ANS-C01 Network Security, Compliance and Governance Practice Test 21 — 15 Questions

Question 1

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Accepted Answer

Check connection status, then verify virtual interface configuration, then check on-premises BGP, then test connectivity, then escalate if unresolved.. Start with the connection status, then verify virtual interface configuration, check on-premises BGP, test connectivity, and escalate if unresolved.

Answer

Check connection status, then check on-premises BGP, then verify virtual interface configuration, then test connectivity, then escalate if unresolved.

Answer

Check connection status, then test connectivity, then verify virtual interface configuration, then check on-premises BGP, then escalate if unresolved.

Answer

Verify virtual interface configuration, then check connection status, then check on-premises BGP, then test connectivity, then escalate if unresolved.

Question 2

Order the steps to migrate a VPC from using an Internet Gateway to a NAT gateway for outbound-only internet access:

Accepted Answer

1. Create NAT gateway in a public subnet. 2. Update route tables to point default route to NAT gateway. 3. Remove the Internet Gateway route from route tables. 4. Adjust security group rules for outbound traffic. 5. Test outbound connectivity.. First create the NAT gateway, then update routes to use it, remove the IGW route, adjust security, and test.

Answer

1. Update route tables to point default route to NAT gateway. 2. Remove the Internet Gateway route. 3. Create NAT gateway in a public subnet. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Remove the Internet Gateway route. 2. Create NAT gateway in a public subnet. 3. Update route tables to point default route to NAT gateway. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Adjust security group rules. 2. Create NAT gateway. 3. Update routes. 4. Remove IGW route. 5. Test outbound connectivity.

Question 3

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

Accepted Answer

Verify peering status, then check route tables, then check security groups and NACLs, then test connectivity, then use VPC Flow Logs. First verify peering status, then check routes, then security groups/ACLs, then test, then use flow logs.

Answer

Test connectivity, then check security groups and NACLs, then check route tables, then use VPC Flow Logs, then verify peering status

Answer

Check security groups and NACLs, then check route tables, then verify peering status, then test connectivity, then use VPC Flow Logs

Answer

Use VPC Flow Logs, then verify peering status, then check route tables, then check security groups and NACLs, then test connectivity

Question 4

Match each AWS networking feature to its purpose for high availability or fault tolerance.

Accepted Answer

Elastic Load Balancer: Distributes incoming traffic across multiple targets to increase fault tolerance.. Correct matches: Elastic Load Balancer distributes traffic, Route 53 provides DNS health checks, and Global Accelerator uses anycast routing. Common confusions: ELB does not handle DNS; Route 53 does not direct traffic over the global network; Global Accelerator does not log traffic.

Answer

Elastic Load Balancer: Routes traffic based on DNS health checks.

Answer

Amazon Route 53: Improves application availability by directing traffic over the AWS global network.

Answer

AWS Global Accelerator: Captures network traffic logs for analysis.

Question 5

Match each AWS Direct Connect virtual interface type to its use case.

Accepted Answer

Private VIF: Used to access VPCs using private IP addresses. Correct matches: Private VIF accesses VPCs via private IPs, Public VIF accesses AWS public services, Transit VIF connects multiple VPCs via Transit Gateway. Common confusions involve swapping public/private access or confusing Transit VIF with Private VIF.

Answer

Private VIF: Used to access AWS public services using public IPs

Answer

Public VIF: Used to access VPCs using private IP addresses

Answer

Transit VIF: Used to connect directly to a single VPC

Question 6

A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The network team wants to ensure that only encrypted traffic is sent over the internet between the two sites. The VPC has a virtual private gateway attached. When testing, they discover that some traffic is going over the internet without encryption. Which configuration change should be made to enforce encryption?

Accepted Answer

Add a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway.. Adding a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway ensures that all traffic destined for the on-premises network is routed through the VPN tunnel, enforcing encryption. Without this static route, traffic might be sent via an internet gateway if a more specific route exists or if route propagation is not properly configured. Option B is incorrect because disabling route propagation would remove dynamic routes from the VPN, but traffic could still go over the internet if there is a route to an internet gateway. Option C is incorrect because IPsec acceleration is about improving performance, not ensuring all traffic uses encryption; the tunnel already uses IPsec. Option D is incorrect because replacing the virtual private gateway with a transit gateway is not necessary; the issue is routing, not the gateway type.

