ANS-C01 Network Security, Compliance and Governance Practice Test 19 — 15 Questions

Question 1

A company is using AWS Transit Gateway to connect multiple VPCs. The security team wants to inspect all traffic between VPCs with a third-party firewall appliance deployed in a centralized inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Transit Gateway route tables with a blackhole route for the inter-VPC traffic and a route pointing to the inspection VPC.. By configuring Transit Gateway route tables with a blackhole route for inter-VPC traffic and a more specific route pointing to the inspection VPC, traffic between VPCs is forced to go through the inspection VPC for firewall inspection. Option A is wrong because VPC peering does not support transitive routing and would require full mesh. Option B is wrong because AWS PrivateLink is used for private connectivity to services, not for routing traffic between VPCs. Option D is wrong because a Network Load Balancer is not designed for traffic inspection and would add unnecessary complexity.

Answer

Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Use AWS PrivateLink to route traffic through the inspection VPC.

Answer

Attach a Network Load Balancer in each VPC and route traffic through it.

Question 2

A company needs to meet compliance requirements that mandate encryption of all data in transit between EC2 instances in the same VPC. The instances are in different subnets and communicate using TCP port 443. Which solution should a network engineer implement?

Accepted Answer

Configure the application to use TLS for communication.. Configuring the application to use TLS ensures end-to-end encryption of data in transit between EC2 instances, meeting the compliance requirement. Option B is incorrect because VPC Flow Logs only capture metadata about traffic (e.g., IP addresses, ports, protocols) and do not encrypt the data itself. Option C is incorrect because AWS Certificate Manager (ACM) provisions certificates but does not automatically encrypt traffic; the application must use those certificates within a TLS configuration. Option D is incorrect because deploying a VPN connection between instances within the same VPC adds unnecessary complexity and does not automatically encrypt application-layer traffic.

Answer

Enable VPC Flow Logs to monitor for unencrypted traffic.

Answer

Use AWS Certificate Manager (ACM) to provision certificates and enable encryption automatically.

Answer

Deploy a VPN connection between the instances.

Question 3

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer needs to restrict access to only the company's public IP range (203.0.113.0/24). What is the correct way to modify the security group rule?

Accepted Answer

Edit the existing inbound rule and change the source CIDR to 203.0.113.0/24.. The CIDR should be changed from 0.0.0.0/0 to 203.0.113.0/24. Option B is wrong because adding a second rule does not remove the open rule. Option C is wrong because security groups do not support deny rules; they are allow-only. Option D is wrong because removing the rule and adding a new deny rule is not how security groups work; security groups are allow-only.

Answer

Add a new inbound rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

Answer

Remove the security group rule and add a new rule to deny SSH from 0.0.0.0/0.

Answer

Create a network ACL that denies SSH from 0.0.0.0/0.

Question 4

A company is deploying an AWS Network Firewall in a centralized inspection VPC and needs to send traffic from multiple VPCs through it. The VPCs are attached to a Transit Gateway. What configuration is required to route traffic to the firewall?

Accepted Answer

Create a Transit Gateway route table with a route to the Network Firewall endpoint and attach the VPCs to it.. The Transit Gateway route table must have a route pointing to the Network Firewall endpoint, and the VPCs attached to that route table will have their traffic inspected by the firewall. Options B, C, and D are incorrect: VPC Gateway Endpoints are for accessing AWS services, not for routing traffic through a firewall; adding routes directly to the firewall's ENI in each VPC subnet is not supported without an endpoint; and NAT gateways are used for outbound internet traffic, not for routing to a firewall.

Answer

Create a VPC Gateway Endpoint for the firewall service.

Answer

Add a route in each VPC's subnet routing table pointing to the firewall's elastic network interface.

Answer

Configure a NAT gateway in each VPC and route traffic through it.

Question 5

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which AWS service should be used to provide internet access to instances in the private subnets without assigning public IP addresses?

