ANS-C01 Network Security, Compliance and Governance Practice Test 21 — 15 Questions

Question 1

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to inspect all traffic between VPCs and on-premises using a centralized firewall appliance. Which architecture meets this requirement?

Accepted Answer

Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.. Option B is correct because a Transit Gateway with a centralized inspection VPC allows routing traffic through firewall appliances. Option A is wrong because VPC peering does not centralize inspection. Option C is wrong because Direct Connect alone does not provide inspection. Option D is wrong because AWS Network Firewall can be deployed in a VPC, but the question asks for architecture; inspection VPC is the best design pattern.

Answer

Deploy AWS Network Firewall in each VPC and route all traffic through it.

Answer

Connect all VPCs to on-premises via AWS Direct Connect and inspect traffic on-premises.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Question 2

A company wants to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used?

Accepted Answer

aws:SourceVpce. Option D is correct because the aws:SourceVpce condition key allows restricting to a specific VPC endpoint. Option A is wrong because aws:SourceVpc restricts to a VPC, not a specific endpoint. Option B is wrong because aws:SourceIp is for IP addresses. Option C is wrong because ec2:Vpc is for EC2 actions, not S3.

Answer

ec2:Vpc

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 3

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to ensure that all internet-bound traffic from VPCs in the organization goes through a centralized egress VPC where it is inspected by a firewall. Which TWO steps are required to enforce this?

Accepted Answer

Create a central egress VPC with an Internet Gateway and a NAT Gateway or firewall.. Options A and D are correct. Option A: A central egress VPC with an internet gateway is required. Option D: A service control policy (SCP) can prevent creation of internet gateways in other accounts. Option B is wrong because Direct Connect is for private connectivity, not internet. Option C is wrong because VPC endpoints are for private access to AWS services. Option E is wrong because AWS WAF is for web ACLs, not egress enforcement.

Answer

Use AWS WAF to block internet access from all VPCs except the central egress VPC.

Answer

Set up an AWS Direct Connect connection to route internet traffic through the central VPC.

Answer

Configure VPC endpoints for all AWS services to force traffic through the central VPC.

Question 4

A company is building a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The security team requires that all API requests are authenticated and authorized, and that the Lambda function has only the necessary permissions to access DynamoDB. Which THREE steps should be taken?

Accepted Answer

Configure API Gateway to use an Amazon Cognito user pool or a Lambda authorizer for authentication.. Options A, C, and D are correct. Option A: Cognito or Lambda authorizer provides authentication. Option C: IAM roles with least privilege for Lambda. Option D: Resource-based policy on DynamoDB to restrict access to the Lambda function. Option B is wrong because API keys are for usage plans, not authentication. Option E is wrong because VPC endpoints are not required for serverless; the function can access DynamoDB over the internet.

Answer

Place the Lambda function inside a VPC and use a VPC endpoint for DynamoDB.

Answer

Use API keys in API Gateway to authenticate requests.

Question 5

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team needs to protect the application from common web exploits like SQL injection and cross-site scripting. Which TWO AWS services should be used together?

Accepted Answer

AWS Shield Advanced. Options B and D are correct. Option B: AWS WAF integrates with ALB to filter web requests. Option D: AWS Shield Advanced provides enhanced DDoS protection. Option A is wrong because AWS Network Firewall is for network layer, not web application layer. Option C is wrong because Amazon GuardDuty is for threat detection, not prevention. Option E is wrong because AWS Firewall Manager is for central management, not direct protection.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 6

A company uses AWS Organizations with SCPs to enforce security controls. The security team wants to prevent users from disabling Amazon GuardDuty or modifying its configuration in any member account. Which SCP effect should be used?

Accepted Answer

Deny. The correct answer is 'Deny' because SCPs use Deny to explicitly block actions. Allow is used to whitelist, but SCPs default to Allow, so Deny is needed to override. 'Block' and 'Prevent' are not valid SCP effects.

Answer

Prevent

Answer

Allow

Answer

Block

Question 7

A company is designing a network security architecture for a multi-account AWS environment using AWS Transit Gateway. They need to ensure that all traffic between VPCs must be inspected by a centralized security appliance (e.g., firewall) in a shared services VPC. Which routing design meets this requirement?

Accepted Answer

Attach the inspection VPC and all spoke VPCs to the same Transit Gateway route table, and add a static route for the spoke VPC CIDRs pointing to the inspection VPC attachment, with blackhole routes for the same CIDRs.. Option C is correct because by attaching both the inspection VPC and the spoke VPCs to the same route table with blackhole routes, traffic between spokes is forced to go through the inspection VPC. Option A is incorrect because it uses separate route tables, which would allow direct routing. Option B allows direct traffic. Option D is not a standard practice.

