ANS-C01 Network Security, Compliance and Governance Practice Test 19 — 15 Questions

Question 1

A company has a VPC with a NAT gateway in a public subnet. They want to restrict outbound internet access from their private subnets to only allow HTTP and HTTPS traffic. They have configured a network ACL on the private subnets. Which additional configuration is required to enforce this restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add outbound rules to the network ACL on the private subnets to allow only HTTP and HTTPS, and deny all other outbound traffic.. Network ACLs on the private subnets can enforce outbound traffic restrictions. By adding rules that allow only HTTP and HTTPS and denying all other outbound traffic, you restrict all instances in those subnets. This is the most direct and cost-effective solution. The NAT gateway will only translate and forward traffic that is allowed by the network ACL.

Answer

Modify the security group on the instances to allow only outbound HTTP and HTTPS.

Answer

Use AWS Network Firewall in the public subnet to filter outbound traffic.

Answer

Configure the NAT gateway to only allow HTTP and HTTPS traffic.

Question 2

A company is deploying a multi-tier web application in a VPC. The application consists of a public-facing Application Load Balancer (ALB) in public subnets, and application servers in private subnets. The security team requires that all traffic to the application servers is encrypted in transit and that the application servers only accept traffic from the ALB. They also need to log all connection attempts to the application servers for auditing. Which two configurations should be implemented to meet these requirements? (Choose two.)

Accepted Answer

Configure the application server security group to allow inbound traffic only from the ALB's security group.. To meet encryption in transit, both the ALB and application servers must use HTTPS. To ensure only the ALB can connect, the application server security group should reference the ALB's security group as the only allowed source. These two configurations together satisfy the encryption and access control requirements. Logging of connection attempts would require additional configuration, such as ALB access logs or server-side logging, but the question asks for two configurations that meet the stated requirements, and these are essential.

Answer

Configure the ALB to use HTTPS listeners and the application servers to use HTTP.

Answer

Configure AWS Network Firewall to inspect traffic between the ALB and the application servers.

Answer

Enable VPC Flow Logs on the application server's elastic network interfaces to capture all traffic.

Question 3

A company uses AWS Site-to-Site VPN over the internet to connect its on-premises data center to a VPC. Compliance requires that all traffic on this connection be encrypted with a customer-managed key and that the company retain control over key rotation. The company also wants to detect and log any attempt to modify the VPN tunnel configuration. Which combination of AWS services should the network engineer use?

Accepted Answer

Use AWS CloudHSM to store the VPN pre-shared keys, configure the tunnels to use those keys, and enable AWS CloudTrail to log VPN API calls.. CloudHSM provides a dedicated, customer-controlled hardware security module for key material, allowing the company to manage and rotate the VPN pre-shared keys itself, which meets the customer-managed key requirement. CloudTrail captures the API calls that create or modify VPN connections, so any attempt to alter the tunnel configuration is logged and auditable.

Answer

Use AWS Secrets Manager to store and rotate the VPN pre-shared keys, and enable AWS Config to record VPN configuration changes as configuration items.

Answer

Configure the VPN tunnels with a private certificate from AWS Certificate Manager and enable VPC Flow Logs to record configuration changes to the VPN connection.

Answer

Use AWS Key Management Service customer managed keys for the VPN tunnel pre-shared keys and enable AWS CloudTrail to log VPN API calls.

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16 and uses AWS Network Firewall to protect its workloads. The security team wants to log all traffic that is denied by the firewall's stateful rule group to an Amazon CloudWatch Logs log group for analysis. They have configured the firewall policy with a stateful rule group that has a default action of 'Drop' and a logging configuration that sends alerts to CloudWatch Logs. However, they notice that only some denied traffic appears in the logs. Which two actions should they take to ensure that all denied traffic is logged? (Choose two.)

Accepted Answer

Ensure that the stateful rule group's default action is set to 'Drop' and that the logging configuration is enabled for the rule group.. To log all denied traffic in AWS Network Firewall, the stateful rule group must have logging enabled for the 'Denied' log type and the default action must be set to 'Drop'. These two settings together ensure that any packet not explicitly allowed is dropped and logged to CloudWatch Logs. Without both, some denied traffic may go unlogged.

Answer

Set the firewall policy's default action for the stateful rule group to 'Drop' and ensure that the logging configuration is attached to the policy, not the rule group.

