ANS-C01 Network Security, Compliance and Governance Practice Test 21 — 15 Questions

Question 1

A company wants to centrally manage and enforce VPC security group rules across multiple accounts in AWS Organizations. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service for centrally managing and enforcing VPC security group rules across multiple accounts in AWS Organizations. It provides centralized security policy management, allowing you to define common security group rules and automatically apply them to new and existing accounts. AWS Config (Option A) is primarily for compliance auditing and resource configuration history, not enforcement. AWS CloudFormation StackSets (Option B) can deploy resources across accounts but does not provide ongoing enforcement of security policies. IAM Policies (Option D) control permissions, not security group configurations.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

IAM Policies

Question 2

A company wants to encrypt data in transit between an on-premises data center and AWS. Which service provides a dedicated encrypted connection?

Accepted Answer

AWS Direct Connect with MACsec. AWS Direct Connect with MACsec provides a dedicated encrypted connection. Option A is wrong because AWS Transit Gateway is a network transit hub, not a connection type. Option C is wrong because AWS Site-to-Site VPN operates over the internet and is not dedicated. Option D is wrong because AWS Client VPN is for individual users and not a dedicated connection.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 3

A security engineer is designing a VPC with public and private subnets. The company requires that instances in the private subnet can initiate outbound connections to the internet but cannot receive inbound connections from the internet. Which TWO components are necessary? (Choose 2)

Accepted Answer

NAT Gateway in the public subnet. To allow instances in a private subnet to initiate outbound internet connections while preventing inbound connections, a NAT Gateway placed in a public subnet is required. The NAT Gateway translates private IPs to its own public IP. Additionally, the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway to direct outbound traffic. Option A (VPC Gateway Endpoint for S3) is for private access to S3, not general internet. Option B (security group allowing inbound from 0.0.0.0/0) would allow inbound connections, violating the requirement. Option D (Internet Gateway attached to private subnet) is incorrect because an Internet Gateway is attached to the VPC, not a subnet, and would allow inbound traffic if used in a route table.

Answer

VPC Gateway Endpoint for S3

Answer

Security group allowing inbound traffic from 0.0.0.0/0

Answer

Internet Gateway attached to the private subnet

Question 4

A company wants to inspect traffic between VPCs in the same region using a third-party security appliance. Which THREE components are needed? (Choose 3)

Accepted Answer

AWS Transit Gateway. The correct answers are C, D, and E. AWS Transit Gateway (C) is required to centrally interconnect multiple VPCs and route traffic through a common inspection point. A dedicated inspection VPC (E) hosts the third-party security appliance, segregating inspection traffic from production workloads. Route tables in the inspection VPC (D) must direct inbound and outbound traffic through the appliance to enforce inspection. Option A is incorrect because VPC Peering does not support centralized inspection and creates a full mesh. Option B is incorrect because NAT Gateways only provide outbound internet access, not inter-VPC traffic inspection.

Answer

VPC Peering connections between all VPCs

Answer

NAT Gateways in each VPC

Question 5

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Accepted Answer

VPC Flow Logs. Options B and D are correct. VPC Flow Logs capture metadata (IP addresses, ports, protocols) about network traffic. Traffic Mirroring captures actual packet content for deep packet inspection. Option A (AWS Config) is incorrect because it records configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not network traffic. Option E (Amazon CloudWatch Logs) is incorrect because it is for log storage and monitoring, not for capturing network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 6

A company uses AWS Organizations with multiple accounts. The security team wants to centrally enforce that no Amazon S3 buckets are publicly accessible across all accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Apply a service control policy (SCP) in AWS Organizations that denies the s3:PutBucketPublicAccessBlock action or enforces a bucket policy condition.. A service control policy (SCP) can be applied at the root organizational unit to deny the s3:PutBucketPublicAccessBlock action and enforce that no S3 buckets are publicly accessible across all accounts. Option A is incorrect because Trusted Advisor provides recommendations, not enforcement. Option C is incorrect because IAM roles are per-account and cannot centrally enforce across all accounts without additional overhead. Option D is incorrect because security groups apply to EC2 instances, not S3 buckets.

Answer

Use AWS Trusted Advisor to check for public buckets and send alerts.

Answer

Create an IAM role in each account with a policy to deny public bucket access, and require users to assume that role.

Answer

Configure security group rules to block public internet access to the S3 endpoints.

Question 7

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT Gateway. The security team wants to ensure that traffic from the private subnets to the internet is logged and inspected for malicious activity. Which solution meets these requirements?

