ANS-C01 Network Security, Compliance and Governance Practice Test 17 — 15 Questions

Question 1

A company wants to restrict access to their S3 bucket so that only users from their corporate network (with a specific IP range) can read objects. They also want to ensure that the objects are encrypted in transit. Which combination of bucket policy and encryption should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.. A bucket policy with a condition key `aws:SourceIp` can restrict access to the corporate IP range, and requiring HTTPS (via a `aws:SecureTransport` condition) ensures encryption in transit. This combination directly meets both requirements without relying on additional infrastructure like VPC endpoints or CloudFront.

Answer

Use a VPC endpoint with a bucket policy that restricts access to the VPC endpoint.

Answer

Use an IAM policy that restricts access to the corporate IP range and enable default encryption on the bucket.

Answer

Enable CloudFront with geographic restrictions and use HTTPS.

Question 2

A company uses AWS WAF to protect their web application. They have a rate-based rule that blocks IPs after 100 requests in 5 minutes. However, they notice that legitimate users behind a corporate NAT gateway are being blocked because the aggregate traffic from the NAT IP exceeds the threshold. Which TWO actions would resolve this issue without compromising security? (Choose TWO.)

Accepted Answer

Use a scope-down statement to exclude traffic from the corporate NAT IP range.

Answer

Implement a custom WAF rule to allow traffic from the corporate IP range.

Answer

Change the rate-based rule to count instead of block.

Answer

Use AWS Shield Advanced for automatic mitigation.

Question 3

A company wants to securely store database credentials and automatically rotate them every 90 days. Which TWO AWS services can work together to achieve this? (Choose TWO.)

Accepted Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 4

A company has a VPC with public and private subnets. They use a NAT Gateway in the public subnet to allow instances in the private subnet to access the internet. The security team wants to ensure that all outbound traffic from the private subnet is logged and inspected. Which THREE services should they use together to achieve this? (Choose THREE.)

Accepted Answer

VPC Flow Logs

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 5

A financial services company has a multi-account AWS environment managed via AWS Organizations. The security team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key (CMK) from the security account. Currently, some accounts have S3 buckets with SSE-S3 encryption or no encryption. The security team must not be able to read the data in the buckets, but must be able to detect and remediate non-compliant buckets. The solution must use AWS native services and minimize operational overhead. Which combination of actions should the security team take?

Accepted Answer

Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.. AWS Config organization conformance packs allow centralized definition of a custom rule to check S3 bucket encryption settings across all accounts. Automatic remediation via Systems Manager Automation can apply the required KMS key to non-compliant buckets without granting the security team data access. Option A is incorrect because it requires per-account AWS Config setup and custom Lambda rules, increasing operational overhead and lacking centralized enforcement. Option B is incorrect because SCPs cannot enforce encryption settings on existing buckets and only apply to IAM principals, not to S3 service actions like bucket configuration; they also cannot detect or remediate non-compliant configurations. Option D is incorrect because CloudTrail trails only log API calls and cannot proactively detect existing bucket encryption settings; metric filters are reactive and not suitable for continuous compliance monitoring.

Answer

Enable AWS Config in each member account individually and create a custom rule using AWS Lambda to check bucket encryption, then send compliance results to the security account via Amazon EventBridge.

Answer

Use a service control policy (SCP) to deny s3:PutObject unless the request includes a specific KMS key ID.

Answer

Enable AWS CloudTrail in the security account and create a metric filter to detect PutBucketEncryption API calls, then trigger a Lambda function to remediate.

Question 6

A company is using Amazon VPC with a public subnet and a private subnet. The public subnet has a NAT gateway. The private subnet has an Amazon RDS for MySQL database. The security team wants to ensure that the database is not accessible from the internet, but they need to allow a specific on-premises network (IP range 203.0.113.0/24) to connect to the database for maintenance. The company also wants to restrict outbound traffic from the database to only necessary AWS services (e.g., S3 for backups) and deny all other outbound traffic. Which configuration should the security team implement?

