ANS-C01 Network Security, Compliance and Governance Practice Test 2 — 15 Questions

Question 1

A company wants to block incoming traffic from specific IP addresses at the edge of the AWS network before it reaches the application load balancer. Which AWS service should be used?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF is a web application firewall that operates at the edge of the AWS network, inspecting HTTP/HTTPS requests before they reach the ALB. By associating a web ACL with the ALB, you can create rules to block traffic from specific IP addresses using IP match conditions. This meets the requirement of blocking at the edge, as WAF filtering occurs before the traffic reaches the load balancer.

Answer

Network ACLs on the VPC subnet containing the ALB

Answer

Security Groups attached to the ALB

Answer

Amazon CloudFront with origin access identity

Question 2

An organization has a requirement that all cross-account access to Amazon S3 buckets must be logged and monitored. The security team has enabled AWS CloudTrail and S3 server access logs. However, they notice that some cross-account access attempts are not being logged. Which additional step should be taken to ensure all cross-account access is logged?

Accepted Answer

Enable CloudTrail data events for S3 buckets to capture object-level API operations.. Enabling CloudTrail data events for S3 buckets captures object-level API operations such as GetObject, PutObject, and DeleteObject, which are not logged by default management events. Cross-account access attempts that involve object-level actions will only be logged if data events are enabled, ensuring comprehensive auditing.

Answer

Create a CloudWatch Logs subscription filter to capture all S3 access logs.

Answer

Enable default encryption on all S3 buckets.

Answer

Enable S3 Object Lock on all buckets to prevent deletion of logs.

Question 3

A company wants to centrally manage and enforce security policies across multiple AWS accounts and VPCs. They need to ensure that all VPCs have a specific set of rules, such as disabling public subnets. Which AWS service should be used?

Accepted Answer

AWS Organizations with Service Control Policies (SCPs). AWS Organizations with Service Control Policies (SCPs) can centrally control permissions across accounts, allowing enforcement of rules like disabling public subnets. Option B is wrong because IAM is for users and roles, not for VPC-level controls. Option C is wrong because AWS Shield is for DDoS protection. Option D is wrong because AWS Config evaluates resource configurations but does not enforce policies.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Shield

Answer

AWS Config

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. They have an AWS Site-to-Site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN is configured with dynamic routing (BGP). The on-premises network advertises a route to 192.168.0.0/16 via BGP. The VPC route table has a static route to 192.168.0.0/16 pointing to a virtual private gateway. The company also has a Direct Connect connection to the same on-premises network advertising the same CIDR. The VPC route table has a propagated route to 192.168.0.0/16 pointing to a Direct Connect virtual interface, learned via BGP. Which route will be used for traffic destined to 192.168.0.0/16?

Accepted Answer

Traffic will use the VPN connection because the static route to the virtual private gateway takes precedence over the propagated route from Direct Connect.. AWS route selection prioritizes static routes over propagated (BGP-learned) routes when the prefix length is identical. The static route to 192.168.0.0/16 pointing to the virtual private gateway is more specific in origin than the propagated Direct Connect route, so it wins. This is consistent with AWS VPC route table evaluation where static routes take precedence over dynamic/propagated routes for the same destination CIDR.

Answer

Traffic will use the VPN connection because the static route to the virtual private gateway has a lower prefix.

Answer

Traffic will use the Direct Connect connection because it is a more reliable connection.

Answer

Traffic will be load-balanced between VPN and Direct Connect.

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all traffic between subnet A and subnet B. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure the Network Firewall rule group to allow the desired traffic between subnets.. Option B is correct because AWS Network Firewall inspects traffic only when the firewall policy's stateless and stateful rule groups permit it; configuring the rule group to allow the desired traffic between subnet A and subnet B ensures the firewall passes the inspected flows rather than dropping them. Option C is correct because Network Firewall is a transparent middlebox: to force east-west traffic between the two subnets through the firewall endpoint, you must add routes in the subnets' route tables pointing the destination CIDR (e.g., 10.0.2.0/24 from subnet A, and 10.0.1.0/24 from subnet B) to the firewall endpoint's elastic network interface. Option A is not required because a transit gateway is used to interconnect VPCs, VPNs, or Direct Connect, not to route traffic between subnets inside a single VPC. Option D is not required because VPC peering connects separate VPCs, and both subnets already reside in the same VPC with native routing. Option E is not required because security groups are stateful instance-level firewalls and do not redirect or inspect traffic through Network Firewall.

Answer

Attach a transit gateway to the VPC and route traffic through it.

Answer

Create a VPC peering connection between subnet A and subnet B.

Answer

Create a security group rule that allows traffic between subnet A and subnet B.