Answer

Enable logging for the stateful rule group with a log type of 'Alert' and destination CloudWatch Logs.

Answer

Enable logging for the stateless rule group with a log type of 'Flow' and destination CloudWatch Logs.

Question 5

A financial services firm connects its on-premises data center to AWS through an AWS Direct Connect connection with a private virtual interface. Regulators require that data in transit between the data center and the VPC be encrypted, and the firm wants to avoid managing any additional hardware. Application latency budgets are tight but allow a modest increase. Which solution should a network engineer implement?

Accepted Answer

Establish an IPsec VPN over the private virtual interface using a customer gateway and a transit gateway or virtual private gateway.. Direct Connect does not encrypt traffic on its own, so a regulatory encryption mandate requires an overlay. An IPsec VPN established over the existing private virtual interface encrypts traffic between the on-premises customer gateway and the AWS VPN endpoint while preserving the private VIF transport, requires no new hardware, and adds only the latency of IPsec processing.

Answer

Deploy AWS PrivateLink endpoints in the VPC and have the data center connect to the service through the endpoint network interfaces.

Answer

Enable AWS Direct Connect encryption by turning on the encrypt attribute on the virtual interface in the AWS Management Console.

Answer

Configure a MACsec key agreement on the dedicated Direct Connect connection to encrypt traffic at layer 2.

Question 6

A company has an AWS Lambda function that needs to access an Amazon RDS database in a private subnet. The Lambda function is configured to run in a VPC with private subnets and has been assigned a security group. The RDS database has a security group that allows traffic on port 3306 from the Lambda function's security group. However, the Lambda function cannot connect to the database. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role lacks the necessary IAM permissions to create ENIs in the VPC.. The most likely cause is that the Lambda execution role lacks the necessary IAM permissions to create ENIs in the VPC. Without these permissions, Lambda cannot establish network connectivity to the RDS database. Other options are either irrelevant or less likely given the scenario.

Answer

The Lambda function's security group does not allow outbound traffic to the RDS security group.

Answer

The Lambda function does not have a NAT gateway configured for internet access.

Answer

The Lambda function does not have an Elastic IP address associated.

Question 7

A company is deploying a web application on AWS and needs to protect it from common web exploits while also filtering malicious IP addresses. The security team wants to use AWS WAF and AWS Shield. Which two actions should they take to meet these requirements? (Choose two.)

Accepted Answer

Enable AWS Shield Advanced on the Application Load Balancer and create an IP set in AWS WAF to block specific malicious IP addresses.. AWS WAF web ACLs with managed or custom rules protect against SQL injection and XSS, and can be associated with an Application Load Balancer. AWS Shield Advanced adds DDoS protection. To block malicious IPs, an AWS WAF IP set rule is used. Together, these actions satisfy the requirements for web exploit protection and IP filtering.

Answer

Use Amazon GuardDuty to detect malicious IP addresses and automatically create AWS WAF IP set rules.

Answer

Create a security group rule to deny traffic from known malicious IP addresses and attach it to the Application Load Balancer.

Answer

Configure an AWS Network Firewall firewall policy with stateful rules to inspect HTTP traffic and block malicious IPs.

Question 8

A company has a VPC with a CIDR block of 10.0.0.0/16. They have a private subnet with a CIDR of 10.0.1.0/24 that hosts a database. The security team wants to ensure that the database can only be accessed by application servers in another subnet (10.0.2.0/24) on port 3306. They have configured a security group on the database that allows inbound traffic on port 3306 from the application servers' security group. However, they also want to add an additional layer of defense using a network ACL. Which network ACL rule should they add to the database subnet's network ACL to allow the required traffic while following AWS best practices?

Accepted Answer

Add an inbound rule allowing TCP port 3306 from 10.0.2.0/24, and an outbound rule allowing TCP ports 1024-65535 to 10.0.2.0/24.. For a stateless network ACL, you must allow both inbound requests and outbound responses. The database listens on port 3306, so inbound must allow that port from the application subnet. Responses from the database use ephemeral source ports (1024-65535) and go to the application servers' ephemeral destination ports. Therefore, the outbound rule should allow TCP ports 1024-65535 to the application subnet. This ensures return traffic is permitted while maintaining least privilege.