Answer

Disable route propagation on the VPC route table to remove any dynamic routes from the VPN.

Answer

Enable IPsec acceleration on the VPN tunnel to ensure all traffic is encrypted.

Answer

Replace the virtual private gateway with a transit gateway and attach the VPN connection.

Question 7

A company has a VPC with multiple subnets. They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all outbound traffic from the VPC to the internet. Currently, the VPC route table has a default route (0.0.0.0/0) pointing to an internet gateway. What routing change is required to route outbound traffic through the firewall?

Accepted Answer

Add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the Network Firewall endpoint's elastic network interface.. To route traffic through AWS Network Firewall, you must add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the firewall endpoint's elastic network interface (ENI). This forces outbound traffic to be inspected by the firewall before reaching the internet gateway. Option A is incorrect because a VPC Gateway Endpoint is used for private access to AWS services, not for routing traffic through a firewall. Option B is incorrect because a NAT gateway provides outbound connectivity but does not inspect traffic; adding another hop to the firewall would be redundant and not supported. Option D is incorrect because a transit gateway is used to connect multiple VPCs or on-premises networks, not to route traffic through a single firewall.

Answer

Create a VPC Gateway Endpoint for the firewall service.

Answer

Add a NAT gateway in a public subnet and route 0.0.0.0/0 to the NAT gateway, then point the NAT gateway to the firewall.

Answer

Add a transit gateway and attach the VPC and the internet gateway to it, then route traffic through the firewall.

Question 8

A company has an Amazon RDS for MySQL database in a private subnet. The database should only be accessible from a specific fleet of EC2 instances in the same VPC. Which combination of security controls should be used to meet this requirement?

Accepted Answer

Use a security group for the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances.. A security group on the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances restricts access to only those instances that are members of that security group. Option A is incorrect because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules; they cannot reference security groups. Option B is incorrect because a VPN connection is used for connectivity to external networks, not for communication within the same VPC. Option D is incorrect because IAM database authentication controls user authentication to the database, not network-level access from EC2 instances.

Answer

Use a network ACL on the private subnet that allows MySQL traffic from the EC2 instances' IP addresses.

Answer

Set up a VPN connection between the EC2 instances and the RDS instance.

Answer

Enable IAM database authentication for the RDS instance and require EC2 instances to use IAM credentials.

Question 9

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must not. Which TWO design choices meet these requirements? (Choose two.)

Accepted Answer

Use a security group on the web tier to allow HTTP/HTTPS from 0.0.0.0/0, and security groups on the app and database tiers that only allow traffic from the web tier security group.. The correct answers are C and E. Option C uses security groups to control traffic between tiers: the web tier security group allows HTTP/HTTPS from 0.0.0.0/0, and the app and database tier security groups only allow traffic from the web tier security group. This ensures that the application and database tiers are not directly accessible from the internet. Option E places the web tier in a public subnet with an internet gateway in its route table, so it can receive inbound traffic from the internet. The app and database tiers are placed in private subnets without a direct route to the internet gateway, so they cannot be accessed from the internet. Option A is incorrect because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for internet access. Option B is incorrect because a NAT gateway provides outbound internet access for private subnets, not inbound internet access to the web tier. Option D is incorrect because placing all tiers in a public subnet exposes the application and database tiers to the internet, even with restrictive security groups, because they would still have a route to the internet gateway.

Answer

Use a VPC Gateway Endpoint for the web tier to access the internet.

Answer

Use a NAT gateway in a public subnet to provide internet access to the app and database tiers for updates.

Answer

Place all tiers in a public subnet with a security group that restricts access to the app and database tiers.

Question 10

A CloudFormation stack was created with the above snippet. An administrator notices that the EC2 instance can receive HTTP traffic from the internet, but cannot access the internet itself (e.g., to download updates). What is the most likely cause?

Accepted Answer

The instance is in a private subnet without a NAT gateway or route to an internet gateway.. The instance can receive inbound HTTP traffic because the security group ingress rule allows HTTP. However, it cannot initiate outbound traffic to the internet. The security group egress rule allows all traffic, so outbound is not restricted. The most likely cause is that the instance is in a private subnet without a NAT gateway or route to an internet gateway. Private subnets cannot directly access the internet without a NAT device. Therefore, Option B is correct. Option A is incorrect because the egress rule is permissive. Option C is incorrect because the security group is properly attached (inbound works). Option D is incorrect because the ingress rule is not the issue.

