ANS-C01 Network Security, Compliance and Governance Practice Test 17 — 15 Questions

Question 1

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted at rest. Which S3 bucket property should be enabled?

Accepted Answer

Default encryption. S3 bucket default encryption ensures that all objects uploaded to the bucket are encrypted at rest. Option B is wrong because versioning is for object versioning, not encryption. Option C is wrong because logging is for access logging. Option D is wrong because MFA Delete is for delete protection.

Answer

Versioning

Answer

MFA Delete

Answer

Server access logging

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT gateway in the public subnet. The security team wants to allow only outbound HTTPS traffic from the instance. Which configuration should be used?

Accepted Answer

Network ACL on the private subnet with outbound rule allowing HTTPS and inbound rule allowing return traffic. A NACL on the private subnet can control inbound and outbound traffic. For outbound HTTPS, allow outbound ephemeral ports and inbound port 443 for return traffic. Option B is wrong because security groups are stateful and automatically allow return traffic, but they do not filter by destination port in the inbound direction for stateful traffic. However, the question asks for a configuration that allows only outbound HTTPS; a security group with outbound rule for HTTPS works, but NACLs are also commonly used. But the best answer is NACL because it provides stateless filtering. Option C is wrong because the NAT gateway's security group (if it had one) would not apply to traffic from the private instance. Option D is wrong because VPC endpoints are for AWS services, not internet.

Answer

Security group on the instance with outbound rule allowing HTTPS

Answer

VPC gateway endpoint for S3

Answer

Security group on the NAT gateway with outbound rule allowing HTTPS

Question 3

A company is designing a network security architecture for a multi-tier application. Which TWO of the following are best practices for implementing defense in depth?

Accepted Answer

Use security groups to control traffic between instances. Option A is correct because placing web servers in public subnets and app servers in private subnets adds a layer of separation. Option C is correct because using security groups as instance-level firewalls provides granular control. Option B is wrong because network ACLs are stateless and not stateful. Option D is wrong because public subnets should not have direct internet access for tiers that don't need it. Option E is wrong because using the same security group for all tiers reduces security.

Answer

Use network ACLs as stateful firewalls at the subnet level

Answer

Attach internet gateways to all subnets for high availability

Answer

Use the same security group for all tiers to simplify management

Question 4

A company is using AWS Direct Connect to connect on-premises to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which TWO options can achieve this?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect virtual interface. Option A is correct because IPsec VPN over Direct Connect can encrypt traffic. Option D is correct because MACsec provides encryption at Layer 2 for dedicated connections. Option B is wrong because TLS is for application-level encryption, not link-level. Option C is wrong because VPC endpoints do not encrypt the Direct Connect link. Option E is wrong because Direct Connect by itself does not provide encryption.

Answer

Use TLS on all applications

Answer

Use VPC gateway endpoints for S3

Answer

Rely on Direct Connect's physical security

Question 5

A company needs to audit network traffic in a VPC for compliance. Which THREE AWS services can be used to capture and analyze network traffic?

Accepted Answer

Traffic Mirroring. Option A is correct because VPC Flow Logs capture IP traffic information. Option B is correct because Traffic Mirroring captures and inspects traffic. Option D is correct because AWS Network Firewall can log traffic. Option C is wrong because CloudTrail logs API calls, not network traffic. Option E is wrong because AWS Config monitors resource configurations, not traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized firewall appliance in a inspection VPC. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a Transit Gateway and create separate route tables for inspection.. Option C is correct because Transit Gateway route tables can direct traffic between VPCs through a central inspection VPC by using blackhole routes or specific associations. Option A is wrong because VPC peering does not support transitive routing and cannot enforce central inspection. Option B is wrong because Direct Connect is for on-premises connectivity and does not provide inter-VPC inspection. Option D is wrong because AWS Network Firewall can be deployed in a single VPC but it is not a requirement to use Transit Gateway with route tables to direct traffic to it.

Answer

Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Deploy AWS Network Firewall in each VPC and allow traffic to flow directly between VPCs.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs through the inspection VPC.

Question 7

A network engineer is designing a security group for a web application that must allow inbound HTTPS traffic from the internet and outbound traffic to an RDS MySQL database. The web servers are in a public subnet and the RDS database is in a private subnet. What is the most secure way to configure the security groups?

Accepted Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from Web SG.. Option B is correct because the web server security group allows inbound HTTPS (443) from anywhere and outbound MySQL (3306) to the database security group. The database security group allows inbound MySQL from the web server security group. Option A is wrong because allowing outbound traffic to 0.0.0.0/0 is too permissive. Option C is wrong because the database security group should reference the web server security group, not vice versa. Option D is wrong because the database should only allow inbound from the web server security group, not from the internet.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from Web SG.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from 0.0.0.0/0.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from 0.0.0.0/0.