Accepted Answer

Modify the database security group to allow inbound TCP 3306 from 203.0.113.0/24. Create a VPC endpoint for S3. Update the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list.. This configuration allows inbound access from the specific on-premises CIDR (203.0.113.0/24) directly via the database security group, which is secure and avoids the complexity of a VPN. Creating a VPC endpoint for S3 enables private connectivity to S3 without traversing the internet. Updating the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list restricts outbound traffic as required. Option A is incorrect because a security group cannot reference a prefix list for on-premises IPs; prefix lists are used for AWS services or specific VPC resources. Option B is incorrect because a Site-to-Site VPN adds unnecessary complexity for a single on-premises CIDR, and using an internet gateway for outbound traffic to S3 bypasses the requirement to restrict outbound traffic. Option D is incorrect because placing the database in a public subnet would expose it to the internet, and using a NAT gateway for outbound traffic to S3 is not as secure as a VPC endpoint.

Answer

Create a security group for the database that allows inbound from the on-premises network using a prefix list for 203.0.113.0/24. Create a VPC endpoint for S3 and allow outbound traffic to the endpoint. Keep the private subnet's network ACL default (allow all outbound).

Answer

Set up a Site-to-Site VPN between the on-premises network and the VPC. Modify the route tables to route 203.0.113.0/24 through the VPN. Place the database in a private subnet and allow inbound from the VPN CIDR. Use an internet gateway for outbound traffic to S3.

Answer

Place the database in a public subnet and use a security group that allows inbound from 203.0.113.0/24. Use the NAT gateway for outbound traffic to S3. Configure the public subnet's network ACL to deny all outbound traffic except to S3.

Question 7

A security engineer needs to block traffic from a specific country from reaching an Application Load Balancer. Which AWS service should be used to accomplish this?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF can be associated with an Application Load Balancer to create web ACLs with geographic match conditions, enabling geo-blocking. Option A (Network ACLs) is incorrect because NACLs operate at the subnet level and do not support geo-blocking. Option B (Security groups) is incorrect because security groups do not support geo-blocking. Option C (Route 53 Resolver DNS Firewall) is incorrect because it filters DNS queries, not HTTP traffic. Option D (AWS WAF web ACL associated with the ALB) is correct because WAF supports geographic match conditions to block traffic from specific countries.

Answer

Network ACLs on the VPC subnet

Answer

Security groups associated with the ALB

Answer

Route 53 Resolver DNS Firewall

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Transit Gateway with appliance mode and a dedicated inspection VPC. Transit Gateway with appliance mode and a dedicated inspection VPC is the correct architecture because it enables symmetric routing, forcing traffic through the inspection VPC for centralized inspection. Option A (AWS PrivateLink) is incorrect; PrivateLink provides private connectivity to services, not traffic inspection between VPCs. Option B (AWS Network Firewall in each VPC) is incorrect because deploying a firewall in each VPC is distributed, not centralized, and does not leverage Transit Gateway. Option C (VPC peering) is incorrect because VPC peering does not support transitive routing; peering each VPC to an inspection VPC would be complex and does not take advantage of Transit Gateway's centralized routing capabilities.

Answer

AWS PrivateLink endpoints in each VPC

Answer

AWS Network Firewall deployed in each VPC

Answer

VPC peering between each VPC and the inspection VPC

Question 9

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT gateway. The security team wants to ensure that traffic from the private subnets cannot bypass the NAT gateway. Which configuration should be used?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 pointing to the NAT gateway. A route table with a default route (0.0.0.0/0) pointing to the NAT gateway ensures all outbound traffic from private subnets goes through the NAT gateway, preventing bypass. Option A is wrong because a forward proxy in a public subnet would still require routing and does not enforce the NAT gateway path. Option B is wrong because an egress-only internet gateway is for IPv6 only. Option D is wrong because a security group on the NAT gateway controls allowed traffic but does not enforce routing.

Answer

Deploy a forward proxy in a public subnet and configure the private subnets to use it

Answer

Use an egress-only internet gateway for the private subnets

Answer

Attach a security group to the NAT gateway that only allows outbound traffic

Question 10

A company is using AWS CloudFormation to deploy a stack that includes an S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. The stack fails to create, and the error indicates that the bucket policy contains an invalid principal. Which condition key should be used to restrict access to a VPC endpoint in the bucket policy?

Accepted Answer

The condition key aws:SourceVpce. To restrict access to a specific VPC endpoint in an S3 bucket policy, you must use the `aws:SourceVpce` condition key in the `Condition` element, not a principal. VPC endpoints cannot be specified as principals in policies. Option A correctly identifies the condition key. Option B (VPC ID) is incorrect because you need the VPC endpoint ID, not the VPC ID. Option C (ARN of the VPC endpoint) is incorrect because ARNs are not used in condition keys for this purpose. Option D (VPC endpoint service) is incorrect because the endpoint service is not used in this condition.

Answer

The VPC ID

Answer

The ARN of the VPC endpoint

Answer

The VPC endpoint service

Question 11

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

Accepted Answer

Amazon SNS. AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service. Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon SQS

Question 12

A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?

Accepted Answer

The target group health checks are failing, so the NLB is not sending traffic to those targets. If target group health checks fail, the NLB stops sending traffic to the unhealthy targets, even though the client IP is logged by the NLB. The traffic is dropped because NLB does not forward to unhealthy targets. Options B and C are incorrect because network ACLs or security groups would only affect traffic after NLB sends it, but health check failure prevents traffic from being sent at all. Option D is incorrect because NLB does not have security groups.

Answer

The target subnet network ACL blocks the client IP

Answer

The target instance security group does not allow traffic from the NLB

Answer

The NLB security group blocks the client IP

Question 13

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The security team wants to enforce multi-factor authentication (MFA) for all VPN connections. Which configuration should be used?

Accepted Answer

Use SAML-based federation with an identity provider that requires MFA. AWS Client VPN supports SAML-based federation with an identity provider (IdP) that requires MFA, making option D correct. Option A is incorrect because security groups do not enforce authentication, let alone MFA. Option B is incorrect because using AWS Managed Microsoft AD alone does not enforce MFA; MFA would require additional configuration such as AWS AD Connector or a third-party MFA solution. Option C is incorrect because mutual authentication with client certificates verifies the client's identity but does not enforce MFA.

Answer

Attach a security group to the Client VPN endpoint that only allows MFA-authenticated traffic

Answer

Use AWS Managed Microsoft AD for authentication

Answer

Use mutual authentication with client certificates

Question 14

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted at rest. Which S3 bucket property should be enabled?

Accepted Answer

Default encryption. S3 bucket default encryption ensures that all objects uploaded to the bucket are encrypted at rest. Option A (Versioning) is for preserving object versions, not encryption. Option B (MFA Delete) adds multi-factor authentication for delete operations, not encryption. Option C (Server access logging) logs access requests, not encryption. Therefore, enabling Default encryption is the correct property to enforce encryption at rest.

Answer

Versioning

Answer

MFA Delete

Answer

Server access logging

Question 15

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT gateway in the public subnet. The security team wants to allow only outbound HTTPS traffic from the instance. Which configuration should be used?

Accepted Answer

Security group on the instance with outbound rule allowing HTTPS. A security group on the EC2 instance with an outbound rule allowing HTTPS (port 443) is the correct configuration. Security groups are stateful, so the outbound rule automatically permits the return traffic, requiring no explicit inbound rule. This ensures only outbound HTTPS is allowed from the instance. Option C is incorrect because network ACLs are stateless and would require explicit inbound rules for return traffic, but more importantly, NACLs are subnet‑level controls and are not the best practice for restricting traffic from a single instance. Option B is incorrect because VPC gateway endpoints are for private connectivity to AWS services, not for internet access. Option D is incorrect because a security group on the NAT gateway would control the NAT gateway's own traffic, not the instance behind it.

Answer

VPC gateway endpoint for S3

Answer

Network ACL on the private subnet with outbound rule allowing HTTPS and inbound rule allowing return traffic

Answer

Security group on the NAT gateway with outbound rule allowing HTTPS