Accepted Answer

NAT gateway in a public subnet.. A NAT gateway allows instances in private subnets to initiate outbound traffic to the internet. Option B is wrong because Internet Gateway alone does not provide NAT; it requires public IPs. Option C is wrong because VPN does not provide direct internet access. Option D is wrong because VPC endpoint is for accessing AWS services.

Answer

Internet gateway attached to the VPC.

Answer

VPC Gateway Endpoint for Amazon S3.

Answer

Site-to-Site VPN connection.

Question 6

A security engineer is designing a network ACL for a public subnet. The subnet hosts a web server on port 443. Which inbound and outbound rules should be configured to allow HTTPS traffic from the internet? (Assume default deny all rule.)

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0.. NACLs are stateless, requiring explicit inbound and outbound rules. The inbound rule allows HTTPS (TCP 443) from the internet. The outbound rule allows return traffic on ephemeral ports (1024-65535) back to the internet. Option B is wrong because the outbound rule only allows TCP 443, which is too restrictive for return traffic. Option C is wrong because the inbound rule only allows ephemeral ports, not HTTPS. Option D is wrong because it incorrectly states 'for responses' and the outbound rule is still too restrictive.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

Answer

Inbound: allow TCP 1024-65535 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to 0.0.0.0/0 for responses.

Question 7

A company has a requirement to audit all network traffic leaving a VPC. The traffic includes traffic to the internet, to on-premises via VPN, and to other VPCs via Transit Gateway. Which AWS service can capture and log all outbound traffic for compliance analysis?

Accepted Answer

VPC Traffic Mirroring. (VPC Traffic Mirroring) is correct because it captures and copies all outbound network traffic, including full packets, for compliance analysis. Option B (VPC Flow Logs) is incorrect because it only logs metadata (e.g., IP addresses, ports, protocols) but not the full packet content. Option C (AWS CloudTrail) is incorrect because it logs API calls and management events, not network traffic. Option D (Amazon GuardDuty) is incorrect because it is a threat detection service that analyzes traffic for anomalies, but it does not log all traffic for auditing purposes.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 8

A company wants to securely connect an on-premises data center to an AWS VPC over the internet using IPsec. Which AWS service should be used?

Accepted Answer

AWS Site-to-Site VPN. WS Site-to-Site VPN, which creates IPsec tunnels over the internet to securely connect an on-premises data center to an AWS VPC. Option A (AWS Transit Gateway) is a network transit hub that can interconnect multiple VPCs and VPNs, but it is not the VPN service itself. Option B (AWS Direct Connect) provides a dedicated physical connection, not over the internet. Option C (AWS Client VPN) is for individual remote users, not for site-to-site connections.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Client VPN

Question 9

A network engineer needs to ensure that all traffic between two VPCs (VPC A and VPC B) is encrypted in transit. The VPCs are in the same region and are connected via a VPC peering connection. What should the engineer do?

Accepted Answer

No additional action is required; all traffic over VPC peering is automatically encrypted.. VPC peering traffic within the same AWS region is automatically encrypted at the physical layer by AWS, ensuring data in transit is encrypted without additional configuration. Option A is incorrect because VPN over VPC peering is not supported and unnecessary. Option C is incorrect while application-level encryption like TLS can be added for extra security, it is not required as the traffic is already encrypted. Option D is incorrect because AWS Transit Gateway with VPN attachments adds unnecessary complexity and cost when VPC peering already provides encrypted connectivity.

Answer

Establish a VPN connection between the VPCs over the peering connection.

Answer

Implement application-level encryption such as TLS.

Answer

Use AWS Transit Gateway with VPN attachments between VPCs.

Question 10

A company is implementing a network security solution for a VPC that contains a web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The company wants to protect against common web exploits and also filter outbound traffic from the instances. Which TWO services should be used together?

Accepted Answer

AWS WAF. To protect against common web exploits, AWS WAF (Option B) should be used with the ALB to filter incoming HTTP/HTTPS requests. For filtering outbound traffic from the EC2 instances, AWS Network Firewall (Option C) provides stateful inspection of both inbound and outbound traffic. Option A (AWS Shield Advanced) is a DDoS protection service, not for web exploit filtering. Option D (Network ACLs) are stateless and cannot perform content-based filtering. Option E (Amazon GuardDuty) is a threat detection service, not a firewall.

