ANS-C01 Network Security, Compliance and Governance Practice Test 20 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to connect to the internet for patching. The security team wants to minimize the attack surface. Which solution should be used?

Accepted Answer

Create a NAT Gateway in the public subnet and update route tables. Option B is correct because a NAT Gateway in the public subnet allows outbound internet traffic from private instances without allowing inbound traffic. Option A is wrong because an internet gateway directly attached to the private subnet would expose the instance. Option C is wrong because a proxy server adds complexity and is less secure than NAT Gateway. Option D is wrong because a VPN is not needed for internet access.

Answer

Set up a proxy server in the public subnet

Answer

Attach an Internet Gateway to the private subnet

Answer

Use a VPN connection to the on-premises network

Question 2

A network engineer needs to block traffic from a specific IP address to an EC2 instance. Which component should be modified?

Accepted Answer

Network ACL. Option D is correct because a Network ACL can deny inbound traffic from a specific IP address at the subnet level. Option A is wrong because security groups allow rules only, not deny. Option B is wrong because route tables do not filter traffic. Option C is wrong because VPC Flow Logs only capture traffic, not filter.

Answer

Route table

Answer

VPC Flow Logs

Answer

Security group

Question 3

A company is deploying a web application behind an Application Load Balancer (ALB). The application must only accept traffic from the ALB. Which security group configuration should be used for the EC2 instances?

Accepted Answer

Allow inbound from the ALB security group on port 80. Option C is correct because the security group for EC2 instances should allow inbound traffic from the ALB's security group. Option A is wrong because allowing 0.0.0.0/0 is insecure. Option B is wrong because VPC CIDR may include other sources. Option D is wrong because the ALB's private IPs are dynamic.

Answer

Allow inbound from 0.0.0.0/0 on port 80

Answer

Allow inbound from the ALB's private IP addresses on port 80

Answer

Allow inbound from the VPC CIDR on port 80

Question 4

A company wants to centrally manage and enforce VPC security group rules across multiple accounts in AWS Organizations. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. Option B is correct because AWS Firewall Manager allows central management of security group rules across accounts. Option A is wrong because AWS Config is for compliance, not enforcement. Option C is wrong because AWS CloudFormation StackSets can deploy resources but not enforce ongoing compliance. Option D is wrong because IAM Policies don't configure security groups.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

IAM Policies

Question 5

A company wants to encrypt data in transit between an on-premises data center and AWS. Which service provides a dedicated encrypted connection?

Accepted Answer

AWS Direct Connect with MACsec. Option D is correct because AWS Direct Connect with MACsec provides dedicated encrypted connection. Option A is wrong because AWS Site-to-Site VPN is over the internet, not dedicated. Option B is wrong because client VPN is for individual users. Option C is wrong because Transit Gateway is a hub, not a connection type.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 6

A security engineer is designing a VPC with public and private subnets. The company requires that instances in the private subnet can initiate outbound connections to the internet but cannot receive inbound connections from the internet. Which TWO components are necessary? (Choose 2)

Accepted Answer

NAT Gateway in the public subnet. Options A and D are correct. A NAT Gateway in the public subnet allows outbound internet access. A route in the private subnet's route table pointing to the NAT Gateway enables this. Option B is wrong because an Internet Gateway is attached to the VPC, not the private subnet. Option C is wrong because a VPC Gateway Endpoint is for AWS services, not internet. Option E is wrong because a security group can allow inbound but the requirement is to not allow inbound; a NAT Gateway already ensures no inbound.

Answer

VPC Gateway Endpoint for S3

Answer

Security group allowing inbound traffic from 0.0.0.0/0

Answer

Internet Gateway attached to the private subnet

Question 7

A company wants to inspect traffic between VPCs in the same region using a third-party security appliance. Which THREE components are needed? (Choose 3)

Accepted Answer

AWS Transit Gateway. Options A, C, and D are correct. A Transit Gateway is needed to interconnect VPCs. The security appliance must be in a dedicated VPC. Appliance VPC route tables must route traffic through the appliance. Option B is wrong because VPC Peering cannot do centralized inspection. Option E is wrong because NAT Gateway is for outbound internet, not inter-VPC inspection.

Answer

VPC Peering connections between all VPCs

Answer

NAT Gateways in each VPC

Question 8

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Accepted Answer

VPC Flow Logs. Options B and C are correct. VPC Flow Logs capture metadata about network traffic. Traffic Mirroring captures actual packet content. Option A is wrong because CloudTrail logs API calls, not network traffic. Option D is wrong because CloudWatch Logs is for log storage, not capture. Option E is wrong because AWS Config records configuration changes.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to centrally enforce that no Amazon S3 buckets are publicly accessible across all accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Apply a service control policy (SCP) in AWS Organizations that denies the s3:PutBucketPublicAccessBlock action or enforces a bucket policy condition.. Option C is correct because an SCP can be applied at the root OU to deny the s3:PutBucketPublicAccessBlock action or enforce a specific bucket policy. Option A is wrong because IAM roles are per-account and cannot centrally enforce across accounts. Option B is wrong because Trusted Advisor provides recommendations, not enforcement. Option D is wrong because security groups are for EC2, not S3.

