ANS-C01 Network Security, Compliance and Governance Practice Test 2 — 15 Questions

Question 1

Which TWO actions can be used to improve the security of an Amazon S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS). Options A and C are correct. Enabling S3 server-side encryption with AWS KMS (SSE-KMS) protects data at rest, and enabling S3 Block Public Access prevents public exposure of the bucket. Option B (MFA Delete) is incorrect because it protects against accidental deletion but does not improve confidentiality. Option D (S3 Versioning) is incorrect as it aids in data recovery, not security. Option E (S3 Cross-Region Replication) is incorrect because it enhances durability and availability, not security.

Answer

Enable MFA Delete on the bucket

Answer

Enable S3 Versioning

Answer

Enable S3 Cross-Region Replication

Question 2

A company wants to restrict access to an EC2 instance such that only traffic from a specific security group (sg-12345678) can reach it. The instance is in a VPC with default network ACLs. What should the security group rule for the instance be?

Accepted Answer

Inbound rule with source set to sg-12345678. Security groups allow you to reference another security group as a source. Option A is incorrect because referencing a CIDR block would allow traffic from any instance in that range, not specifically from the security group. Option C is incorrect because referencing a VPC CIDR allows traffic from any IP in that range, which is broader than the specific security group requirement. Option D is incorrect because security group rules cannot reference prefix lists as a source; they can only reference CIDR blocks, other security groups, or prefix lists for VPC endpoints.

Answer

Inbound rule with source set to the CIDR block of the VPC

Answer

Inbound rule with source set to the VPC's CIDR block

Answer

Inbound rule with source set to a prefix list that includes the security group

Question 3

A company has a VPC with a public subnet containing a NAT gateway and a private subnet with EC2 instances. The EC2 instances need to access an S3 bucket. The security team wants to log all S3 API calls made by the instances. Which approach should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and enable AWS CloudTrail to log S3 API calls. A VPC endpoint for S3 (Gateway type) allows EC2 instances in a private subnet to access S3 without going through the internet or a NAT gateway. AWS CloudTrail can be configured to log S3 API calls made via the endpoint, providing the required logging. Option A is incorrect because CloudWatch Logs on the instances capture application logs, not S3 API calls. Option B is incorrect because a proxy server adds unnecessary complexity and does not inherently log API calls. Option C is incorrect because VPC Flow Logs capture IP traffic metadata, not application-level API operations.

Answer

Enable Amazon CloudWatch Logs on the instances to capture application logs

Answer

Configure a proxy server in the public subnet and use it for S3 access

Answer

Enable VPC Flow Logs on the private subnet

Question 4

A company needs to audit all changes to security groups in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security groups. Option A is wrong because AWS Config records resource configuration changes but is not primarily for auditing API calls. Option C is wrong because Amazon CloudWatch Logs stores logs but does not capture API calls by default. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 5

A company has a VPC with an internet-facing Application Load Balancer (ALB) that routes traffic to EC2 instances in private subnets. The security team wants to block traffic from specific geographic regions. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF can be associated with an ALB to filter traffic based on geographic location. Option B is wrong because AWS Shield Advanced provides DDoS protection, not geographic filtering. Option C is wrong because Network ACLs do not support geographic blocking. Option D is wrong because Security Groups do not support geographic blocking.

Answer

AWS Shield Advanced

Answer

Network ACLs

Answer

Security Groups

Question 6

A company is designing a security group rule to allow outbound HTTPS traffic (TCP 443) to a specific external service IP range 203.0.113.0/24. The security group is attached to a fleet of EC2 instances. Which rule should be added?

Accepted Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/24. Security group outbound rules require a destination CIDR, and the specified IP range 203.0.113.0/24 matches the requirement. Option A is incorrect because it specifies a /32 destination, which would restrict traffic to a single IP rather than the full /24 range. Option B is incorrect because while security groups can use prefix lists as destinations, using a prefix list for a single external IP range is unnecessary and adds complexity; the direct CIDR is the proper approach. Option C is incorrect because for outbound rules, you must specify 'Destination', not 'Source'.

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/32

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: pl-12345 (prefix list for the IP range)

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Source: 203.0.113.0/24

Question 7

A company is using AWS Direct Connect to connect their on-premises network to AWS. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect virtual interface (VIF) configured. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures that traffic automatically uses the VPN if the Direct Connect connection fails?