Answer

AWS Shield Advanced

Answer

Network ACLs

Answer

Amazon GuardDuty

Question 11

A company is designing a multi-VPC architecture with AWS Transit Gateway. The security requirements include: (1) all inter-VPC traffic must be inspected by a central firewall, (2) traffic to the internet must egress through a centralized egress VPC, and (3) traffic to on-premises via Direct Connect must go through the same inspection firewall. Which THREE components are required to meet these requirements?

Accepted Answer

AWS Network Firewall in an inspection VPC. The correct components are B, C, and E. Option B (AWS Network Firewall in an inspection VPC) provides the central firewall to inspect inter-VPC traffic. Option C (Virtual Private Gateway (VGW) attachment to the inspection VPC) enables on-premises Direct Connect traffic to be routed through the inspection VPC and firewall. Option E (AWS Transit Gateway with multiple route tables) allows segmentation of traffic and ensures that inter-VPC traffic and traffic to/from on-premises is routed through the inspection VPC. Option A (VPC peering connections between all VPCs) is not needed because Transit Gateway provides the connectivity. Option D (NAT gateways in each VPC) is not required because internet egress is centralized through an egress VPC, not through individual NAT gateways.

Answer

VPC peering connections between all VPCs

Answer

NAT gateways in each VPC

Question 12

A security team needs to implement a solution to detect and alert on suspicious network traffic within a VPC. The solution should analyze VPC Flow Logs and generate findings for potential threats. Which THREE AWS services can be used together to achieve this?

Accepted Answer

VPC Flow Logs. The correct combination is A (VPC Flow Logs) as the data source, B (Amazon Detective) for deep investigation of findings, and C (Amazon GuardDuty) which automatically analyzes VPC Flow Logs for threat detection. Options D (AWS CloudTrail) is incorrect because it logs API calls, not network traffic. Option E (AWS Config) is incorrect as it tracks resource configuration changes.

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A company runs a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be inspected by a third-party firewall appliance for compliance. The firewall appliance must be deployed in a separate VPC and must inspect traffic without introducing a single point of failure. Which architecture meets these requirements?

Accepted Answer

Deploy Gateway Load Balancer endpoints in the application VPC and attach them to the firewall appliance in the inspection VPC across multiple Availability Zones.. Gateway Load Balancer endpoints in the application VPC allow traffic to be sent to a third-party firewall appliance deployed in a separate inspection VPC across multiple Availability Zones, providing high availability and traffic inspection. Option A is incorrect because Proxy Protocol v2, while used for preserving client IP, does not enable traffic inspection by a firewall. Option B is incorrect because AWS Direct Connect is a dedicated network connection to on-premises, not a mechanism for traffic inspection. Option C is incorrect because AWS Network Firewall is a managed service that can inspect traffic, but it cannot be used to route traffic to a third-party firewall appliance in a separate VPC; it is itself the firewall.

Answer

Configure the Application Load Balancer to send all traffic to the firewall appliance using Proxy Protocol v2.

Answer

Use AWS Direct Connect to route all traffic through the firewall appliance.

Answer

Use AWS Network Firewall to inspect traffic.

Question 14

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.. AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation. Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

Answer

VPC Flow Logs are not capturing all traffic.

Answer

The network ACL inbound rule blocks the return traffic.

Answer

The security group outbound rule is not configured correctly.

Question 15

A company wants to securely connect an on-premises data center to a VPC in AWS. The connection must be encrypted and use the public internet. The company has a moderate volume of traffic and needs a quick setup. Which solution meets these requirements?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted IPSec tunnel over the public internet and can be set up quickly. Option A is wrong because AWS Client VPN is for individual client connections, not site-to-site. Option B is wrong because AWS Transit Gateway is a network transit hub, not a connection method. Option D is wrong because AWS Direct Connect provides a dedicated private connection, not over the public internet.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect