ANS-C01 Network Security, Compliance and Governance Practice Test 18 — 15 Questions

Question 1

A company is designing a network security architecture for a multi-tier application. Which TWO of the following are best practices for implementing defense in depth?

Accepted Answer

Use security groups to control traffic between instances. The correct answers are B and D. Security groups act as stateful, instance-level firewalls, making them a best practice for controlling traffic between instances (B). Placing web servers in public subnets and application servers in private subnets provides network segmentation, a key defense-in-depth principle (D). Option A is incorrect because network ACLs are stateless, not stateful. Option C is incorrect because internet gateways should only be attached to public subnets, not all subnets. Option E is incorrect because using the same security group for all tiers reduces security boundaries.

Answer

Use network ACLs as stateful firewalls at the subnet level

Answer

Attach internet gateways to all subnets for high availability

Answer

Use the same security group for all tiers to simplify management

Question 2

A company is using AWS Direct Connect to connect on-premises to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which TWO options can achieve this?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect virtual interface. You can establish an IPsec VPN tunnel over a Direct Connect virtual interface to encrypt traffic at Layer 3. Option B is correct because MACsec (802.1ae) provides encryption at Layer 2 for dedicated connections. Option C is incorrect because TLS only encrypts specific application traffic, not all traffic traversing the link. Option D is incorrect because VPC gateway endpoints are used for private connectivity to S3 and DynamoDB, but they do not encrypt data across the Direct Connect link itself. Option E is incorrect because physical security does not provide encryption of data in transit.

Answer

Use TLS on all applications

Answer

Use VPC gateway endpoints for S3

Answer

Rely on Direct Connect's physical security

Question 3

A company needs to audit network traffic in a VPC for compliance. Which THREE AWS services can be used to capture and analyze network traffic?

Accepted Answer

Traffic Mirroring. Traffic Mirroring captures and inspects traffic. Option C is correct because VPC Flow Logs capture IP traffic information. Option D is correct because AWS Network Firewall can log traffic. Option A is wrong because AWS Config monitors resource configurations, not traffic. Option E is wrong because CloudTrail logs API calls, not network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized firewall appliance in a inspection VPC. Which architecture meets this requirement?

Accepted Answer

Attach all VPCs to a Transit Gateway and create separate route tables for inspection.. Transit Gateway route tables can direct traffic between VPCs through a central inspection VPC by using route propagation and appropriate route table associations. Option A is wrong because VPC peering does not support transitive routing; traffic would need to traverse multiple non-transitive connections, and peering alone cannot force traffic through a centralized firewall. Option B is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; traffic between VPCs would flow directly unless routing forces it through the firewall, which is not described. Option D is wrong because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing traffic between VPCs through an inspection VPC.

Answer

Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Deploy AWS Network Firewall in each VPC and allow traffic to flow directly between VPCs.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs through the inspection VPC.

Question 5

A network engineer is designing a security group for a web application that must allow inbound HTTPS traffic from the internet and outbound traffic to an RDS MySQL database. The web servers are in a public subnet and the RDS database is in a private subnet. What is the most secure way to configure the security groups?

Accepted Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from Web SG.. The most secure configuration. The web server security group allows inbound HTTPS from the internet (0.0.0.0/0) and outbound MySQL traffic specifically to the database security group. The database security group allows inbound MySQL only from the web server security group. This ensures that only the web servers can communicate with the database, minimizing exposure. Option B is less secure because the web server security group allows outbound traffic to 0.0.0.0/0, which is overly permissive. Option C is incorrect because the database security group allows inbound MySQL from 0.0.0.0/0, exposing the database to the internet. Option D combines both overly permissive outbound and inbound rules, making it the least secure.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from Web SG.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from 0.0.0.0/0.

Answer

Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from 0.0.0.0/0.

Question 6

A company wants to block inbound traffic from a specific IP address range (203.0.113.0/24) at the VPC level using AWS WAF. Which resource should the AWS WAF web ACL be associated with?