Answer

Add an inbound rule allowing TCP port 3306 from 10.0.2.0/24, and an outbound rule allowing TCP ports 1024-65535 to 0.0.0.0/0.

Answer

Add an inbound rule allowing TCP port 3306 from 10.0.2.0/24, and an outbound rule allowing TCP port 3306 to 10.0.2.0/24.

Answer

Add an inbound rule allowing TCP port 3306 from 0.0.0.0/0, and an outbound rule allowing all traffic.

Question 9

A company is deploying a web application in a VPC. They want to protect the application from common web exploits and DDoS attacks. They also need to ensure that only traffic from specific geographic regions is allowed. Which TWO AWS services should they use to meet these requirements? (Choose two.)

Accepted Answer

AWS Shield Advanced. AWS WAF and AWS Shield Advanced together provide comprehensive protection. AWS WAF protects against common web exploits and allows geographic restrictions. AWS Shield Advanced provides DDoS protection. Both are needed to meet all requirements.

Answer

Amazon CloudFront with geo restriction

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Question 10

A company has an AWS Direct Connect connection with a private virtual interface (VIF) to a VPC. They also have a Site-to-Site VPN as a backup. The security team wants to ensure that all traffic to on-premises is encrypted and that failover to the VPN is automatic. They have configured BGP with AS path prepending on the VPN. However, they notice that traffic is not failing over when the Direct Connect goes down. What is the likely cause?

Accepted Answer

The Direct Connect BGP session is not being withdrawn, so the routes remain in the routing table with a lower AS path length than the VPN.. For automatic failover from Direct Connect to VPN, the Direct Connect BGP session must be withdrawn when the connection fails. If the session remains up, AWS continues to prefer the Direct Connect routes due to shorter AS path. AS path prepending on the VPN makes its routes less preferred, which is correct for backup, but failover only occurs if the primary routes are removed. The other options address less likely causes.

Answer

The BGP timer settings on the VPN are not aligned with the Direct Connect BGP timers.

Answer

The VPN connection is not advertising the same routes as the Direct Connect, so the on-premises network does not have a backup path.

Answer

The VPN connection is using a different pre-shared key than the Direct Connect, causing authentication failures.

Question 11

A company is designing a hybrid cloud architecture with AWS. They need to ensure that all traffic between their on-premises data center and AWS is encrypted, and that they can centrally manage encryption keys. They also need to meet compliance requirements that mandate the use of FIPS 140-2 validated cryptographic modules. Which two AWS services or features should they use to meet these requirements? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN with a customer gateway configured to use FIPS 140-2 validated IPsec.. AWS Site-to-Site VPN with FIPS 140-2 validated IPsec provides encrypted tunnels, and ACM Private CA enables centralized certificate management for VPN authentication, meeting compliance and key management requirements. Direct Connect with MACsec lacks FIPS validation and end-to-end encryption. KMS and CloudHSM do not natively manage VPN keys.

Answer

AWS CloudHSM to store the pre-shared keys for the VPN tunnels.

Answer

AWS Key Management Service (KMS) with customer managed keys to manage encryption keys for the VPN.

Answer

AWS Direct Connect with MACsec encryption for the dedicated connection.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to restrict access to an Amazon S3 bucket so that only resources within this VPC can access it. The company has configured a VPC endpoint for S3 and attached a bucket policy that allows access from the VPC endpoint. However, the security team wants to ensure that requests to the S3 bucket are only allowed if they originate from the VPC. Which additional configuration should be implemented to meet this requirement?

Accepted Answer

Update the S3 bucket policy to include a condition that restricts access to the VPC ID using the aws:sourceVpc condition key.. To ensure that requests to an S3 bucket originate only from a specific VPC, the bucket policy should include a condition using the aws:sourceVpc condition key. This key is evaluated based on the VPC ID from which the request is made. When using a gateway VPC endpoint for S3, the request includes the VPC ID, allowing the bucket policy to enforce that only resources within that VPC can access the bucket. This is the most secure and direct method to meet the requirement.

Answer

Modify the S3 bucket policy to include a condition that restricts access to the VPC endpoint ID.

Answer

Update the S3 bucket policy to include a condition that restricts access to the VPC CIDR block using the aws:SourceIp condition key.

Answer

Configure the S3 bucket policy to deny all requests that do not come from the VPC endpoint's elastic network interface.

