ANS-C01 Network Security, Compliance and Governance Practice Test 17 — 15 Questions

Question 1

A company is deploying a new VPC and wants to ensure that all inbound traffic to its web servers is allowed only on TCP ports 80 and 443 from the internet, while all other inbound traffic is denied. The web servers run in a public subnet behind an internet gateway. Which configuration enforces this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a security group that allows inbound TCP 80 and 443 from 0.0.0.0/0 and attach it to the instances, relying on the security group's implicit deny for all other inbound traffic.. Security groups are stateful and permit only the inbound traffic explicitly allowed by their rules, with an implicit deny for all other inbound traffic. Allowing TCP 80 and 443 from 0.0.0.0/0 on the instance security group restricts inbound access to exactly those web ports while automatically permitting return traffic, which matches the requirement without additional deny rules.

Answer

Create a network ACL that allows inbound TCP 80 and 443 and denies all other inbound traffic, but leave the instance security group with its default allow-all inbound rule.

Answer

Create a network ACL that allows inbound TCP 80 and 443 and relies on the default outbound allow-all rule to permit return traffic, without modifying the security group.

Answer

Create a security group that allows inbound TCP 80 and 443 from 0.0.0.0/0 and add an outbound rule that denies all traffic.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all VPCs in all accounts have flow logs enabled and that the logs are stored in a central S3 bucket. They also need to prevent any account from disabling flow logs. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy flow logs and an SCP to deny the deletion of flow logs across all accounts.. CloudFormation StackSets provide centralized deployment of flow logs across all accounts, reducing manual effort. An SCP at the organization level can deny the action to delete flow logs, ensuring they remain enabled. Together, these services meet the requirements with minimal operational overhead.

Answer

Enable VPC flow logs individually in each account and use AWS Trusted Advisor to monitor for compliance.

Answer

Create a service control policy that requires flow logs to be enabled and use AWS Security Hub to aggregate findings.

Answer

Create an AWS Config rule in each account that checks for flow logs and use an SCP to deny the deletion of flow logs.

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16 and uses AWS Site-to-Site VPN to connect to an on-premises network. The on-premises network uses 10.0.0.0/8. The company wants to ensure that only specific on-premises subnets can reach the VPC, and that the VPC can only reach specific on-premises services. Which two actions should a network engineer take to meet these requirements? (Choose two.)

Accepted Answer

Configure the VPN connection with static routes for only the specific on-premises subnets that should be reachable from the VPC.. To restrict reachability in both directions, the engineer must control route advertisements on both ends of the VPN. On the AWS side, configuring the VPN connection with static routes for only the specific on-premises subnets prevents the VPC from learning the full 10.0.0.0/8. On the on-premises side, configuring the customer gateway to advertise only the specific VPC subnets prevents on-premises from learning the entire VPC CIDR. Together, these actions limit traffic to the intended services and subnets.

Answer

Create a network ACL on the VPN subnet that denies traffic from the on-premises CIDR range 10.0.0.0/8 except for the approved subnets.

Answer

Enable route propagation on the VPC route table and rely on the on-premises BGP advertisements to filter traffic.

Answer

Attach a security group to the virtual private gateway that allows traffic only from the specific on-premises subnets.

Question 4

A healthcare company runs a three-tier application across three VPCs that are attached to a single AWS Transit Gateway. Security policy requires that the application tier in VPC-B can initiate connections to the database tier in VPC-C, but the database tier must never initiate connections back to the application tier. All subnets are private, and the transit gateway has the default association and propagation for all attachments. Which solution enforces this unidirectional requirement with the LEAST operational overhead?

Accepted Answer

Configure a transit gateway route table used by VPC-C that contains only a static route for the application subnet CIDR pointing to the VPC-B attachment, and associate the database subnet route table with that transit gateway route table.. The transit gateway route table associated with the database VPC attachment can be scoped to include only a route toward the application subnet, so packets originating in the database tier have no path back to the application tier. Because the application VPC's route table still points to the database attachment, the application tier can initiate connections while the return direction is blocked, all without additional inspection appliances.

Answer

Apply a security group on the database instances that allows inbound traffic from the application security group and set the outbound rules to allow only responses, relying on the stateful nature of security groups for enforcement.

Answer

Attach an AWS Direct Connect gateway to the transit gateway and use a prefix list to filter routes so that only the database CIDR is advertised to VPC-B.

Answer

Create a stateless AWS Network Firewall rule group with a pass rule for the application CIDR to the database CIDR and a drop rule for the reverse direction, then attach the firewall policy to the transit gateway.

Question 5

A network engineer has configured an AWS Site-to-Site VPN over a transit gateway with two tunnels for redundancy. The on-premises customer gateway device supports BGP and advertises the same set of prefixes over both tunnels. The engineer observes that return traffic from AWS sometimes arrives on a different tunnel than the one the original packet used, and stateful inspection on the customer gateway drops the packets. Which change addresses the root cause?

Accepted Answer

Use AS_PATH prepending on the standby tunnel so that AWS prefers a single tunnel for all prefixes, keeping both directions on the same path.. With two VPN tunnels advertising identical prefixes, AWS can select either tunnel per flow, which produces asymmetric paths that break stateful inspection. Making one tunnel's path less preferred through AS_PATH prepending causes AWS to use a single tunnel consistently for those prefixes, so request and response traffic stays on the same path and the customer gateway sees full flows.

Answer

Increase the transit gateway attachment's BGP hold time so that tunnel flapping is reduced and path selection stabilizes.

Answer

Enable equal-cost multipath routing on the transit gateway so both tunnels are used simultaneously for the same flow.

Answer

Configure the customer gateway to advertise more specific prefixes on the preferred tunnel and less specific prefixes on the standby tunnel.

Question 6

A company uses AWS Organizations with several accounts. They want to implement a centralized network security policy that enforces the following requirements: (1) all VPCs in all accounts must have a specific set of outbound rules that deny traffic to a list of malicious IPs, (2) the security team must be able to audit all changes to these rules, and (3) the solution must automatically apply to new accounts and VPCs. Which TWO AWS services or features should be used together to meet these requirements? (Choose two.)

Accepted Answer

AWS Network Firewall. AWS Firewall Manager centrally manages security policies across accounts and automatically applies them to new resources, while AWS Network Firewall enforces the outbound rules to deny malicious IPs. Together they provide centralized enforcement and auditing. Other services like Security Hub, GuardDuty, and AWS Config provide detection or auditing but not enforcement.

Answer

AWS Config

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Question 7

A company runs a three-tier web application in a VPC. The database tier resides in private subnets and must accept connections only from the application tier. A security engineer needs to enforce this restriction at the subnet boundary so that even if an application-tier instance's security group is misconfigured, traffic from the internet cannot reach the database. The engineer creates a network ACL for the database subnets. Which configuration should the engineer apply to the network ACL to meet these requirements?

Accepted Answer

Add inbound rules that allow the application subnet CIDR on the database port and allow all outbound traffic; rely on the default deny for all other inbound traffic.. A network ACL provides stateless subnet-level filtering and can restrict inbound access to the database subnets to only the application subnet CIDR on the database port. Because network ACLs cannot reference security groups, the source must be expressed as a CIDR. This creates an independent enforcement layer that blocks internet traffic even if a security group is later misconfigured.

Answer

Add inbound rules that allow the application security group ID on the database port and deny all other inbound traffic.

Answer

Add inbound rules that allow all traffic and add outbound rules that deny traffic to the internet; rely on security groups for database port filtering.

Answer

Add inbound rules that allow the application subnet CIDR on the database port and add outbound rules that allow only the application subnet CIDR on the ephemeral port range.

Question 8

A company needs to ensure that all traffic between two VPCs attached to a transit gateway is inspected by a security appliance in a separate inspection VPC. They have configured a transit gateway with multiple route tables. Which configuration will achieve this requirement?

Accepted Answer

Associate each VPC with a separate transit gateway route table. In the route table for VPC A, add a route to VPC B's CIDR pointing to the inspection VPC attachment. In the route table for VPC B, add a route to VPC A's CIDR pointing to the inspection VPC attachment.. The correct answer is to use separate transit gateway route tables for each VPC and point routes to the other VPC's CIDR to the inspection VPC attachment. This forces traffic to be sent to the inspection VPC, where a security appliance can inspect it before forwarding to the destination. The inspection VPC must have routes back to the transit gateway for the destination VPCs. This is a common pattern for centralized inspection.