Accepted Answer

Application Load Balancer. AWS WAF can be associated with an Application Load Balancer to filter HTTP/HTTPS traffic. Option B is wrong because NLB does not support AWS WAF. Option C is wrong because VPC peering does not have a web ACL. Option D is wrong because a security group is used for stateful filtering, but AWS WAF is a separate service for web traffic.

Answer

Network Load Balancer

Answer

VPC peering connection

Answer

Security group

Question 7

A company uses AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate for a domain hosted on Route 53. The certificate is used by an Application Load Balancer. After renewal, the ALB continues to serve the old certificate. What is the most likely cause?

Accepted Answer

DNS validation failed during renewal.. The most likely cause is that DNS validation failed during renewal. ACM attempts to automatically renew public certificates using DNS validation when the domain is in Route 53. If the DNS validation fails (e.g., due to incorrect CNAME record or permissions), the certificate will not be renewed, and the ALB will continue to serve the old certificate. Option B is incorrect because ACM automatically redeploys renewed public certificates to associated resources such as ALB listeners; no manual update is required. Option A is incorrect because ACM handles renewal and does not require import. Option C is incorrect because the certificate is public, not private.

Answer

The certificate was not imported into ACM correctly.

Answer

The ALB listener is not configured to use the new certificate.

Answer

The certificate is a private certificate and cannot be used with an ALB.

Question 8

A company has a VPC with public and private subnets. The public subnet hosts a NAT gateway. The private subnet hosts EC2 instances that need to download patches from the internet. The EC2 instances have a security group that allows outbound HTTPS to 0.0.0.0/0. What additional configuration is required?

Accepted Answer

Add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway.. EC2 instances in a private subnet need a route in their route table that directs internet traffic (0.0.0.0/0) to the NAT gateway to access the internet for patch downloads. Option A is incorrect because an internet gateway is attached to the VPC, not a subnet, and private subnets should not have direct internet access. Option B is incorrect because the NAT gateway must be in a public subnet to have internet access via the internet gateway. Option D is incorrect because a VPC endpoint for S3 is used for private connectivity to S3, not for general internet access.

Answer

Attach an internet gateway to the private subnet.

Answer

Move the NAT gateway to the private subnet.

Answer

Create a VPC endpoint for S3.

Question 9

A security team needs to audit all network traffic entering and leaving a VPC. Which AWS service should be used to capture IP traffic information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, allowing auditing of all network traffic. Option B is wrong because AWS Config records resource configuration changes, not network traffic. Option C is wrong because Amazon CloudWatch Logs can store and monitor logs but does not capture network traffic. Option D is wrong because AWS CloudTrail records API calls, not network traffic.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 10

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN tunnel is up, but traffic from on-premises cannot reach EC2 instances in the VPC. The EC2 instances have a security group that allows inbound ICMP from the on-premises CIDR. What is the most likely cause?

Accepted Answer

The subnet route table does not have a route for the on-premises CIDR pointing to the virtual private gateway.. For traffic from on-premises to reach EC2 instances in the VPC via Site-to-Site VPN, the subnet route table must include a route for the on-premises CIDR block with the virtual private gateway (VGW) as the target. Option A is incorrect because ICMP is allowed. Option B is incorrect because static routes are not required on the VPN connection itself; routes are needed in the route table. Option D is incorrect because subnet association with the main route table is not necessary; any custom route table works.

Answer

The security group rule is using the wrong protocol.

Answer

The VPN connection does not have static routes configured.

Answer

The subnet is not associated with the main route table.

Question 11

A company wants to allow a specific IAM user to manage network ACLs for a specific VPC only. Which IAM policy action should be used?

Accepted Answer

ec2:ModifyNetworkAclAttribute. Managing network ACLs requires multiple IAM actions, including creating, deleting, and modifying rules and attributes. None of the listed actions alone sufficiently allows full management. ec2:ModifyNetworkAclAttribute only modifies attributes like tags, ec2:CreateNetworkAcl only creates new ACLs, ec2:DescribeNetworkAcls is read-only, and ec2:AuthorizeSecurityGroupIngress is for security groups. To allow a user to manage network ACLs, a combination of actions such as ec2:CreateNetworkAcl, ec2:DeleteNetworkAcl, ec2:ReplaceNetworkAclEntry, etc. is needed.

Answer

ec2:AuthorizeSecurityGroupIngress

Answer

ec2:CreateNetworkAcl

Answer

ec2:DescribeNetworkAcls

Question 12

A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?

Accepted Answer

AWS Network Firewall. AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A (AWS WAF) is wrong because it works at the application layer for inbound web traffic and does not block outbound traffic at the instance level. Option B (Network ACL) is wrong because NACLs are stateless and work at the subnet level. Option C (Security group with outbound rules) is wrong because security groups do not support allowlisting based on domain names.

Answer

AWS WAF

Answer

Network ACL

Answer

Security group with outbound rules

Question 13

A company needs to ensure that all outbound traffic from a VPC goes through a centralized inspection appliance in a different VPC. Which TWO actions must be taken to achieve this?

Accepted Answer

Use AWS Transit Gateway with appropriate route tables to direct traffic to the inspection VPC.. The correct answers are D and E. D: AWS Transit Gateway enables transitive routing between VPCs. By configuring appropriate route tables, traffic from source VPCs can be directed to the inspection VPC for centralized inspection. E: After the inspection appliance processes the traffic, it must be forwarded to its final destination. This requires proper routing in the inspection VPC to send the inspected traffic out to the internet or to another VPC. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet traffic routing. Option B is incorrect because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing between VPCs. Option C is incorrect because VPC peering does not support transitive routing; it only allows direct communication between two VPCs, not through a third VPC.

Answer

Deploy VPC endpoints for all AWS services used.

Answer

Use AWS Direct Connect Gateway to route traffic between VPCs.

Answer

Create VPC peering connections between all VPCs.

Question 14

Which THREE of the following are valid ways to restrict access to an S3 bucket that is accessed by EC2 instances in a VPC?

Accepted Answer

Use an S3 bucket policy that restricts access to the VPC or VPC endpoint.. Options A, C, and D are correct. Option A: S3 bucket policies can restrict access based on source VPC or VPC endpoint. Option C: VPC endpoint policies can specify which S3 buckets can be accessed through the endpoint. Option D: IAM roles (instance profiles) grant permissions to EC2 instances to access S3 buckets. Option B is incorrect because network ACLs operate at the subnet level and do not filter by S3 bucket; they only filter based on IP addresses. Option E is incorrect because security groups do not apply to S3 bucket access; they control traffic to/from EC2 instances.

Answer

Use a network ACL to restrict access to the S3 prefix list.

Answer

Use a security group to allow outbound traffic from the EC2 instance to the S3 bucket.

Question 15

Which TWO of the following are best practices for securing a VPC?

Accepted Answer

Use multiple Availability Zones for redundancy.. (Use multiple Availability Zones) is correct because it provides redundancy and improves availability, which is a key security best practice by ensuring fault tolerance. Option D (Restrict inbound SSH access to specific IP ranges) is correct as it minimizes the attack surface by limiting administrative access to authorized IPs only. Option A is wrong: VPC Flow Logs capture IP traffic information but do not block traffic; they are used for monitoring and analysis, not as a security control. Option C is wrong: placing databases in public subnets exposes them to the internet, increasing risk; they should be in private subnets with controlled access. Option E is wrong: the default VPC security group allows all inbound traffic, which is overly permissive; custom security groups should be used to implement least privilege.

Answer

Enable VPC Flow Logs on all subnets to block malicious traffic.

Answer

Place database instances in public subnets for easier management.

Answer

Use the default VPC security group for all instances.