ANS-C01 Network Security, Compliance and Governance Practice Test 16 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect their on-premises network to AWS. They have a VPC with a virtual private gateway (VGW) and a private VIF attached to it. They recently added a second Direct Connect connection for redundancy. Both connections are active and advertised via BGP. The on-premises network uses BGP with the same AS number. After configuration, they notice that traffic is not load-balanced as expected; instead, all traffic flows through one connection. What is the most likely cause?

Accepted Answer

The on-premises router is configured with a higher local preference for one of the BGP sessions, causing it to prefer that path.

Answer

The on-premises router has a static route pointing to the primary connection, overriding BGP learned routes.

Answer

Both Direct Connect connections are in the same AWS region and use the same VGW, so traffic cannot be load-balanced.

Answer

The Direct Connect connections are using different VLANs, causing asymmetric routing.

Question 2

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.. AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Answer

Use AWS Trusted Advisor to check for security group changes and send email alerts.

Answer

Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.

Answer

Enable VPC Flow Logs and analyze logs for changes to security group rules.

Question 3

A company wants to restrict access to their S3 bucket so that only users from their corporate network (with a specific IP range) can read objects. They also want to ensure that the objects are encrypted in transit. Which combination of bucket policy and encryption should they use?

Accepted Answer

Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.. Option C is correct because a bucket policy with a condition key `aws:SourceIp` can restrict access to the corporate IP range, and requiring HTTPS (via a `aws:SecureTransport` condition) ensures encryption in transit. This combination directly meets both requirements without relying on additional infrastructure like VPC endpoints or CloudFront.

Answer

Use a VPC endpoint with a bucket policy that restricts access to the VPC endpoint.

Answer

Use an IAM policy that restricts access to the corporate IP range and enable default encryption on the bucket.

Answer

Enable CloudFront with geographic restrictions and use HTTPS.

Question 4

A company uses AWS WAF to protect their web application. They have a rate-based rule that blocks IPs after 100 requests in 5 minutes. However, they notice that legitimate users behind a corporate NAT gateway are being blocked because the aggregate traffic from the NAT IP exceeds the threshold. Which TWO actions would resolve this issue without compromising security? (Choose TWO.)

Accepted Answer

Use a scope-down statement to exclude traffic from the corporate NAT IP range.

Answer

Implement a custom WAF rule to allow traffic from the corporate IP range.

Answer

Change the rate-based rule to count instead of block.

Answer

Use AWS Shield Advanced for automatic mitigation.

Question 5

A company wants to securely store database credentials and automatically rotate them every 90 days. Which TWO AWS services can work together to achieve this? (Choose TWO.)

Accepted Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 6

A company has a VPC with public and private subnets. They use a NAT Gateway in the public subnet to allow instances in the private subnet to access the internet. The security team wants to ensure that all outbound traffic from the private subnet is logged and inspected. Which THREE services should they use together to achieve this? (Choose THREE.)

Accepted Answer

VPC Flow Logs

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 7

A financial services company has a multi-account AWS environment managed via AWS Organizations. The security team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key (CMK) from the security account. Currently, some accounts have S3 buckets with SSE-S3 encryption or no encryption. The security team must not be able to read the data in the buckets, but must be able to detect and remediate non-compliant buckets. The solution must use AWS native services and minimize operational overhead. Which combination of actions should the security team take?

Accepted Answer

Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.. Option C is correct because using AWS Config rules with an organization-level conformance pack allows centralized enforcement. The custom rule can check bucket encryption settings, and the remediation action (SSM automation) can apply the correct KMS key. The security team can view compliance without accessing the data. Option A is wrong because SCPs can only deny actions, not enforce specific encryption settings proactively. Option B is wrong because CloudTrail trails only log events, they do not enforce policies. Option D is wrong because enabling AWS Config in every account individually creates operational overhead and does not allow organization-wide enforcement easily.

Answer

Enable AWS Config in each member account individually and create a custom rule using AWS Lambda to check bucket encryption, then send compliance results to the security account via Amazon EventBridge.

Answer

Use a service control policy (SCP) to deny s3:PutObject unless the request includes a specific KMS key ID.

Answer

Enable AWS CloudTrail in the security account and create a metric filter to detect PutBucketEncryption API calls, then trigger a Lambda function to remediate.

Question 8

A company is using Amazon VPC with a public subnet and a private subnet. The public subnet has a NAT gateway. The private subnet has an Amazon RDS for MySQL database. The security team wants to ensure that the database is not accessible from the internet, but they need to allow a specific on-premises network (IP range 203.0.113.0/24) to connect to the database for maintenance. The company also wants to restrict outbound traffic from the database to only necessary AWS services (e.g., S3 for backups) and deny all other outbound traffic. Which configuration should the security team implement?

Accepted Answer

Modify the database security group to allow inbound TCP 3306 from 203.0.113.0/24. Create a VPC endpoint for S3. Update the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list.. Option A is correct because modifying the database security group to allow inbound from the on-premises CIDR directly is the simplest and most secure way. Using a VPC endpoint for S3 allows private connectivity. A custom network ACL on the private subnet can deny all outbound traffic except to the VPC endpoint. Option B is wrong because a security group cannot reference another region's CIDR; also, allowing all outbound traffic to the VPC endpoint defeats the purpose. Option C is wrong because the NAT gateway is not needed for on-premises access; also, a security group cannot reference a prefix list for on-premises IPs. Option D is wrong because an internet gateway is not needed for on-premises access via VPN; also, allowing all outbound traffic to 0.0.0.0/0 is insecure.