Question 8

A company wants to block inbound traffic from a specific IP address range (203.0.113.0/24) at the VPC level using AWS WAF. Which resource should the AWS WAF web ACL be associated with?

Accepted Answer

Application Load Balancer. Option A is correct because AWS WAF can be associated with an Application Load Balancer to filter HTTP/HTTPS traffic. Option B is wrong because NLB does not support AWS WAF. Option C is wrong because VPC peering does not have a web ACL. Option D is wrong because a security group is used for stateful filtering, but AWS WAF is a separate service for web traffic.

Answer

Network Load Balancer

Answer

VPC peering connection

Answer

Security group

Question 9

A company uses AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate for a domain hosted on Route 53. The certificate is used by an Application Load Balancer. After renewal, the ALB continues to serve the old certificate. What is the most likely cause?

Accepted Answer

The ALB listener is not configured to use the new certificate.. Option A is correct because ACM automatically renews certificates but the ALB may not use the new certificate until it is redeployed or the listener is updated. Option B is wrong because the certificate is public and can be used with an ALB. Option C is wrong because ACM uses DNS validation with Route 53 automatically. Option D is wrong because ACM does not need to import the certificate; it issues it.

Answer

The certificate was not imported into ACM correctly.

Answer

The certificate is a private certificate and cannot be used with an ALB.

Answer

DNS validation failed during renewal.

Question 10

A company has a VPC with public and private subnets. The public subnet hosts a NAT gateway. The private subnet hosts EC2 instances that need to download patches from the internet. The EC2 instances have a security group that allows outbound HTTPS to 0.0.0.0/0. What additional configuration is required?

Accepted Answer

Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. Option B is correct because private subnet instances need a route to the NAT gateway for internet access. Option A is wrong because an internet gateway is attached to the VPC, not the private subnet. Option C is wrong because the NAT gateway is already in the public subnet. Option D is wrong because a VPC endpoint is for private connectivity to AWS services, not for internet access.

Answer

Attach an internet gateway to the private subnet.

Answer

Move the NAT gateway to the private subnet.

Answer

Create a VPC endpoint for S3.

Question 11

A security team needs to audit all network traffic entering and leaving a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. Option C is correct because VPC Flow Logs capture IP traffic information for network interfaces. Option A is wrong because CloudTrail records API calls. Option B is wrong because CloudWatch Logs can store logs but does not capture network traffic. Option D is wrong because AWS Config records resource configuration changes.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 12

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN tunnel is up, but traffic from on-premises cannot reach EC2 instances in the VPC. The EC2 instances have a security group that allows inbound ICMP from the on-premises CIDR. What is the most likely cause?

Accepted Answer

The subnet route table does not have a route for the on-premises CIDR pointing to the virtual private gateway.. Option B is correct because the route table of the VPC subnet must have a route pointing the on-premises CIDR to the virtual private gateway (VGW). Option A is wrong because the VPN static routes are configured on the customer gateway side. Option C is wrong because the security group rule is correct. Option D is wrong because the route table association is not the issue.

Answer

The security group rule is using the wrong protocol.

Answer

The VPN connection does not have static routes configured.

Answer

The subnet is not associated with the main route table.

Question 13

A company wants to allow a specific IAM user to manage network ACLs for a specific VPC only. Which IAM policy action should be used?

Accepted Answer

ec2:CreateNetworkAcl. Option C is correct because ec2:CreateNetworkAcl is the action to create network ACLs. Option A is wrong because ec2:DescribeNetworkAcls is read-only. Option B is wrong because ec2:ModifyNetworkAclAttribute modifies attributes, not creation. Option D is wrong because ec2:AuthorizeSecurityGroupIngress is for security groups, not network ACLs.

Answer

ec2:AuthorizeSecurityGroupIngress

Answer

ec2:ModifyNetworkAclAttribute

Answer

ec2:DescribeNetworkAcls

Question 14

A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?

Accepted Answer

AWS Network Firewall. Option D is correct because AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A is wrong because security groups do not support allowlisting based on domain names. Option B is wrong because NACLs are stateless and work at the subnet level. Option C is wrong because AWS WAF works at the application layer for inbound web traffic.

Answer

AWS WAF

Answer

Network ACL

Answer

Security group with outbound rules

Question 15

A company needs to ensure that all outbound traffic from a VPC goes through a centralized inspection appliance in a different VPC. Which TWO actions must be taken to achieve this?

Accepted Answer

Use AWS Transit Gateway with appropriate route tables to direct traffic to the inspection VPC.. Option A is correct: Transit Gateway with route tables can direct traffic to the inspection VPC. Option C is correct: The inspection VPC must have routes to forward traffic back. Option B is wrong: VPC peering does not support transitive routing. Option D is wrong: Direct Connect is for on-premises. Option E is wrong: VPC endpoints do not route general internet traffic.

Answer

Deploy VPC endpoints for all AWS services used.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs.

Answer

Create VPC peering connections between all VPCs.