ANS-C01 Network Security, Compliance and Governance Practice Test 19 — 15 Questions

Question 1

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.. Option C is correct because AWS Network Firewall's stateful rules are evaluated only for traffic that goes through the firewall endpoint. If the subnet's route table does not point to the firewall endpoint, traffic bypasses the firewall. Option A is wrong because VPC Flow Logs capture traffic after security group and NACL evaluation. Option B is wrong because security group allows outbound HTTPS. Option D is wrong because network ACL allows outbound traffic.

Answer

VPC Flow Logs are not capturing all traffic.

Answer

The network ACL inbound rule blocks the return traffic.

Answer

The security group outbound rule is not configured correctly.

Question 2

A company wants to securely connect an on-premises data center to a VPC in AWS. The connection must be encrypted and use the public internet. The company has a moderate volume of traffic and needs a quick setup. Which solution meets these requirements?

Accepted Answer

AWS Site-to-Site VPN. Option B is correct because AWS Site-to-Site VPN creates an encrypted IPSec tunnel over the public internet and can be set up quickly. Option A is wrong because Direct Connect provides a dedicated connection, not over the internet. Option C is wrong because Client VPN is for individual client connections, not site-to-site. Option D is wrong because Transit Gateway is a network transit hub, not a connection method.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no VPC in any account can have an internet gateway attached. Which option meets this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.. Option D is correct because a service control policy (SCP) can be applied to the root or OUs to deny the ec2:AttachInternetGateway action. Option A is wrong because IAM roles are per-account and not centrally enforced. Option B is wrong because security groups do not control internet gateway attachments. Option C is wrong because network ACLs do not control internet gateway attachments.

Answer

Create an IAM policy that denies ec2:AttachInternetGateway and attach it to each account's admin role.

Answer

Use security groups to block traffic from internet gateways.

Answer

Use network ACLs to block traffic from internet gateways.

Question 4

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to use a proxy server running on an EC2 instance in the public subnet. The security group for the proxy server must allow inbound HTTP/HTTPS from the instance in the private subnet. The security group for the private instance must allow outbound HTTP/HTTPS to the proxy server. However, the private instance cannot connect to the proxy. What is the most likely cause?

Accepted Answer

The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.. Option B is correct because the route table of the private subnet likely has a default route to a NAT gateway or internet gateway, causing traffic to bypass the proxy. The private instance's security group allows outbound HTTP/HTTPS to the proxy, but the subnet route may not point to the proxy. Option A is wrong because the network ACL must allow both inbound and outbound traffic; if it blocks inbound, the proxy cannot receive requests. Option C is wrong because the proxy's security group allows inbound from the private instance. Option D is wrong because the private instance's security group allows outbound to the proxy.

Answer

The security group for the private instance does not allow outbound traffic to the proxy server.

Answer

The network ACL for the private subnet blocks inbound traffic from the proxy.

Answer

The security group for the proxy server does not allow inbound traffic from the private instance's security group.

Question 5

A company needs to audit all changes to security groups in a VPC. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls, including changes to security groups, and can be used for auditing. Option A is wrong because CloudWatch is for monitoring metrics and logs, not API activity. Option B is wrong because VPC Flow Logs capture network traffic, not API changes. Option D is wrong because AWS Config can track resource changes but is not primarily for auditing API calls; it focuses on resource configuration.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch

Question 6

A company has a VPC with multiple subnets. The network ACL for a subnet is configured to deny all inbound traffic. A security group attached to an EC2 instance in that subnet allows SSH from a specific IP range. Will SSH traffic from that IP range reach the instance?

Accepted Answer

No, because the network ACL denies all inbound traffic.. Option B is correct because network ACLs are stateless and deny all inbound traffic, so even though the security group allows SSH, the network ACL will block the traffic before it reaches the instance. Option A is wrong because security groups are stateful but are evaluated after network ACLs. Option C is wrong because the network ACL operates at the subnet level. Option D is wrong because the order does not matter for stateless ACLs.

Answer

Yes, because the security group allows SSH.

Answer

Yes, because the security group overrides the network ACL.

Answer

It depends on the rule number order in the network ACL.

Question 7

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The application is fronted by Amazon CloudFront and an Application Load Balancer. The security team wants to receive notifications when a DDoS attack is detected. Which AWS service should be used to receive these notifications?

Accepted Answer

Amazon CloudWatch. Option C is correct because AWS Shield Advanced integrates with Amazon CloudWatch to emit DDoS detection metrics, which can trigger CloudWatch Alarms for notifications. Option A is wrong because Amazon GuardDuty focuses on threat detection, not Shield events. Option B is wrong because AWS Config is for resource configuration auditing. Option D is wrong because VPC Flow Logs capture network traffic, not Shield events.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 8

A company wants to allow a specific IP address range to access an EC2 instance in a private subnet using a bastion host. The bastion host is in a public subnet. Which security group configuration is correct?