Answer

Create a transit gateway peering attachment between the two VPCs and route all traffic through the peering connection.

Answer

Associate both VPCs with the same transit gateway route table and add a static route to the inspection VPC's attachment.

Answer

Associate both VPCs with the same transit gateway route table and enable appliance mode on the inspection VPC attachment.

Question 9

A security auditor requires that all access to an S3 bucket containing network flow logs be restricted to a specific VPC endpoint and that requests from any other source be denied, including requests from the public internet. Which configuration should the network engineer implement?

Accepted Answer

Create a gateway VPC endpoint for S3, attach it to the VPC route tables, then attach a bucket policy that denies requests unless aws:SourceVpce matches the endpoint ID.. A gateway VPC endpoint for S3 provides private connectivity and supports the aws:SourceVpce condition key in bucket policies. Denying requests unless aws:SourceVpce matches the endpoint ID ensures that only traffic through that endpoint is allowed, blocking internet and other-source access, which meets the auditor's requirement.

Answer

Create an interface VPC endpoint for S3 with a private hosted zone, then use an S3 access point policy to deny requests from outside the VPC CIDR.

Answer

Create a gateway VPC endpoint for S3 and configure a security group on the endpoint to allow only the VPC CIDR, then rely on the security group to deny other sources.

Answer

Create an interface VPC endpoint for S3 in the VPC, then attach a bucket policy that denies requests unless aws:SourceVpce matches the endpoint ID.

Question 10

A healthcare company runs a three-tier application in a VPC. The compliance team requires that all DNS queries originating from the private subnets be resolved by a self-managed DNS server on-premises so that query contents can be logged by an existing SIEM. The company already has an AWS Site-to-Site VPN attached to a virtual private gateway. Which configuration change meets this requirement with the least operational effort?

Accepted Answer

Set the DHCP option set for the VPC to the on-premises DNS server IP addresses and restart the instances so they pick up the new resolver.. The requirement is that instance DNS queries themselves be resolved and logged by the on-premises server, not merely that some namespace be forwarded. Pointing the VPC DHCP option set at the on-premises resolver addresses makes instances query that server directly across the existing VPN, giving complete visibility. Resolver endpoints and DNS Firewall change forwarding or filtering behavior but do not move the default resolution path for all queries.

Answer

Enable Route 53 Resolver DNS Firewall on the VPC and point the default rule action to the on-premises server IP address.

Answer

Create an inbound Resolver endpoint in the VPC and configure the on-premises server to forward all queries to it.

Answer

Create a Route 53 Resolver outbound endpoint in the VPC and a forwarding rule for the on-premises domain, then associate the rule with the VPC.

Question 11

A company is using AWS Network Firewall to protect its VPC. They have configured a firewall policy with a rule group that allows HTTP and HTTPS traffic and blocks all other traffic. The security team wants to log all denied traffic and also capture full packet data for further analysis. Which two actions should they take to meet these requirements? (Choose two.)

Accepted Answer

Enable alert logging in the firewall policy and set the log destination to an S3 bucket.. To log denied traffic and capture full packet data, you must configure logging in the firewall policy. Alert logging captures events that match rules with actions like 'drop' or 'alert', and it can include packet data. You need to enable alert logging and choose a destination such as CloudWatch Logs or S3. Additionally, you can send logs to CloudWatch Logs for real-time monitoring. Combining alert logging with a suitable destination meets both requirements.

Answer

Configure the firewall to use a strict order rule group that blocks all traffic.

Answer

Configure the firewall policy to capture packet data for denied traffic and store it in an S3 bucket.

Answer

Enable flow logging in the firewall policy and set the log destination to CloudWatch Logs.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to ensure that all traffic from their on-premises network (192.168.0.0/16) to the VPC is allowed, but all other inbound traffic is denied. They have set up a network ACL on the subnet. Which rule should they add to the network ACL to meet this requirement?

