ANS-C01 Network Security, Compliance and Governance Practice Test 16 — 15 Questions

Question 1

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team wants to implement defense in depth. Which three layers of security should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security groups. Security groups act as virtual firewalls at the instance level, providing stateful filtering. Network ACLs provide stateless filtering at the subnet level, adding a perimeter layer. AWS WAF protects web applications at the application layer, guarding against common web exploits. Together, these three layers (A, B, E) implement defense in depth for network security. IAM policies (C) are for identity and access management, not network filtering. VPC Flow Logs (D) are for monitoring traffic, not blocking it.

Answer

AWS Identity and Access Management (IAM) policies

Answer

VPC Flow Logs

Question 2

A company has a VPC with multiple subnets and is using Network Access Analyzer to identify unintended network access. It reports that an EC2 instance in a private subnet has a route to an internet gateway. Which two actions should be taken to remediate this?

Accepted Answer

Ensure the EC2 instance does not have a public IP address. The Network Access Analyzer report indicates that the EC2 instance in a private subnet has an unintended route to an internet gateway. To remediate this, two actions are needed: (1) Remove the route to the internet gateway from the subnet's route table, which eliminates the direct path to the internet. (2) Ensure the EC2 instance does not have a public IP address, because even without a route, a public IP could allow direct internet access via the internet gateway. Option A directly addresses the public IP, and option B fixes the route table. Options C (assigning a public IP) would worsen the issue. Option D (updating security group to deny outbound 0.0.0.0/0) does not affect routing and would not remove the internet gateway route. Option E (attaching a NAT gateway) would add another internet route, not remove the existing one.

Answer

Assign a public IP address to the instance

Answer

Update the security group to deny outbound traffic to 0.0.0.0/0

Answer

Attach a NAT gateway to the private subnet

Question 3

Refer to the exhibit. A company has attached the IAM policy to an S3 bucket named example-bucket. Users report they cannot access objects in the bucket even when coming from the allowed IP range. What is the most likely cause?

Accepted Answer

S3 Block Public Access settings are enabled, overriding the policy. The policy allows anonymous access (Principal: "*") from a specific IP range. However, S3 Block Public Access settings can override bucket policies by blocking any public access. If S3 Block Public Access is enabled at the account or bucket level, it will deny all public access regardless of the bucket policy. Thus, even though the policy is valid, the Block Public Access setting prevents access. Option D is correct because S3 Block Public Access settings override the policy. Option A is incorrect because the Principal element of "*" is valid for a bucket policy. Option B is incorrect because the condition correctly restricts to the specified IP range; the issue is broader than IP mismatch. Option C is incorrect because aws:SourceIp is used correctly in the condition.

Answer

The policy syntax is invalid because of the Principal element

Answer

The IP address range in the condition does not match the users' IP

Answer

The condition uses aws:SourceIp incorrectly

Question 4

Refer to the exhibit. A network engineer is analyzing a VPC Flow Log record from a VPC with CIDR 10.0.0.0/16. The record indicates a REJECT action. Which component is most likely blocking the traffic?

Accepted Answer

The destination instance's security group. Flow logs record traffic after security group and NACL evaluation. A REJECT indicates the traffic was dropped by a security group or NACL. Since the destination port is 80 (HTTP), a security group is likely blocking inbound HTTP. Option C is correct. Option A is wrong because the source IP is within the VPC. Option B is wrong because there is no indication of a missing route. Option D is wrong because NACL rules are stateless and would show REJECT if they block, but security groups are more common for instance-level blocking.

Answer

The destination instance's operating system firewall

Answer

A missing route in the route table

Answer

The network ACL of the destination subnet

Question 5

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains several EC2 instances that need to download software updates from the internet. The security team has configured the following: - A security group on the EC2 instances allows outbound traffic to 0.0.0.0/0 on ports 443 and 80. - The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT gateway. - The NAT gateway is in the public subnet with an Elastic IP and its security group allows inbound traffic from the private subnet CIDR on ports 443 and 80, and outbound to 0.0.0.0/0 on all ports. Despite this, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group inbound rule is too restrictive. The most likely cause is that the NAT gateway's security group inbound rule is too restrictive. NAT gateways are managed services and do not have security groups; if one were hypothetically attached, its inbound rule allowing only ports 443 and 80 would block return traffic on ephemeral ports. More critically, security groups are stateful—if outbound traffic is allowed, return traffic is automatically permitted regardless of inbound rules. Therefore, option D is incorrect. Option B is incorrect because the NAT gateway has an Elastic IP, and option C is incorrect because the private subnet route table has a default route to the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP associated

Answer

The route table of the private subnet does not have a route to the NAT gateway

Answer

The EC2 instances' security group does not allow inbound traffic from the NAT gateway

Question 6

A company has a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The security team requires that all traffic between VPCs must be inspected by a centralized firewall appliance deployed in a security VPC. They have configured a Transit Gateway with a route table that has blackhole routes for all VPC CIDRs except the security VPC, and the security VPC appliance performs inspection and returns traffic to the Transit Gateway. Recently, they added a new VPC for a critical application. After configuration, some traffic from the new VPC to other VPCs is being dropped. The network engineer verifies that the Transit Gateway route table includes a blackhole route for the new VPC's CIDR and that the security VPC's firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.

Answer

The security VPC's network ACLs are blocking return traffic from the firewall appliance back to the Transit Gateway.

Answer

The new VPC's route table does not have a default route pointing to the Transit Gateway attachment.

Answer

The Transit Gateway route table propagates the new VPC's CIDR, overriding the static blackhole route.