Question 6

A company needs to log all network traffic between EC2 instances in a VPC for security analysis. They want to capture metadata about traffic, including source and destination IP, ports, protocol, and packet counts. Which THREE AWS services or features can be used to achieve this? (Choose three.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) is correct because it captures IP traffic metadata for ENIs in a VPC—source/destination IP, ports, protocol, packets, and bytes—and can be published to CloudWatch Logs or S3 for security analysis. Traffic Mirroring (C) is correct because it copies actual packet data from EC2 ENIs to a target (another ENI or Network Load Balancer), enabling deep inspection of traffic between instances, including metadata and payload. AWS Network Firewall flow logs (D) is correct because when Network Firewall is deployed in the VPC, its flow logs record connection metadata such as source/destination IP, ports, protocol, and packet/byte counts for traffic passing through the firewall. AWS CloudTrail (A) is not correct because it logs AWS API activity and management events, not network traffic metadata between EC2 instances. Security Group rules logging (E) is not correct because security groups are stateful filters and do not provide a logging feature for traffic metadata; there is no such service capability.

Answer

AWS CloudTrail

Answer

Security Group rules logging

Question 7

A security team has attached the above IAM policy to a user. The user tries to add an inbound rule to a security group that allows traffic from 0.0.0.0/0. The request is denied. However, the user is able to add a rule allowing traffic from 203.0.113.10. Which statement explains this behavior?

Accepted Answer

The Deny statement only denies the action when the CIDR is 0.0.0.0/0, which overrides the Allow for that specific case. For other CIDRs, the Allow applies because the user's source IP is within the allowed range.. The Deny statement denies the ec2:AuthorizeSecurityGroupIngress action only when the condition is satisfied—specifically, when the CIDR being added is 0.0.0.0/0. The Allow statement permits the action when the user's source IP falls within 203.0.113.0/24. Since the user's IP is 203.0.113.10, the Allow applies. However, the Deny overrides the Allow for the specific case of 0.0.0.0/0. For other CIDRs, such as 203.0.113.10, the Deny condition is not met, so the Allow takes effect. Option A is incorrect because the condition key is valid; Option B is incorrect because the Deny does not block all ingress actions; Option C is incorrect because the Allow is not unconditional—it depends on the user's source IP.

Answer

The Deny statement incorrectly uses the condition ec2:AuthorizeSecurityGroupIngress, which is not a valid condition key, so the Deny is ignored.

Answer

The Deny statement denies all ec2:AuthorizeSecurityGroupIngress actions, so the user cannot add any inbound rules.

Answer

The Allow statement allows all ec2:AuthorizeSecurityGroupIngress actions from IPs in 203.0.113.0/24, so the user can add any rule.

Question 8

A network engineer has created a gateway VPC endpoint for S3 as shown in the exhibit. The endpoint is associated with route table rtb-12345678. An EC2 instance in a subnet that uses route table rtb-12345678 tries to download an object from my-bucket. The request fails with an access denied error. Which change should the engineer make to resolve the issue?

Accepted Answer

Add a route in route table rtb-12345678 that sends traffic to the S3 service via the VPC endpoint.. The gateway VPC endpoint for S3 requires a route in the associated route table that directs traffic destined for S3 (using the AWS-managed prefix list for S3 in the region) to the endpoint. Without this route, traffic from the EC2 instance to S3 does not use the endpoint and instead goes through the internet or NAT gateway, which can result in an access denied error if the bucket policy or endpoint policy restricts access to the endpoint. Adding the route ensures that S3 traffic from the subnet uses the gateway endpoint, satisfying the conditions for access.

Answer

Associate the endpoint with a different route table.

Answer

Add a bucket policy to my-bucket that allows access from the VPC endpoint.

Answer

Modify the endpoint policy to allow all S3 actions.

Question 9

A company uses AWS Organizations with SCPs to restrict access. The security team needs to prevent users in the 'Developers' OU from disabling AWS Config or modifying its rules. Which SCP effect should be used?

Accepted Answer

Deny. SCPs in AWS Organizations use a deny-list model where any action not explicitly allowed is implicitly denied, but to prevent specific actions like disabling AWS Config or modifying its rules, you must use an explicit Deny statement. An SCP with Effect: Deny on the config:StopConfigurationRecorder, config:DeleteConfigurationRecorder, and config:PutConfigurationRecorder actions ensures these actions are blocked regardless of IAM permissions. The Deny effect overrides any Allow in identity-based policies, making it the correct mechanism for guardrails.

Answer

Block

Answer

Allow

Answer

NotAction

Question 10

A company wants to restrict access to its S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The condition key s3:x-amz-server-side-encryption-aws-kms-key-id is used in a bucket policy to require that objects are uploaded with SSE-KMS using a specific KMS key ID. This ensures that only uploads with the specified KMS key are allowed, directly enforcing the use of SSE-KMS. The key is part of the request headers and can be evaluated in the policy.

Answer

s3:x-amz-server-side-encryption

Answer

kms:ViaService

Answer

kms:EncryptionContext

Question 11

A company has a hybrid network with an AWS Direct Connect connection to a VPC. They also have a site-to-site VPN connection as a backup. The VPC routing tables are configured with a route to the on-premises CIDR via the virtual private gateway. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect connection even when it is healthy. What is the most likely cause?