Accepted Answer

Configure VPC Traffic Mirroring from the private subnet instances to a network security appliance (e.g., partner firewall) for deep packet inspection.. VPC Traffic Mirroring allows you to capture and mirror all traffic from the elastic network interfaces (ENIs) of instances in private subnets to a network security appliance (e.g., partner firewall) for deep packet inspection and logging. This meets the requirement for inspecting traffic for malicious activity. Option A is incorrect because AWS Shield Advanced provides DDoS protection but does not provide deep packet inspection or logging of all traffic. Option B is incorrect because AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at the application layer, not network-level traffic from private subnets. Option C is incorrect because VPC Flow Logs only capture metadata (IP addresses, ports, protocols) and do not inspect packet payloads for malicious activity.

Answer

Use AWS Shield Advanced to inspect traffic and detect malicious activity.

Answer

Deploy AWS WAF on the NAT Gateway to inspect and filter outgoing traffic.

Answer

Enable VPC Flow Logs on the NAT Gateway and analyze the logs with Amazon Detective.

Question 8

A company wants to allow its employees to securely access internal web applications hosted in a VPC without using a VPN. The solution must authenticate users against the company's Active Directory and apply fine-grained access controls. Which AWS service should be used?

Accepted Answer

AWS Verified Access. AWS Verified Access is the correct service because it provides secure access to corporate applications hosted in a VPC without requiring a VPN, and it integrates with identity providers such as Active Directory for authentication and fine-grained access control. Option A (AWS SSO) is designed for federating access to AWS accounts and applications, not for securing access to internal VPC-based applications without a VPN. Option C (AWS Client VPN) requires VPN client software and a VPN connection, which does not meet the requirement of not using a VPN. Option D (Application Load Balancer with OIDC authentication) can authenticate users but typically requires the ALB to be publicly accessible or connected via VPN, and it does not provide the same purpose-built zero-trust access capabilities as Verified Access.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Client VPN

Answer

Application Load Balancer with OIDC authentication

Question 9

A company is designing a multi-account architecture. They need to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the security account. The logs must be encrypted at rest using a customer-managed KMS key in the security account. Which combination of steps is required?

Accepted Answer

Configure the KMS key policy to allow the log-producing accounts to use the key, and the S3 bucket policy to allow those accounts to write.. To centralize VPC flow logs with customer-managed KMS encryption, you need both a KMS key policy that grants the log-producing accounts permission to use the key (kms:Encrypt, kms:GenerateDataKey) and an S3 bucket policy that allows those accounts to write objects. Option A is wrong because SSE-S3 cannot be used with cross-account access in this context. Option B is wrong because using separate keys per account defeats centralization. Option D is wrong because without modifying the KMS key policy, cross-account encryption will fail.

Answer

Configure the S3 bucket policy to allow the log accounts to write; encryption is automatic with SSE-S3.

Answer

Create a KMS key in each account and configure the S3 bucket to use each key.

Answer

Create a KMS key in the security account with no key policy changes; use bucket policies to allow cross-account writes.

Question 10

A company uses AWS Certificate Manager (ACM) to issue certificates for a fleet of Application Load Balancers. The security team requires that only specific IAM roles can request, renew, or delete ACM certificates. Which policy type should be used to enforce this?

Accepted Answer

IAM identity-based policies attached to the IAM roles. ACM access is controlled via IAM identity-based policies attached to IAM roles, which allow specifying which roles can request, renew, or delete certificates. Option A is incorrect because AWS managed policies are a type of IAM policy, but the question asks for the policy type used to enforce access for specific IAM roles, and AWS managed policies can be used but are not the only type; however, the key point is that identity-based policies are the mechanism. Option B is incorrect because service control policies (SCPs) apply to all accounts in an AWS Organization and cannot target specific IAM roles within an account. Option D is incorrect because ACM does not support resource-based policies; only IAM policies can be used to control access to certificates.

Answer

AWS managed policies such as AWSCertificateManagerFullAccess

Answer

Service control policies (SCPs) in AWS Organizations

Answer

Resource-based policies attached to the ACM certificates

Question 11

A company is using AWS CloudHSM to store sensitive encryption keys. Which of the following is a security best practice for managing the HSM?

