ANS-C01 Network Security, Compliance and Governance Practice Test 20 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no VPC in any account can have an internet gateway attached. Which option meets this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.. A service control policy (SCP) applied at the root organizational unit (OU) level can deny the ec2:AttachInternetGateway action across all accounts in the organization. This centrally enforces the restriction. Option A is incorrect because IAM policies are applied per account and do not prevent the action if the user has permissions through other means. Option B is incorrect because security groups control traffic at the instance level, not internet gateway attachments. Option D is incorrect because network ACLs control traffic at the subnet level, not internet gateway attachments.

Answer

Create an IAM policy that denies ec2:AttachInternetGateway and attach it to each account's admin role.

Answer

Use security groups to block traffic from internet gateways.

Answer

Use network ACLs to block traffic from internet gateways.

Question 2

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to use a proxy server running on an EC2 instance in the public subnet. The security group for the proxy server must allow inbound HTTP/HTTPS from the instance in the private subnet. The security group for the private instance must allow outbound HTTP/HTTPS to the proxy server. However, the private instance cannot connect to the proxy. What is the most likely cause?

Accepted Answer

The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.. The route table for the private subnet likely has a default route pointing to a NAT gateway or internet gateway, causing traffic to bypass the proxy server. Even though security groups are configured correctly, routing decisions are made first. Traffic from the private instance to the proxy server would be directed to the default gateway (NAT/internet gateway) instead of the proxy's IP address. Option A is incorrect: the security group for the private instance does allow outbound HTTP/HTTPS to the proxy. Option B is incorrect: network ACLs are stateless and must allow both inbound and outbound; but if they blocked inbound from the proxy, that would affect return traffic, not the initial connection. Option D is incorrect: the proxy's security group is configured to allow inbound from the private instance.

Answer

The security group for the private instance does not allow outbound traffic to the proxy server.

Answer

The network ACL for the private subnet blocks inbound traffic from the proxy.

Answer

The security group for the proxy server does not allow inbound traffic from the private instance's security group.

Question 3

A company needs to audit all changes to security groups in a VPC. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security groups, and can be used for auditing. Option A is wrong because VPC Flow Logs capture network traffic, not API activity. Option B is wrong because AWS Config can track resource configuration changes but is not primarily for auditing API calls; it focuses on compliance and configuration history. Option C is wrong because Amazon CloudWatch is for monitoring metrics and logs, not API activity.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch

Question 4

A company has a VPC with multiple subnets. The network ACL for a subnet is configured to deny all inbound traffic. A security group attached to an EC2 instance in that subnet allows SSH from a specific IP range. Will SSH traffic from that IP range reach the instance?

Accepted Answer

No, because the network ACL denies all inbound traffic.. Network ACLs are stateless and deny all inbound traffic, so even though the security group allows SSH, the network ACL will block the traffic before it reaches the instance. Option A is wrong because security groups are stateful but are evaluated after network ACLs. Option C is wrong because the network ACL operates at the subnet level. Option D is wrong because the order does not matter for stateless ACLs.

Answer

Yes, because the security group allows SSH.

Answer

Yes, because the security group overrides the network ACL.

Answer

It depends on the rule number order in the network ACL.

Question 5

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The application is fronted by Amazon CloudFront and an Application Load Balancer. The security team wants to receive notifications when a DDoS attack is detected. Which AWS service should be used to receive these notifications?

Accepted Answer

Amazon CloudWatch. AWS Shield Advanced integrates with Amazon CloudWatch to emit DDoS detection metrics. You can create a CloudWatch alarm based on these metrics (e.g., DDoSDetected) to send notifications via SNS. Option A (AWS Config) is for resource configuration auditing, not DDoS notifications. Option C (VPC Flow Logs) captures network traffic metadata but does not provide Shield-specific alerts. Option D (Amazon GuardDuty) is a threat detection service, but it does not directly provide Shield Advanced event notifications.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 6

A company wants to allow a specific IP address range to access an EC2 instance in a private subnet using a bastion host. The bastion host is in a public subnet. Which security group configuration is correct?

