ANS-C01 Network Security, Compliance and Governance Practice Test 2 — 15 Questions

Question 1

A security engineer runs tcpdump on an EC2 instance (10.0.1.5) and sees the output above. The instance is in a private subnet with a security group that allows inbound HTTPS from 0.0.0.0/0. The instance is behind a Network Load Balancer (NLB) that has a public IP. The engineer is unable to establish an HTTPS connection from the internet. What is the most likely cause?

Accepted Answer

The NLB's target group health checks are failing, causing the NLB to consider the instance unhealthy.. The tcpdump output shows the NLB's health check traffic (SYN packets from the NLB's private IPs) reaching the instance, but the engineer cannot establish an HTTPS connection from the internet. If the target group health checks are failing, the NLB marks the instance as unhealthy and stops forwarding traffic to it, which would prevent any internet HTTPS connections from reaching the instance. This is the most likely cause because the security group allows inbound HTTPS from 0.0.0.0/0, and the NLB does not preserve source IP by default, so the security group is not blocking traffic from the internet.

Answer

The NLB is not preserving the source IP, so the security group is blocking the traffic.

Answer

The instance's operating system firewall is blocking the connection.

Answer

The security group is blocking inbound traffic from the NLB.

Question 2

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from a specific AWS Client VPN endpoint. The security team has configured the ALB security group to allow inbound traffic from the Client VPN CIDR range, but users report that they can still access the application from outside the VPN. What is the MOST likely cause of this issue?

Accepted Answer

The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.. Option A is correct because the ALB security group is configured to allow inbound traffic from the Client VPN CIDR range, but if the ALB itself is internet-facing (i.e., it has public IP addresses and is deployed in public subnets), traffic can bypass the security group rules if the security group is not actually applied to the ALB's network interfaces. The most likely cause is that the ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet, meaning the security group rules are not being enforced on the ALB's listener. This allows users outside the VPN to access the application because the ALB accepts traffic from any source unless the security group explicitly restricts it.

Answer

The network ACL is stateless and requires separate inbound and outbound rules for return traffic.

Answer

The subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0.

Answer

The EC2 instances' security group allows inbound traffic from 0.0.0.0/0.

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?

Accepted Answer

Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.. Option A is correct because it uses separate Transit Gateway route tables to isolate the inspection VPC and other VPCs. By configuring the route table for VPC A to point to VPC B's CIDR via the inspection VPC attachment, all inter-VPC traffic is forced through the centralized firewall appliances. This leverages Transit Gateway's ability to route traffic between attachments based on route table associations and propagations, ensuring traffic flows through the inspection VPC without requiring VPC peering or additional per-VPC firewalls.

Answer

Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.

Answer

Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.

Question 4

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. The bucket policy should deny requests that do not originate from the VPC. Which condition key should be used in the bucket policy?

Accepted Answer

aws:SourceVpc. The correct condition key is `aws:SourceVpc`, which allows you to restrict access to an S3 bucket based on the VPC from which the request originates. When used in a bucket policy with a Deny effect, it ensures that only requests coming from the specified VPC ID are allowed, and all other requests are denied. This key is specifically designed for VPC-based access control in S3 bucket policies.

Answer

aws:VpcSourceIp

Answer

aws:Referer

Answer

aws:SourceIp

Question 5

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The security team needs to centrally manage and enforce network security policies across all accounts. Which TWO services or features can be used to centrally enforce network security controls? (Choose TWO.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed service that provides stateful, application-layer filtering and intrusion prevention for VPCs. It can be centrally deployed and managed across multiple accounts using AWS Firewall Manager, enabling consistent enforcement of network security policies at scale.

Answer

Network ACLs

Answer

VPC Flow Logs

Answer

VPC security groups with cross-account references

Question 6

A company attaches the above bucket policy to an S3 bucket. A user from the IP range 203.0.113.0/24 makes a request over HTTPS (TLS) to download an object from the bucket. Will the request succeed?

Accepted Answer

Yes, because the request uses HTTPS and comes from the allowed IP range.. Option D is correct because the bucket policy includes an Allow statement that grants s3:GetObject access to requests coming from the IP range 203.0.113.0/24 over HTTPS (using the aws:SecureTransport condition). The Deny statement only denies requests that do not use HTTPS (i.e., aws:SecureTransport equals false), so a request from the allowed IP range using TLS is not affected by the Deny and is permitted by the Allow statement.

Answer

Yes, but only if the request also includes a valid AWS signature.

Answer

No, because the Allow statement is overridden by the Deny statement.

Answer

No, because the Deny statement denies all requests regardless of the condition.