Answer

Create a security group for the database that allows inbound from the on-premises network using a prefix list for 203.0.113.0/24. Create a VPC endpoint for S3 and allow outbound traffic to the endpoint. Keep the private subnet's network ACL default (allow all outbound).

Answer

Set up a Site-to-Site VPN between the on-premises network and the VPC. Modify the route tables to route 203.0.113.0/24 through the VPN. Place the database in a private subnet and allow inbound from the VPN CIDR. Use an internet gateway for outbound traffic to S3.

Answer

Place the database in a public subnet and use a security group that allows inbound from 203.0.113.0/24. Use the NAT gateway for outbound traffic to S3. Configure the public subnet's network ACL to deny all outbound traffic except to S3.

Question 9

A security engineer needs to block traffic from a specific country from reaching an Application Load Balancer. Which AWS service should be used to accomplish this?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF can be associated with an ALB to create IP set rules that block traffic based on geographic origin. Option A is wrong because Security Groups do not support geo-blocking. Option B is wrong because NACLs operate at the subnet level and do not support geo-blocking. Option D is wrong because Route 53 Resolver DNS Firewall filters DNS queries, not HTTP traffic.

Answer

Network ACLs on the VPC subnet

Answer

Security groups associated with the ALB

Answer

Route 53 Resolver DNS Firewall

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Transit Gateway with appliance mode and a dedicated inspection VPC. Transit Gateway with appliance mode enables asymmetric routing and forces traffic to the inspection VPC. Option A is wrong because VPC peering does not centralize inspection. Option C is wrong because AWS Network Firewall is a managed service, not a third-party appliance. Option D is wrong because PrivateLink is for service access, not traffic inspection.

Answer

AWS PrivateLink endpoints in each VPC

Answer

AWS Network Firewall deployed in each VPC

Answer

VPC peering between each VPC and the inspection VPC

Question 11

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT gateway. The security team wants to ensure that traffic from the private subnets cannot bypass the NAT gateway. Which configuration should be used?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 pointing to the NAT gateway. A route table with a default route pointing to the NAT gateway ensures all outbound traffic goes through the NAT. Option B is wrong because an egress-only internet gateway is for IPv6. Option C is wrong because a proxy in a public subnet still needs routing. Option D is wrong because a security group on the NAT gateway does not enforce routing.

Answer

Deploy a forward proxy in a public subnet and configure the private subnets to use it

Answer

Use an egress-only internet gateway for the private subnets

Answer

Attach a security group to the NAT gateway that only allows outbound traffic

Question 12

A company is using AWS CloudFormation to deploy a stack that includes an S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. The stack fails to create, and the error indicates that the bucket policy contains an invalid principal. Which principal should be used to restrict access to a VPC endpoint?

Accepted Answer

The condition key aws:SourceVpce. The condition key aws:SourceVpce allows restricting access to a specific VPC endpoint. Option A is wrong because a VPC endpoint has its own ARN, but it is not used as a principal. Option C is wrong because the VPC ID is not a principal. Option D is wrong because the VPC endpoint service is not a principal for S3 bucket policies.

Answer

The VPC ID

Answer

The ARN of the VPC endpoint

Answer

The VPC endpoint service

Question 13

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

Accepted Answer

Amazon SNS. AWS Shield Advanced integrates with CloudWatch to send metrics and events. CloudWatch Events (now Amazon EventBridge) can trigger SNS notifications. Option A is wrong because SQS is a queue, not a notification service. Option C is wrong because Lambda is compute, not notification. Option D is wrong because Config is for configuration compliance.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon SQS

Question 14

A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?

Accepted Answer

The target group health checks are failing, so the NLB is not sending traffic to those targets. NLB target group health checks might be failing, so the NLB does not send traffic to unhealthy targets. Option A is wrong because security groups on targets would drop traffic after NLB sends it. Option B is wrong because NLB does not have security groups. Option C is wrong because NACLs on the target subnet affect traffic to the instance, but the NLB would still send traffic if the target is healthy.

Answer

The target subnet network ACL blocks the client IP

Answer

The target instance security group does not allow traffic from the NLB

Answer

The NLB security group blocks the client IP

Question 15

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The security team wants to enforce multi-factor authentication (MFA) for all VPN connections. Which configuration should be used?

Accepted Answer

Use SAML-based federation with an identity provider that requires MFA. AWS Client VPN supports mutual authentication and can use SAML-based identity federation with an IdP that requires MFA. Option A is wrong because client certificates alone do not enforce MFA. Option B is wrong because Active Directory alone does not enforce MFA. Option D is wrong because security groups do not enforce authentication.

Answer

Attach a security group to the Client VPN endpoint that only allows MFA-authenticated traffic

Answer

Use AWS Managed Microsoft AD for authentication

Answer

Use mutual authentication with client certificates