Accepted Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the bastion security group.. The bastion host, located in the public subnet, should allow inbound SSH from the specified IP address range (e.g., corporate network) because users initiate the connection from that range to the bastion. The private instance should only allow inbound SSH from the bastion host's security group, not directly from the IP range, to ensure that all access is mediated through the bastion. Option A is incorrect because the bastion should not allow SSH from the private instance; it's the other way around. Option B is incorrect because the bastion should allow SSH from the IP range, not from the private instance. Option C is incorrect because the private instance should not allow SSH directly from the IP range, as it violates the principle of using a bastion.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the bastion security group.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the IP range.

Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the IP range.

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC contains a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to use a VPC endpoint for S3. Which TWO configurations are required?

Accepted Answer

Create an endpoint policy that allows access to the S3 bucket.. To access S3 from a private subnet using a VPC endpoint, two configurations are required. First, an endpoint policy must be created (Option B is correct) to control which S3 buckets and actions are allowed. Second, a route must be added in the private subnet's route table pointing to the gateway endpoint (Option D is correct) to direct S3 traffic through the endpoint. Option A is incorrect because assigning a public IP to the EC2 instance is not needed; the endpoint provides private connectivity. Option C is incorrect because a NAT gateway is not required when using a VPC endpoint. Option E is incorrect because gateway endpoints do not use security groups; they use endpoint policies for access control.

Answer

Assign a public IP address to the EC2 instance.

Answer

Deploy a NAT gateway in the public subnet.

Answer

Attach a security group to the gateway endpoint.

Question 8

A security engineer is designing a network security solution for a multi-tier application. The web tier must be accessible from the internet on ports 80 and 443. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier on port 3306. Which THREE network access control mechanisms should be used?

Accepted Answer

Security groups that allow traffic from specific security groups for the database tier.. Options A, D, and E are correct network access control mechanisms. Option A is correct because security groups can allow traffic based on source security group IDs, enabling tier-specific access. Option D is correct because network ACLs provide stateless filtering at the subnet level, adding a layer of defense. Option E is correct because security groups can reference other security groups as sources, allowing the database tier to accept traffic only from the application tier security group. Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/HTTPS traffic at the application layer, not suitable for database tier access control. Option C is incorrect because IAM policies manage user and resource permissions, not network-level traffic filtering.

Answer

AWS WAF to filter traffic to the database tier.

Answer

IAM policies to restrict access to the database.

Question 9

A company is designing a network architecture for a highly sensitive application that must meet strict compliance requirements. The application is deployed in a VPC with multiple subnets. The company needs to ensure that all traffic between subnets is encrypted and that no traffic can bypass the encryption. Which TWO steps should be taken?

Accepted Answer

Use network ACLs to block all traffic except encrypted protocols (e.g., IPSec).. Network ACLs can be configured to block all traffic except encrypted protocols like IPSec, thereby enforcing encryption at the subnet level. Option C is correct: A VPC CNI plugin that supports encryption can enforce encryption for pods in Kubernetes clusters, which is relevant for containerized workloads in the VPC. Option B is incorrect: VPN connections are established between VPCs or between a VPC and on-premises networks, not between subnets within the same VPC. It is not possible to set up VPN connections between subnet route tables. Option D is wrong: Security groups only filter traffic based on IP addresses and ports; they cannot inspect or enforce encryption of the traffic content. Option E is wrong: VPC Flow Logs only log metadata about traffic and cannot enforce or detect whether the traffic payload is encrypted. Therefore, the correct steps are A and C.

Answer

Set up VPN connections between each subnet's route tables.

Answer

Use security groups to allow only encrypted traffic.

Answer

Enable VPC Flow Logs to detect unencrypted traffic.

Question 10

A company is using AWS Direct Connect to connect its on-premises network to VPCs in multiple AWS accounts. The company wants to ensure that traffic from the on-premises network can only access specific VPCs based on the source IP address. Which AWS service should be used to enforce this segmentation?