Question 13

A company runs a production VPC with an Internet-facing Application Load Balancer in public subnets and application servers in private subnets. A security audit reveals that some application servers initiated outbound connections to unknown IP addresses on port 443. The security team wants to block this outbound traffic and log any attempts, while still allowing the servers to receive inbound traffic from the ALB. The company uses a NAT Gateway for outbound internet access. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Deploy AWS Network Firewall in a dedicated subnet, update the route tables for the private subnets to send outbound traffic through the firewall endpoint, and configure stateful rule groups to block outbound traffic to unknown IPs on port 443 and log the blocked traffic.. AWS Network Firewall provides stateful inspection and logging for VPC traffic. By routing outbound traffic from private subnets through the firewall endpoint, you can enforce rules that block unknown IPs on port 443 while allowing legitimate traffic. The service logs blocked attempts, and it is fully managed, reducing operational overhead. Security groups and network ACLs lack the granularity and logging capabilities required, and PrivateLink is not designed for this purpose.

Answer

Modify the existing security group for the application servers to remove all outbound rules, and create a network ACL on the private subnets that denies outbound traffic to unknown IPs on port 443. Enable VPC Flow Logs on the network ACL.

Answer

Create a new security group that denies all outbound traffic and attach it to the application servers. Use VPC Flow Logs to capture the blocked traffic.

Answer

Use AWS PrivateLink to create an endpoint for the unknown IP addresses, and configure a VPC endpoint policy to deny traffic to those IPs. Enable VPC Flow Logs to capture the denied traffic.

Question 14

A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses dynamic routing with BGP. The company's security policy requires that all traffic from on-premises to the VPC be inspected by a third-party firewall appliance running on an EC2 instance in the VPC. The firewall appliance is deployed in a subnet with a route table that directs traffic to the internet gateway. The company has configured the VPN connection to advertise the on-premises routes to the VPC. After deployment, the security team notices that traffic from on-premises to the VPC is not being inspected by the firewall appliance. What is the MOST likely cause of this issue?

Accepted Answer

The VPC route tables do not have a route for the on-premises CIDR pointing to the firewall appliance's elastic network interface.. For traffic from on-premises to be inspected by a firewall appliance in the VPC, the VPC route tables must have routes that direct traffic to the appliance's ENI. Specifically, the route table for the subnet where the traffic enters (e.g., the VPN gateway subnet) or the subnet where the destination resides must have a route for the on-premises CIDR pointing to the firewall appliance's ENI. Without this route, traffic is routed directly to the destination, bypassing the firewall. The VPN connection itself only propagates routes to the VPC route tables for the on-premises network, but it does not force traffic through the appliance. Therefore, the missing route is the most likely cause.

Answer

The firewall appliance's security group is not allowing traffic from the on-premises CIDR block.

Answer

The VPN connection is not configured to use BGP, so routes are not propagated to the VPC route tables.

Answer

The VPN connection is configured to use static routing instead of dynamic routing, so the on-premises routes are not known to the VPC.

Question 15

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The company has a private virtual interface (VIF) with a BGP session. The on-premises router advertises a default route (0.0.0.0/0) to the VIF, and the VPC route table has a route for 0.0.0.0/0 pointing to the VIF. The company wants to ensure that if the BGP session goes down, traffic to on-premises fails over to a VPN connection. The company has set up a Site-to-Site VPN as a backup. However, during a recent test, when the BGP session was shut down, traffic did not fail over to the VPN. What is the MOST likely cause?

Accepted Answer

The VPC route table does not have a route for 0.0.0.0/0 pointing to the VPN connection.. For failover from Direct Connect to VPN to work when the on-premises router advertises a default route, the VPC route table must have two entries for 0.0.0.0/0: one pointing to the Direct Connect VIF and one pointing to the VPN. When the BGP session goes down, the VIF route is withdrawn, and the VPN route becomes active. Without the VPN route, traffic has no path. The other options are less likely because they do not address the missing backup route for the default prefix.

Answer

The VPC route table does not have a route for the on-premises CIDR pointing to the VPN connection.

Answer

The Direct Connect VIF is configured with a lower BGP local preference than the VPN, causing the VPN to be preferred even when the VIF is up.

Answer

The BGP session on the VPN connection is not configured to advertise the same routes as the Direct Connect VIF.