Answer

Use AWS Trusted Advisor to check for public buckets and send alerts.

Answer

Create an IAM role in each account with a policy to deny public bucket access, and require users to assume that role.

Answer

Configure security group rules to block public internet access to the S3 endpoints.

Question 10

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT Gateway. The security team wants to ensure that traffic from the private subnets to the internet is logged and inspected for malicious activity. Which solution meets these requirements?

Accepted Answer

Configure VPC Traffic Mirroring from the private subnet instances to a network security appliance (e.g., partner firewall) for deep packet inspection.. Option B is correct because VPC Traffic Mirroring can mirror traffic from the private subnet ENIs to a security appliance for inspection. Option A is wrong because VPC Flow Logs only capture metadata, not packet contents. Option C is wrong because AWS WAF is for web application layer, not network layer inspection. Option D is wrong because AWS Shield is for DDoS protection, not inspection.

Answer

Use AWS Shield Advanced to inspect traffic and detect malicious activity.

Answer

Deploy AWS WAF on the NAT Gateway to inspect and filter outgoing traffic.

Answer

Enable VPC Flow Logs on the NAT Gateway and analyze the logs with Amazon Detective.

Question 11

A company wants to allow its employees to securely access internal web applications hosted in a VPC without using a VPN. The solution must authenticate users against the company's Active Directory and apply fine-grained access controls. Which AWS service should be used?

Accepted Answer

AWS Verified Access. Option C is correct because AWS Verified Access provides secure access to corporate applications without a VPN, integrating with identity providers like Active Directory. Option A is wrong because AWS Client VPN requires VPN client software. Option B is wrong because AWS SSO is for federating access to AWS accounts, not applications. Option D is wrong because ALB with OIDC is possible but requires public exposure or VPN; Verified Access is purpose-built.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Client VPN

Answer

Application Load Balancer with OIDC authentication

Question 12

A company is designing a multi-account architecture. They need to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the security account. The logs must be encrypted at rest using a customer-managed KMS key in the security account. Which combination of steps is required?

Accepted Answer

Configure the KMS key policy to allow the log-producing accounts to use the key, and the S3 bucket policy to allow those accounts to write.. Option D is correct because cross-account KMS access requires a KMS key policy that grants the log-producing accounts permission to use the key, and the S3 bucket policy must allow cross-account writes. Option A is wrong because using a single KMS key with cross-account access requires key policy. Option B is wrong because a CMK in each account would not be centralized. Option C is wrong because S3 bucket policy alone does not handle encryption permissions.

Answer

Configure the S3 bucket policy to allow the log accounts to write; encryption is automatic with SSE-S3.

Answer

Create a KMS key in each account and configure the S3 bucket to use each key.

Answer

Create a KMS key in the security account with no key policy changes; use bucket policies to allow cross-account writes.

Question 13

A company uses AWS Certificate Manager (ACM) to issue certificates for a fleet of Application Load Balancers. The security team requires that only specific IAM roles can request, renew, or delete ACM certificates. Which policy type should be used to enforce this?

Accepted Answer

IAM identity-based policies attached to the IAM roles. Option B is correct because ACM does not support resource-based policies; IAM policies are used to control access. Option A is wrong because ACM does not support resource-based policies. Option C is wrong because service control policies apply to all accounts in an organization, not to specific roles. Option D is wrong because AWS Managed Policies are predefined but can be customized; the question asks for the policy type, not a specific policy.

Answer

AWS managed policies such as AWSCertificateManagerFullAccess

Answer

Service control policies (SCPs) in AWS Organizations

Answer

Resource-based policies attached to the ACM certificates

Question 14

A company is using AWS CloudHSM to store sensitive encryption keys. Which of the following is a security best practice for managing the HSM?

Accepted Answer

Store the CloudHSM security officer (CO) password in AWS Secrets Manager.. Option A is correct because CloudHSM requires client-side authentication using certificates; best practice is to store the security officer password in a secure password manager. Option B is wrong because CloudHSM does not use KMS keys. Option C is wrong because CloudHSM is a dedicated hardware appliance; the cluster is managed by the customer. Option D is wrong because AWS does not have root access to CloudHSM clusters.

Answer

Disable two-factor authentication for the HSM to simplify management.

Answer

Use AWS KMS to automatically rotate the CloudHSM partition password.

Answer

Allow AWS to manage the CloudHSM cluster by granting AWS support access.

Question 15

A company has a VPC with multiple security groups. An EC2 instance in security group A needs to communicate with an RDS instance in security group B on port 3306. The security team wants to minimize exposure. What should the inbound rule in security group B be?

Accepted Answer

Allow inbound TCP 3306 from security group A. Option C is correct because referencing security group A as source allows traffic from any instance associated with security group A, which is the most specific and secure. Option A is wrong because it allows traffic from any instance in the VPC (0.0.0.0/0). Option B is wrong because it allows traffic from the entire subnet. Option D is wrong because it allows traffic from the instance's IP, but if the instance is replaced, the IP may change.

Answer

Allow inbound TCP 3306 from the CIDR block of the subnet where the EC2 instance resides

Answer

Allow inbound TCP 3306 from 0.0.0.0/0

Answer

Allow inbound TCP 3306 from the private IP address of the EC2 instance