Accepted Answer

Allow inbound traffic from 192.168.0.0/16 with rule number 100, and deny all other inbound traffic with rule number 200.. Network ACLs are stateless and process rules in order of rule number, from lowest to highest. To allow specific traffic and deny all else, place the allow rule before the deny rule. The allow rule for 192.168.0.0/16 must have a lower rule number than the deny-all rule. This ensures that on-premises traffic is permitted while all other inbound traffic is blocked.

Answer

Allow inbound traffic from 192.168.0.0/16, and deny all other inbound traffic with a lower rule number.

Answer

Add an allow rule for 192.168.0.0/16 and rely on the default deny rule at the end of the network ACL to block all other traffic.

Answer

Deny all inbound traffic with rule number 100, and allow traffic from 192.168.0.0/16 with rule number 200.

Question 13

A company has a VPC with an AWS Network Firewall deployed in a dedicated subnet. The firewall policy is configured to block all outbound traffic except to a list of approved domains. A security engineer notices that traffic to an unapproved domain is being allowed. The engineer verifies that the firewall policy has a rule group with domain allowlisting and a default deny action. What is the most likely cause of the issue?

Accepted Answer

The domain allowlist rule group is using a rule that matches on HTTP Host header, but the traffic is HTTPS and the firewall is not configured for TLS inspection.. AWS Network Firewall cannot inspect encrypted HTTPS traffic without TLS inspection. If the domain allowlist rule matches on the HTTP Host header, it will not see the domain in HTTPS traffic, so the rule fails to match and the traffic may be allowed. Enabling TLS inspection or using SNI-based filtering is necessary.

Answer

The firewall policy is not associated with the route table of the subnet where the firewall endpoint is deployed.

Answer

The firewall subnet's route table is sending traffic directly to the internet gateway instead of the firewall endpoint.

Answer

The domain allowlist rule group is configured with a priority that is lower than the default deny action.

Question 14

A healthcare company uses AWS Organizations with multiple accounts. They have a central security account that hosts an AWS Network Firewall in a transit gateway hub VPC. All spoke VPCs route traffic through the transit gateway to the firewall for inspection. The company needs to ensure that all traffic between spoke VPCs is inspected, including traffic that stays within the same Availability Zone. After deploying the firewall, they notice that traffic between two spoke VPCs in the same Availability Zone is not being inspected. What is the MOST likely reason for this?

Accepted Answer

The transit gateway attachment for the firewall VPC does not have appliance mode enabled.. When using a transit gateway to route traffic through a central firewall VPC, appliance mode must be enabled on the firewall's transit gateway attachment. Appliance mode ensures that the transit gateway maintains flow stickiness to the same Availability Zone for the firewall appliance, which is necessary for stateful inspection. Without appliance mode, traffic between spokes in the same AZ may be routed directly without passing through the firewall, leading to uninspected traffic. Enabling appliance mode on the firewall attachment resolves this.

Answer

The firewall policy is configured to only inspect traffic that crosses Availability Zone boundaries.

Answer

The spoke VPC route tables are directing traffic to the firewall VPC using a peering connection instead of the transit gateway.

Answer

The transit gateway route tables for the spoke VPCs do not have a route to the firewall VPC attachment.

Question 15

A company has a VPC with a subnet that hosts a critical application. The security team wants to log all traffic that is allowed by the network ACL and security group, and also log all traffic that is denied by the network ACL. They have enabled VPC Flow Logs on the subnet with a filter of 'ALL'. However, they notice that the flow logs do not capture traffic that is denied by the security group. What is the reason for this?

Accepted Answer

VPC Flow Logs do capture security group denied traffic with filter ALL; the issue is likely that the flow log is not configured to log to the correct destination or the traffic is not reaching the security group.. VPC Flow Logs with filter ALL capture all traffic, including traffic denied by security groups. The absence of security group denied logs suggests a configuration issue with the flow log destination or permissions, or the traffic is not reaching the security group. The other options incorrectly claim that security group denied traffic is not logged.

Answer

The flow log filter 'ALL' captures all traffic, but security group denied traffic is only logged if the flow log is created at the ENI level, not the subnet level.

Answer

VPC Flow Logs do not capture traffic that is denied by security groups; only network ACL denied traffic is logged.

Answer

Security group denied traffic is not logged by VPC Flow Logs because security groups are stateful and denied traffic is not recorded.