled logging requires a compliance evaluation and remediation loop, which AWS Config rules with automatic remediation provide. Together these deliver centralized, enforced flow logging with self-healing behavior.

Answer

Use AWS Firewall Manager to create a policy that pushes flow log settings to all VPCs in the organization.

Answer

Configure each account's VPC to publish flow logs to a local CloudWatch log group and rely on account administrators to forward them centrally.

Answer

Enable AWS CloudTrail data events for all S3 buckets so that flow log delivery failures are recorded.