Question 7

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS and that bucket policies restrict access to specific IAM roles. They have created an SCP that denies s3:PutBucketPolicy unless the bucket is encrypted with KMS (using a condition) and restricts the PutBucketPolicy action to a specific role. After applying the SCP, the development team reports that they cannot update bucket policies even when using the allowed role. The SCP is attached to the root OU. The allowed role is in the dev account and has full S3 permissions via an IAM policy. What is the most likely reason for the failure?

Accepted Answer

The SCP denies s3:PutBucketPolicy for all principals except the allowed role, but the SCP is applied at the root OU and affects all accounts, so the allowed role is still denied because SCPs are deny-by-default and the allow list in the SCP does not override the implicit deny.

Answer

The SCP must be applied to the dev account specifically, not the root OU, because SCPs attached to OUs do not affect member accounts unless explicitly inherited.

Answer

The SCP condition key for KMS encryption is incorrect because the s3:PutBucketPolicy action does not support condition keys for encryption.

Answer

The IAM policy attached to the allowed role does not include s3:PutBucketPolicy permission, even though it has full S3 access.

Question 8

A company is using AWS Client VPN for remote access. They want to ensure that only clients with a valid client certificate can connect, and that traffic is routed through a centralized inspection VPC. The VPN endpoint is configured with mutual authentication using server and client certificates. The route table in the VPN VPC has a default route pointing to an AWS Network Firewall endpoint in the inspection VPC. Users report that they can connect to the VPN but cannot access any internal resources. The network engineer checks the Client VPN endpoint configuration and confirms that the authorization rules allow access to the internal CIDR (10.0.0.0/8). What is the most likely cause?

Accepted Answer

The route table in the VPN VPC has a default route (0.0.0.0/0) pointing to the Network Firewall, but the Network Firewall's route table needs a route back to the VPN VPC for the client CIDR, which is missing.

Answer

The client certificate is not associated with the same CA as the server certificate, causing TLS handshake failure.

Answer

The subnet route table in the VPN VPC does not have a route for the client CIDR (assigned by the VPN) pointing to the VPN endpoint's network interface.

Answer

The AWS Network Firewall in the inspection VPC is blocking traffic from the VPN client CIDR because it does not have a rule allowing it.

Question 9

A company uses AWS Network Firewall to inspect traffic between VPCs in a transit gateway setup. They have a rule group that allows HTTP and HTTPS traffic to a web server in a production VPC. Recently, the security team added a new Suricata IPS rule to block traffic from a specific IP address. After deploying the updated rule group, they notice that all traffic to the web server is being dropped, even from allowed IPs. The firewall logs show the new rule is triggering for all traffic, not just the specific IP. What is the most likely cause?

Accepted Answer

The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.

Answer

The web server's security group is blocking traffic from the firewall's IP range after the firewall adds its source IP.

Answer

The new Suricata rule uses the 'drop' action instead of 'reject', causing all packets to be dropped.

Answer

The rule group is attached to the firewall policy in the wrong direction (e.g., outbound instead of inbound).

Question 10

A company wants to securely store and manage secrets such as database passwords and API keys. They need to automatically rotate secrets every 30 days and ensure that only specific IAM roles can access them. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating secrets such as database passwords and API keys. It supports native rotation with AWS Lambda, enforces fine-grained access control via IAM roles, and can rotate secrets on a schedule (e.g., every 30 days) without custom scripting.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Question 11

A company has an S3 bucket that stores sensitive documents. They need to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, they want to prevent any uploads that do not specify the required KMS key. Which combination of bucket policy and default encryption should they implement?

Accepted Answer

Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.

Answer

Enable default encryption with SSE-S3, and add a bucket policy that denies s3:PutObject unless the request uses the required KMS key.

Answer

Use a bucket policy that requires the kms:Encrypt permission for the required key, but do not enable default encryption.

Answer

Enable default encryption with SSE-KMS using the required key, and rely on IAM policies to enforce encryption, not bucket policies.

Question 12

A company wants to allow their employees to access internal web applications hosted on EC2 instances in a private subnet. The employees are outside the corporate network and connect via the internet. Which AWS service would provide secure, managed remote access without requiring a VPN client on each employee's device?

Accepted Answer

AWS Application Load Balancer with AWS WAF and Cognito authentication

Answer

AWS Direct Connect

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 13

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is encrypted in transit. They also want to minimize changes to existing VPC route tables. Which solution should they use?

Accepted Answer

Use a transit VPC architecture with EC2-based VPN appliances in a security VPC that encrypt traffic between VPCs.

Answer

Enable Transit Gateway VPN attachments between each VPC and the Transit Gateway with IPsec VPN.

Answer

Use AWS Network Firewall to inspect and encrypt traffic between VPCs.

Answer

Implement VPC peering with encryption enabled.

Question 14

A company uses AWS Direct Connect to connect their on-premises network to AWS. They have a VPC with a virtual private gateway (VGW) and a private VIF attached to it. They recently added a second Direct Connect connection for redundancy. Both connections are active and advertised via BGP. The on-premises network uses BGP with the same AS number. After configuration, they notice that traffic is not load-balanced as expected; instead, all traffic flows through one connection. What is the most likely cause?

Accepted Answer

The on-premises router is configured with a higher local preference for one of the BGP sessions, causing it to prefer that path.

Answer

The on-premises router has a static route pointing to the primary connection, overriding BGP learned routes.

Answer

Both Direct Connect connections are in the same AWS region and use the same VGW, so traffic cannot be load-balanced.

Answer

The Direct Connect connections are using different VLANs, causing asymmetric routing.

Question 15

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.. AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Answer

Use AWS Trusted Advisor to check for security group changes and send email alerts.

Answer

Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.

Answer

Enable VPC Flow Logs and analyze logs for changes to security group rules.