Accepted Answer

The VPC route table has a more specific route pointing to the VPN connection. The VPC route table has a more specific route pointing to the VPN connection. AWS route selection is longest-prefix match first, so if a route to a narrower on-premises CIDR (e.g., /24) points at the VPN's virtual private gateway while the Direct Connect path covers a broader CIDR (e.g., /16), traffic to that more specific prefix will always prefer the VPN regardless of Direct Connect health. Options B and D describe failure conditions that would explain traffic not using Direct Connect, but the scenario states the Direct Connect connection is healthy, and a down VPN would not cause traffic to avoid a healthy Direct Connect path. Option C is irrelevant because a VPN connection is always attached to a customer gateway by design and that attachment does not influence route preference.

Answer

The VPN connection is down

Answer

The VPN connection is attached to a Customer Gateway

Answer

The Direct Connect virtual interface is in the 'Down' state

Question 12

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

Accepted Answer

Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket. The Lambda function's execution role must have an IAM policy granting s3:GetObject on the target bucket. The bucket policy denies all principals except those explicitly allowed, so the execution role must be explicitly allowed both by the identity-based policy and, if the bucket policy requires it, by the bucket policy itself. Adding the IAM policy to the execution role is the correct fix.

Answer

Remove the bucket policy that denies all principals

Answer

Attach an internet gateway to the VPC and a public IP to the Lambda function

Answer

Create a VPC endpoint for S3 and attach it to the Lambda function's VPC

Question 13

A company has an AWS Direct Connect connection and wants to ensure that all traffic from its VPC to an S3 bucket in another region stays within the AWS network. How should this be accomplished?

Accepted Answer

Use a NAT gateway in the VPC and route traffic through the Direct Connect public VIF. To keep traffic from a VPC to an S3 bucket in another region within the AWS network, the correct approach is to route through a NAT gateway and then over the Direct Connect public VIF, which carries traffic to AWS public services (including S3) without traversing the public internet. This preserves the private AWS backbone path across regions. Gateway and interface endpoints for S3 are regional constructs that do not span regions in this scenario.

Answer

Create a VPC Gateway Endpoint for S3 in the source VPC

Answer

Create a VPC Interface Endpoint for S3 in the source VPC

Answer

Establish a VPN connection to the S3 bucket

Question 14

A company wants to monitor and log all changes to security group rules in their AWS account for compliance purposes. Which TWO services can be used together to achieve this?

Accepted Answer

Amazon EventBridge. Amazon EventBridge (C) is correct because it can receive and route events from AWS services, including security group change events, so they can be delivered to targets such as Lambda, SNS, or SQS for monitoring and alerting. AWS CloudTrail (E) is correct because it records API activity in the account, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, CreateSecurityGroup, and DeleteSecurityGroup calls, providing the audit trail of who changed security group rules and when. Together, CloudTrail captures the change events and EventBridge can react to them in near real time for compliance monitoring and logging workflows. AWS Trusted Advisor (A) is not correct because it provides best-practice checks and recommendations, not a change-event log for security group rules. VPC Flow Logs (B) is not correct because it captures IP traffic metadata for network interfaces, subnets, or VPCs, not security group rule configuration changes. AWS Config (D) is not marked correct here because, while it can record resource configuration changes and evaluate compliance, the question asks for two services used together to monitor and log changes, and the intended pair is CloudTrail plus EventBridge.

Answer

AWS Trusted Advisor

Answer

VPC Flow Logs

Answer

AWS Config

Question 15

A company is designing a network security solution for a VPC that hosts a multi-tier web application. The web servers are in a public subnet, and the application servers are in a private subnet. The company wants to ensure that the web servers can only be accessed on port 443 from the internet, and the application servers can only be accessed from the web servers on port 3306. Which THREE components should be configured?

Accepted Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports. Option B is correct because a network ACL on the public subnet must allow inbound TCP 443 from 0.0.0.0/0 and also allow outbound traffic to the ephemeral port range (1024-65535) so the web servers' responses can return to internet clients, since NACLs are stateless. Option D is correct because a security group on the application servers permitting inbound TCP 3306 sourced from the web server security group enforces that only the web tier can reach the database port, using security group referencing rather than CIDR ranges. Option E is correct because a security group on the web servers allowing inbound TCP 443 from 0.0.0.0/0 restricts internet access to HTTPS only, and security groups are stateful so return traffic is automatically allowed. Option A is not correct because it omits the required outbound ephemeral port rule, making the stateless NACL incomplete for return traffic. Option C is not correct because referencing the public subnet CIDR is broader and less precise than using security group references, and the application servers' inbound control is properly handled by the security group in option D.

Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0

Answer

Network ACL on the private subnet allowing inbound 3306 from the public subnet CIDR