Accepted Answer

Configure the VPN connection but attach it to a separate VGW, and use a transit gateway with failover routing.. By attaching the VPN to a separate VGW and using a transit gateway with failover routing (using route table priorities), the TGW can automatically route traffic to the Direct Connect VIF as primary and fail over to the VPN when the Direct Connect connection fails. This provides automatic failover without relying on static routes or BGP attribute manipulation. Option B is incorrect because adding a static route pointing to the VPN would always send traffic to the VPN, overriding any BGP propagated routes and preventing the use of Direct Connect when available. Option C is incorrect because not propagating routes means there are no dynamic routes; static routes would not provide automatic failover. Option D is incorrect because VPC route tables do not support metrics on static routes; a static route for Direct Connect would take precedence over propagated VPN routes and would not fail over to VPN when Direct Connect fails; additionally, static routes always have higher precedence than propagated routes, so the traffic would not automatically use VPN.

Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the VPN.

Answer

Configure the VPN connection but do not propagate routes; use static routes in the route table.

Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the Direct Connect VIF with a higher metric.

Question 8

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via a VPN. They want to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the network?

Accepted Answer

Configure Transit Gateway with appliance mode and route traffic through a dedicated inspection VPC.. Transit Gateway supports appliance mode that forces traffic to be routed through a dedicated inspection VPC where a centralized security appliance resides. Option A is wrong because VPC peering does not support transitive routing; each VPC would need individual peering connections, and traffic cannot be centrally inspected. Option C is wrong because security groups only provide stateful filtering at the instance level and do not inspect all traffic between VPCs; VPC Flow Logs are for logging, not inspection. Option D is wrong because placing the security appliance in each VPC creates a distributed model, not centralized; Network Firewall can be used with Transit Gateway for centralized inspection but the option implies per-VPC appliances, which is not the design requested.

Answer

Create VPC Peering connections between each VPC and the inspection VPC.

Answer

Use security groups in each VPC to restrict traffic and enable VPC Flow Logs for auditing.

Answer

Place the security appliance in each VPC and use Network Firewall to inspect traffic.

Question 9

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a security requirement that all traffic between VPCs must be inspected by a third-party firewall deployed in a central inspection VPC. The Transit Gateway has route tables configured with blackhole routes for inter-VPC traffic, and the inspection VPC has the firewall. However, traffic is not being inspected; it is being dropped. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route table for inter-VPC traffic has blackhole routes instead of pointing to the inspection VPC attachment.. Blackhole routes in the Transit Gateway route table for inter-VPC traffic cause packets to be dropped before they can be forwarded to the inspection VPC attachment. To enable traffic inspection, the route table must have a route pointing to the inspection VPC attachment instead of a blackhole. Option A is incorrect because route propagation from the inspection VPC determines whether the inspection VPC can reach other VPCs, but it does not cause inter-VPC traffic to be dropped; the blackhole is the direct cause. Option B is incorrect because the firewall not forwarding traffic back would affect return traffic after inspection, but traffic is dropped before ever reaching the firewall. Option C is incorrect because static routes for the inspection VPC are not the primary issue; the route table for inter-VPC traffic already has blackhole routes, which take precedence and drop traffic regardless of static routes.

Answer

The inspection VPC is not propagating its routes to the Transit Gateway.

Answer

The firewall appliance is not configured to forward traffic back to the Transit Gateway.

Answer

The Transit Gateway route tables do not have static routes for the inspection VPC.

Question 10

A company wants to enforce that all outbound traffic from its VPC flows through a centralized inspection VPC for security monitoring. The VPCs are connected via Transit Gateway. Which set of actions should a network engineer take to ensure that traffic from application VPCs is routed to the inspection VPC before reaching the internet?

Accepted Answer

Create a TGW route table with a blackhole route for 0.0.0.0/0 and associate it with application VPC attachments; attach the inspection VPC to a different TGW route table that has a route to the internet via an egress VPC.. It uses separate Transit Gateway route tables to enforce traffic isolation: the application VPC attachments use a route table with a blackhole for 0.0.0.0/0, preventing direct internet access, while the inspection VPC uses a different route table with a route to an egress VPC that has an internet gateway. This ensures all outbound traffic from application VPCs must first traverse the inspection VPC for security monitoring before reaching the internet.