Accepted Answer

AWS Transit Gateway. The correct answer because AWS Transit Gateway provides the connectivity hub between Direct Connect and multiple VPCs, and its route tables can be used to isolate traffic based on the Direct Connect virtual interface. However, Transit Gateway route tables are destination-based, not source-based. To enforce segmentation based on source IP address, you must combine Transit Gateway with a firewall service such as AWS Network Firewall or a third-party firewall appliance. The other options are incorrect: VPC Peering does not support source IP filtering and does not scale to many VPCs; AWS PrivateLink is for accessing services within a VPC; and Security Groups apply at the instance level, not to traffic from Direct Connect.

Answer

VPC Peering

Answer

AWS PrivateLink

Answer

Security Groups

Question 11

A company has a VPC with public and private subnets. An application in the private subnet needs to access an S3 bucket. Which design meets security best practices without exposing the application to the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route table. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without internet exposure. Option B (NAT Gateway) would provide internet access but is unnecessary and could expose the application indirectly. Option C (VPN) is overkill and not needed for S3 access within AWS. Option D (Internet Gateway) would expose the application to the internet, violating security best practices.

Answer

Use a NAT Gateway in the public subnet and route traffic through it

Answer

Set up a VPN connection to AWS and route through it

Answer

Attach an Internet Gateway to the VPC and update route tables

Question 12

A security engineer needs to audit all changes to security group rules in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security group rules. Option A (VPC Flow Logs) is wrong because it captures network traffic, not API calls. Option C (AWS Config) is wrong because it records configuration changes, but not the API call history. Option D (Amazon CloudWatch Logs) is wrong because it is used for log storage and monitoring, not for recording API calls.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which policy type should be used?

Accepted Answer

Service Control Policy (SCP). The Service Control Policy (SCP). SCPs are used in AWS Organizations to centrally control the maximum available permissions for all accounts in an organization. They can be used to prevent security groups from allowing inbound SSH from 0.0.0.0/0 by denying the ability to create or modify security group rules that permit such traffic. Network ACLs (Option A) operate at the subnet level and are not account-wide; they control traffic entering/exiting subnets, but cannot enforce organizational policies across multiple accounts. IAM policies (Option B) apply to users, groups, or roles, and cannot directly restrict security group configurations. AWS Config rules (Option D) are detective controls that can evaluate compliance but are not preventive; they do not block the creation of non-compliant security group rules. Therefore, SCP is the appropriate preventive policy type.

Answer

Network ACL

Answer

IAM policy

Answer

AWS Config rule

Question 14

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to connect to the internet for patching. The security team wants to minimize the attack surface. Which solution should be used?

Accepted Answer

Create a NAT Gateway in the public subnet and update route tables. A NAT Gateway in the public subnet allows the EC2 instance in the private subnet to initiate outbound connections to the internet for patching while preventing unsolicited inbound traffic, thus minimizing the attack surface. Option A is incorrect because a proxy server adds unnecessary complexity and overhead compared to a managed NAT Gateway, and it still requires careful configuration to minimize attack surface. Option B is incorrect because an Internet Gateway cannot be attached directly to a private subnet; it is attached to the VPC and requires a public subnet for route propagation. Option D is incorrect because a VPN connection is designed for hybrid connectivity to on-premises networks, not for general internet access from a VPC.

Answer

Set up a proxy server in the public subnet

Answer

Attach an Internet Gateway to the private subnet

Answer

Use a VPN connection to the on-premises network

Question 15

A company is deploying a web application behind an Application Load Balancer (ALB). The application must only accept traffic from the ALB. Which security group configuration should be used for the EC2 instances?

Accepted Answer

Allow inbound from the ALB security group on port 80. To ensure the EC2 instances only accept traffic from the ALB, the security group should reference the ALB's security group as the source. This is a best practice because the ALB acts as a proxy, and using its security group dynamically allows traffic from any ALB instance, even if the ALB's IP addresses change. Option A is insecure as it allows traffic from any source (0.0.0.0/0). Option C is not recommended because the ALB's private IP addresses can change (e.g., during scaling or replacement), making static IP rules difficult to maintain. Option D is too broad, as it would allow traffic from any resource within the VPC CIDR, not just the ALB.

Answer

Allow inbound from 0.0.0.0/0 on port 80

Answer

Allow inbound from the ALB's private IP addresses on port 80

Answer

Allow inbound from the VPC CIDR on port 80