Answer

The security group egress rule restricts outbound traffic to only HTTP.

Answer

The security group is not attached to the instance properly.

Answer

The security group ingress rule only allows HTTP from the internet, but not other protocols needed for updates.

Question 11

A company is designing a hub-and-spoke network in AWS. The security team requires that all traffic between VPCs in different spokes must be inspected by a third-party firewall deployed in the hub VPC. Which architecture meets this requirement with minimal complexity?

Accepted Answer

Use a Transit Gateway with separate route tables for each spoke VPC, and configure the spoke route tables to route all inter-spoke traffic through the hub VPC firewall.. A Transit Gateway acts as a regional hub that supports transitive routing between attached VPCs, and by using separate route tables per spoke attachment, the architect can force all inter-spoke traffic through the hub VPC where the third-party firewall resides. This is the canonical AWS hub-and-spoke inspection pattern because TGW route tables provide the segmentation needed to redirect traffic to a security VPC appliance without full mesh complexity. It scales cleanly as spokes are added, unlike peering meshes.

Answer

Create VPC peering connections between each spoke VPC and configure security groups to enforce inspection.

Answer

Use AWS PrivateLink to connect all spoke VPCs to a central service in the hub.

Answer

Set up AWS Direct Connect between all VPCs and route through a central firewall.

Question 12

A company uses AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection attempts. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. AWS WAF provides a specialized SQL injection match condition that inspects request components (URI, query string, body, headers, cookies) for patterns indicative of SQL injection attacks. This condition uses AWS's managed rule patterns to detect common SQLi payloads like ' OR '1'='1, UNION SELECT, and comment-based evasion techniques. It is the only rule type among the options designed specifically to identify and block SQL injection attempts at the application layer.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 13

A company uses AWS Shield Advanced for DDoS protection. During an attack, they notice that legitimate traffic is being throttled. Which configuration change should be made to reduce false positives while maintaining protection?

Accepted Answer

Increase the rate limit threshold in the associated AWS WAF rate-based rule.. AWS WAF rate-based rules count requests per source IP over a rolling window and block or count when the threshold is exceeded. If legitimate users share NAT or proxy IPs, a low threshold causes false positives. Raising the threshold reduces the chance that normal traffic trips the rule while still allowing Shield Advanced and WAF to mitigate volumetric attacks.

Answer

Reduce the rate limit in the Shield Advanced configuration.

Answer

Disable the AWS WAF rate-based rule for the duration of the attack.

Answer

Increase the sensitivity of the AWS WAF web ACL.

Question 14

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, but the database servers must not be. Which architecture meets these requirements?

Accepted Answer

Place web servers in public subnets with an internet gateway, and databases in private subnets with no direct internet access.. Placing web servers in public subnets with an internet gateway and database servers in private subnets with no direct internet access ensures only the web tier is accessible from the internet. Option A is incorrect because a NAT gateway is used for outbound internet access from private subnets, not for allowing inbound traffic to the database servers. Option C is incorrect because an AWS Site-to-Site VPN is used to connect on-premises networks to a VPC, not to provide internet access to private subnets. Option D is incorrect because placing database servers in public subnets directly exposes them to the internet; security groups alone do not prevent internet routability, and best practice is to place databases in private subnets.

Answer

Use a NAT gateway for the database servers to allow inbound traffic.

Answer

Place all servers in private subnets and use an AWS Site-to-Site VPN for internet access.

Answer

Place both web and database servers in public subnets and use security groups to restrict database access.

Question 15

A company needs to encrypt data at rest in Amazon S3. Which AWS service manages the encryption keys?

Accepted Answer

AWS KMS. AWS KMS (Key Management Service) is the AWS service that manages encryption keys for Amazon S3. AWS KMS allows you to create, rotate, and control access to encryption keys used to encrypt data at rest in S3. Option A (AWS Secrets Manager) is incorrect because it manages secrets like database credentials, not encryption keys for S3. Option B (AWS Certificate Manager) is incorrect because it manages SSL/TLS certificates, not encryption keys. Option C (AWS CloudHSM) is incorrect because while it provides hardware security modules for key storage, it is not the default or primary key manager for S3; AWS KMS is the integrated service for S3 encryption.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Answer

AWS CloudHSM