Accepted Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the bastion security group.. Option A is correct because the bastion host should allow SSH from the IP range, and the private instance should allow SSH only from the bastion host's security group. Option B is wrong because the bastion host should not allow SSH from the private instance. Option C is wrong because the private instance should not allow SSH from the internet. Option D is wrong because the bastion host should not allow SSH from the private instance.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the bastion security group.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the IP range.

Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the IP range.

Question 9

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC contains a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to use a VPC endpoint for S3. Which TWO configurations are required?

Accepted Answer

Create an endpoint policy that allows access to the S3 bucket.. Option A is correct because a gateway endpoint for S3 must have a route in the private subnet's route table pointing to the endpoint. Option C is correct because the endpoint policy must allow the instance to access the specific bucket. Option B is wrong because gateway endpoints do not use ENIs or security groups. Option D is wrong because gateway endpoints are free; no need to assign a public IP. Option E is wrong because NAT gateway is not needed when using a VPC endpoint.

Answer

Assign a public IP address to the EC2 instance.

Answer

Deploy a NAT gateway in the public subnet.

Answer

Attach a security group to the gateway endpoint.

Question 10

A security engineer is designing a network security solution for a multi-tier application. The web tier must be accessible from the internet on ports 80 and 443. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier on port 3306. Which THREE network access control mechanisms should be used?

Accepted Answer

Security groups that allow traffic from specific security groups for the database tier.. Option A is correct because security groups can be used to allow traffic between tiers based on security group IDs. Option C is correct because network ACLs provide stateless filtering at the subnet level. Option E is correct because security groups for the database tier can reference the application tier security group. Option B is wrong because IAM is for identity management, not network filtering. Option D is wrong because AWS WAF is for web application firewall at the application layer, not for network-level access between tiers.

Answer

AWS WAF to filter traffic to the database tier.

Answer

IAM policies to restrict access to the database.

Question 11

A company is designing a network architecture for a highly sensitive application that must meet strict compliance requirements. The application is deployed in a VPC with multiple subnets. The company needs to ensure that all traffic between subnets is encrypted and that no traffic can bypass the encryption. Which THREE steps should be taken?

Accepted Answer

Use network ACLs to block all traffic except encrypted protocols (e.g., IPSec).. Option B is correct because using NACLs to block non-encrypted traffic enforces encryption at the subnet level. Option C is correct because a VPC CNI plugin can enforce encryption for Kubernetes workloads. Option E is correct because using VPNs between subnets can provide encryption. Option A is wrong because security groups do not enforce encryption. Option D is wrong because VPC Flow Logs only monitor traffic, they do not enforce encryption.

Answer

Use security groups to allow only encrypted traffic.

Answer

Enable VPC Flow Logs to detect unencrypted traffic.

Question 12

A company is using AWS Direct Connect to connect its on-premises network to VPCs in multiple AWS accounts. The company wants to ensure that traffic from the on-premises network can only access specific VPCs based on the source IP address. Which AWS service should be used to enforce this segmentation?

Accepted Answer

AWS Transit Gateway. Option B is correct because AWS Transit Gateway can use route tables to segment traffic between Direct Connect and multiple VPCs based on source IP. Option A is wrong because VPC Peering does not support source IP filtering. Option C is wrong because AWS PrivateLink is for accessing services within a VPC, not for routing. Option D is wrong because Security Groups apply at the instance level, not to traffic from Direct Connect.

Answer

VPC Peering

Answer

AWS PrivateLink

Answer

Security Groups

Question 13

A company has a VPC with public and private subnets. An application in the private subnet needs to access an S3 bucket. Which design meets security best practices without exposing the application to the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route table. Option C is correct because a VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without internet exposure. Option A is wrong because NAT Gateway provides outbound internet access, which is not needed and adds complexity. Option B is wrong because internet gateway would expose the application. Option D is wrong because VPN is not needed.

Answer

Use a NAT Gateway in the public subnet and route traffic through it

Answer

Set up a VPN connection to AWS and route through it

Answer

Attach an Internet Gateway to the VPC and update route tables

Question 14

A security engineer needs to audit all changes to security group rules in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls, including changes to security group rules. Option A is wrong because AWS Config records configuration changes but not API calls. Option C is wrong because CloudWatch Logs is for log storage, not recording API calls. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which policy type should be used?

Accepted Answer

Service Control Policy (SCP). Option A is correct because an SCP can restrict permissions at the account level. Option B is wrong because IAM policies apply to users/roles, not resource configurations. Option C is wrong because AWS Config rules are detective, not preventive. Option D is wrong because NACLs are per-subnet, not account-wide.

Answer

Network ACL

Answer

IAM policy

Answer

AWS Config rule