Accepted Answer

Store the CloudHSM security officer (CO) password in AWS Secrets Manager.. Storing the CloudHSM security officer (CO) password in AWS Secrets Manager is a security best practice. Secrets Manager provides secure storage, automatic rotation, and fine-grained access control for sensitive credentials, reducing the risk of exposure. Option A is incorrect because disabling two-factor authentication would weaken the security posture of the HSM. Option B is incorrect because AWS KMS cannot rotate CloudHSM partition passwords; KMS manages encryption keys, not HSM passwords. Option D is incorrect because granting AWS support access would compromise the customer-managed security model of CloudHSM, where only the customer controls the HSM cluster.

Answer

Disable two-factor authentication for the HSM to simplify management.

Answer

Use AWS KMS to automatically rotate the CloudHSM partition password.

Answer

Allow AWS to manage the CloudHSM cluster by granting AWS support access.

Question 12

A company has a VPC with multiple security groups. An EC2 instance in security group A needs to communicate with an RDS instance in security group B on port 3306. The security team wants to minimize exposure. What should the inbound rule in security group B be?

Accepted Answer

Allow inbound TCP 3306 from security group A. Referencing security group A as the source allows inbound traffic on port 3306 from any instance associated with security group A, which is the most specific and secure method. This approach automatically adapts if instances in security group A change IP addresses. Option A is wrong because it allows traffic from any instance in the specified subnet, not just those that need to communicate. Option B is wrong because it allows traffic from all IP addresses, violating the principle of least privilege. Option C is wrong because it ties the rule to a single instance's IP address, which can change and requires updates if the instance is replaced.

Answer

Allow inbound TCP 3306 from the CIDR block of the subnet where the EC2 instance resides

Answer

Allow inbound TCP 3306 from 0.0.0.0/0

Answer

Allow inbound TCP 3306 from the private IP address of the EC2 instance

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to inspect all traffic between VPCs and on-premises using a centralized firewall appliance. Which architecture meets this requirement?

Accepted Answer

Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.. A Transit Gateway with a centralized inspection VPC allows routing all traffic through firewall appliances for centralized inspection. Option A is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; it distributes inspection per VPC. Option B is wrong because connecting all VPCs to on-premises via Direct Connect does not provide centralized inspection within AWS; it sends traffic on-premises, which may not be desired. Option C is wrong because VPC peering does not support transitive routing, making it unsuitable for centralized inspection across many VPCs.

Answer

Deploy AWS Network Firewall in each VPC and route all traffic through it.

Answer

Connect all VPCs to on-premises via AWS Direct Connect and inspect traffic on-premises.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Question 14

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to ensure that all internet-bound traffic from VPCs in the organization goes through a centralized egress VPC where it is inspected by a firewall. Which TWO steps are required to enforce this?

Accepted Answer

Create a central egress VPC with an Internet Gateway and a NAT Gateway or firewall.. Options A and E are correct. Option A: A central egress VPC with an Internet Gateway and NAT Gateway or firewall is required to route and inspect all internet-bound traffic. Option E: An SCP denying ec2:CreateInternetGateway in all accounts except the central network account prevents other accounts from creating their own Internet Gateways, thereby forcing traffic through the central VPC. Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/S traffic, not a method to block all internet access at the network level. Option C is incorrect because AWS Direct Connect is for private on-premises connectivity, not for routing internet traffic. Option D is incorrect because VPC endpoints provide private access to AWS services without traversing the internet; they do not enforce internet egress routing.

Answer

Use AWS WAF to block internet access from all VPCs except the central egress VPC.

Answer

Set up an AWS Direct Connect connection to route internet traffic through the central VPC.

Answer

Configure VPC endpoints for all AWS services to force traffic through the central VPC.

Question 15

A company is building a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The security team requires that all API requests are authenticated and authorized, and that the Lambda function has only the necessary permissions to access DynamoDB. Which THREE steps should be taken?

Accepted Answer

Configure API Gateway to use an Amazon Cognito user pool or a Lambda authorizer for authentication.. The correct steps are B, D, and E. Option B ensures authentication via Amazon Cognito user pools or Lambda authorizers. Option D grants the Lambda function least-privilege access to DynamoDB using an IAM role. Option E uses a resource-based policy on the DynamoDB table to restrict access to only the Lambda function's IAM role. Option A is incorrect because placing the Lambda function in a VPC is not required for security; it can access DynamoDB over the internet. Option C is incorrect because API keys are for usage plans and rate limiting, not for authentication.

Answer

Place the Lambda function inside a VPC and use a VPC endpoint for DynamoDB.

Answer

Use API keys in API Gateway to authenticate requests.