Answer

Create VPC peering connections between each application VPC and the inspection VPC, and add routes pointing to the peering connection.

Answer

Attach an internet gateway to each application VPC and add a default route pointing to the inspection VPC's NAT gateway.

Answer

Attach an internet gateway to each application VPC and add default route pointing to it.

Question 11

A security engineer is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The company requires that all VPC flow logs be delivered to a central S3 bucket in the security account. The security engineer has created a bucket policy that grants the necessary permissions. However, flow logs from member accounts are failing to be delivered. What is the most likely cause?

Accepted Answer

The bucket policy does not include a condition that restricts access to the flow log delivery service using aws:SourceArn or aws:SourceAccount.. The VPC Flow Logs delivery service uses a service-linked role to write to the destination S3 bucket. Without a condition in the bucket policy that restricts access using `aws:SourceArn` or `aws:SourceAccount`, the policy is vulnerable to the confused deputy problem, where a different AWS service or account could potentially write to the bucket. The missing condition causes the delivery to fail because the service cannot verify that the request originated from the expected source.

Answer

The member accounts have not created an IAM role with permissions to write to the central bucket.

Answer

The bucket policy does not grant write access to the member accounts' root user.

Answer

The central S3 bucket has not been configured with ACLs enabled.

Question 12

A company is using AWS Direct Connect to connect its on-premises network to AWS. The company wants to encrypt all traffic between its on-premises network and AWS. Which solution meets this requirement?

Accepted Answer

Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.. AWS Direct Connect does not natively encrypt traffic; it provides a private, dedicated network connection. To meet the encryption requirement, you can establish an IPsec VPN tunnel over the private VIF, which encrypts all traffic between the on-premises network and the VPC. This approach combines the low latency and reliability of Direct Connect with the security of IPsec encryption.

Answer

Use a public virtual interface (VIF) and route traffic through a NAT gateway.

Answer

Use a private virtual interface (VIF) and enable encryption on the Direct Connect connection.

Answer

Use a private VIF and enable TLS on all applications.

Question 13

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to initiate outbound connections to the internet for software updates. The company wants to ensure that all outbound traffic goes through a single, highly available IP address for whitelisting purposes. Which solution should be used?

Accepted Answer

Launch a NAT instance in a public subnet and assign an Elastic IP. Configure the private subnet route table to point to the NAT instance.. A NAT instance in a public subnet with an Elastic IP provides a single, stable IP address for outbound traffic from the private subnet. By configuring the private subnet route table to point to the NAT instance, all outbound internet traffic goes through that instance. While not inherently highly available across Availability Zones, the solution meets the core requirement of a single IP for whitelisting and can be made more resilient using Auto Scaling and instance recovery.

Answer

Create an internet gateway and attach it to the private subnet, then configure the route table.

Answer

Create a VPC endpoint for Amazon S3 and route software update traffic through that endpoint.

Answer

Create a NAT gateway in each Availability Zone and assign the same Elastic IP to both.

Question 14

A company wants to audit all changes made to security groups and network ACLs in its AWS account. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those that modify security groups and network ACLs. By enabling CloudTrail, you can capture CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, CreateNetworkAclEntry, and similar API calls, providing an audit trail of who made the change, when, and from which IP address.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 15

A security engineer is designing a security group configuration for a web application that consists of an Application Load Balancer (ALB), Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS database. Which TWO actions should the engineer take to follow security best practices? (Choose TWO.)

Accepted Answer

Configure the EC2 instance security group to allow inbound traffic on port 443 from the ALB security group.. Referencing the ALB security group as the source in the EC2 security group rule ensures that only traffic originating from the ALB (and not any other source) is allowed on port 443. This follows the security best practice of using security group references instead of IP ranges, providing a tighter, more dynamic access control that automatically scales with the ALB's elastic network interfaces.

Answer

Configure the RDS security group to allow inbound traffic on port 3306 from 0.0.0.0/0.

Answer

Configure the ALB security group to allow inbound traffic on port 443 from the security group of the EC2 instances.

Answer

Configure the ALB security group to allow inbound traffic on port 80 from the security group of the EC2 instances.