Question 7

A company has deployed a multi-tier application in a VPC with public and private subnets. The web tier runs on EC2 instances in public subnets, and the application tier runs on EC2 instances in private subnets. The application tier must only accept traffic from the web tier security group. The security group for the application tier has an inbound rule allowing HTTP traffic from the web tier security group. However, the application team reports that the web tier instances cannot connect to the application tier instances. The network administrator has verified that the web tier instances can resolve the private DNS names of the application tier instances, and the route tables are correctly configured. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The web tier security group's outbound rules do not allow traffic to the application tier security group.. Security groups are stateful, meaning that if you allow inbound traffic, the return traffic is automatically allowed regardless of outbound rules. However, the outbound rules of the initiating security group (the web tier) must permit the traffic to reach the destination. Since the web tier instances initiate the connection to the application tier, the web tier security group's outbound rules must allow HTTP traffic to the application tier security group. If those outbound rules are missing or too restrictive, the connection will fail even though the application tier's inbound rule is correct.

Answer

The application tier instances do not have a route to the web tier instances.

Answer

The application tier security group's inbound rule is stateful, but the outbound rule is not configured to allow return traffic.

Answer

The network ACL for the private subnet is blocking inbound traffic from the public subnet.

Question 8

A company has a VPC with public and private subnets. The security team wants to inspect all traffic between the private subnets and the internet using a centralized inspection VPC. The company uses AWS Network Firewall and wants to ensure that traffic cannot bypass the firewall. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Deploy the Network Firewall in a dedicated inspection VPC and use a VPC peering or transit gateway to route traffic from the workload VPC to the inspection VPC.. Option B is correct because deploying AWS Network Firewall in a dedicated inspection VPC and using a transit gateway (or VPC peering) allows centralized traffic inspection. This architecture ensures that all traffic between the workload VPC and the internet is routed through the inspection VPC, preventing bypass. The transit gateway enables transitive routing, while VPC peering can also be used with proper route table entries to force traffic through the firewall.

Answer

Configure an AWS WAF web ACL and associate it with the internet gateway.

Answer

Enable VPC Flow Logs on the private subnets to monitor traffic.

Answer

Create an internet gateway in the workload VPC and attach it to the private subnets.

Question 9

A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?

Accepted Answer

The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.. Option C is correct because the bucket policy includes a condition that requires the object to have the tag 'classification: public' (using s3:ExistingObjectTag). If the objects in the 'confidential/' prefix do not have this tag, the condition fails and access is denied, even though the prefix matches. The policy explicitly grants public read access only to objects that satisfy both the prefix and the tag condition.

Answer

The bucket policy does not grant access to objects owned by other AWS accounts.

Answer

The 's3:GetObjectVersion' action is not allowed because the bucket is not versioned.

Answer

The condition should use 'StringLike' instead of 'StringEquals' for tag matching.

Question 10

A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) across multiple Availability Zones. The application uses a MySQL database on an RDS instance in a private subnet. Security compliance requires that all traffic between the ALB and EC2 instances must be encrypted. The security team finds that the ALB currently sends traffic to the EC2 instances using HTTP on port 80. The EC2 security group allows inbound HTTP traffic from the ALB security group. The team needs to implement encryption with minimal changes and without disrupting the application. Which solution meets these requirements?

Accepted Answer

Modify the ALB listener to use HTTPS on port 443. Create a new target group with protocol HTTPS on port 443. Install a valid SSL/TLS certificate on each EC2 instance. Update the EC2 security group to allow inbound HTTPS from the ALB security group.. Option C is correct because it directly modifies the existing ALB to use an HTTPS listener on port 443, creates a new target group with HTTPS on port 443, and requires installing a valid SSL/TLS certificate on each EC2 instance. This ensures all traffic between the ALB and EC2 instances is encrypted with TLS, meeting the security requirement with minimal changes and no disruption to the application. The EC2 security group update to allow inbound HTTPS from the ALB security group completes the configuration.

Answer

Set up an AWS Client VPN endpoint and have the ALB send traffic through the VPN to the EC2 instances.

Answer

Deploy an internal ALB in front of the EC2 instances and configure it with an HTTPS listener. Route traffic from the public ALB to the internal ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB) and use TLS listeners to the EC2 instances.

Question 11

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Question 12

Order the steps to migrate a VPC from using an Internet Gateway to a NAT gateway for outbound-only internet access:

Question 13

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

Question 14

Match each AWS networking feature to its purpose for high availability or fault tolerance.

Question 15

Match each AWS networking service to the OSI layer it primarily operates at.

ANS-C01 Network Security, Compliance and Governance Practice Test 2 — 15 Questions

Exhibit

ANS-C01 Network Security, Compliance and Governance Practice Test 2 — 15 Questions

Exhibit