Answer

Attach all VPCs to a single route table and enable VPC peering for inspection VPC.

Answer

Use a centralized NAT gateway in the inspection VPC and configure all spokes to route traffic through it.

Answer

Create separate route tables for each VPC attachment and propagate routes from all VPCs.

Question 8

A company is using AWS WAF to protect a web application. They want to block requests that originate from known malicious IP addresses. Which WAF rule type should be used?

Accepted Answer

IP set match condition. IP set match conditions are used to match the source IP address of a request against a list of IP addresses. Regex, string match, and SQL injection are for other attack types.

Answer

String match condition

Answer

Regex match condition

Answer

SQL injection match condition

Question 9

A company uses AWS Shield Advanced for DDoS protection. They want to receive near real-time notifications when a DDoS attack is detected. Which AWS service should be used to trigger the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). AWS Shield Advanced integrates with CloudWatch to send metrics and alarms. Shield can send events to EventBridge, but for near real-time notifications, CloudWatch Alarms are typically used to trigger SNS topics. Lambda and SQS are not direct notification services for Shield events.

Answer

Amazon EventBridge

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 10

A security engineer is troubleshooting an issue where Amazon Inspector is not finding any vulnerabilities in an EC2 instance. The instance has the AWS Systems Manager Agent (SSM Agent) installed and is managed by AWS Systems Manager. What is the most likely reason for Inspector not reporting findings?

Accepted Answer

The EC2 instance is not managed by AWS Systems Manager.. Inspector requires the SSM Agent to be installed and the instance to be properly registered with Systems Manager. If the instance is not managed by Systems Manager, Inspector cannot perform assessments. Missing IAM role, Security Groups, or Subnet would not prevent Inspector from running; they affect other aspects.

Answer

The EC2 instance does not have an IAM role that allows Inspector to scan it.

Answer

The EC2 instance is in a private subnet without a NAT gateway.

Answer

The EC2 instance's security group blocks outbound traffic to the Inspector service.

Question 11

A company wants to enforce that all Amazon S3 buckets in an AWS account are encrypted at rest. Which AWS service can be used to automatically detect and report unencrypted buckets?

Accepted Answer

AWS Config. AWS Config can evaluate resources against rules. The 's3-bucket-server-side-encryption-enabled' managed rule checks for encryption. CloudTrail logs API calls, GuardDuty detects threats, and Inspector assesses vulnerabilities.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 12

A company has a VPC with public and private subnets. The security team wants to block all outbound traffic to the internet from the private subnets except for traffic to an AWS service like Amazon S3. Which configuration should be used?

Accepted Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route table.. A VPC endpoint for S3 allows private subnet instances to access S3 without going through an internet gateway. A NAT gateway would allow all internet traffic, not just S3. A proxy server would allow all traffic unless configured to restrict. Internet gateway alone does not provide granular control.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet route table.

Answer

Place a proxy server in the private subnet and configure all instances to use it.

Answer

Configure a NAT gateway in the public subnet and update the route table to send 0.0.0.0/0 traffic to the NAT gateway.

Question 13

A company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates for an Application Load Balancer (ALB). The security team notices that an ACM-issued certificate is about to expire. How can they automate renewal?

Accepted Answer

Use AWS Certificate Manager's automatic renewal feature; no additional configuration is required if the certificate was issued by ACM.. ACM automatically renews certificates issued by ACM if the domain is validated with DNS or email. No manual action is needed. Imported certificates must be manually renewed. Removing and re-adding is not automatic. Lambda is unnecessary.

Answer

Set a CloudWatch alarm to send a notification when the certificate is about to expire, then manually renew.

Answer

Manually remove the certificate from ACM and re-issue a new one.

Answer

Configure an AWS Lambda function to monitor certificate expiration and re-issue the certificate.

Question 14

A company uses an AWS Network Firewall to inspect traffic between VPCs and the internet. They want to allow outbound HTTPS traffic only to specific domains. Which rule configuration should be used?

Accepted Answer

Create a stateful rule group with a 'pass' action for the allowed domains using domain list rule group.. Domain list rule group in AWS Network Firewall can match FQDNs. Stateful rule groups inspect traffic states. Suricata compatible rules allow custom domain matching. IP set would match by IP, not domain.

Answer

Create a stateless rule group with a 'forward' action for the allowed IP addresses.

Answer

Create a stateful rule group with a 'drop' action for all traffic and then 'pass' for the allowed domains using Suricata compatible rules.

Answer

Create an IP set rule group with the allowed domain IP addresses.

Question 15

A security engineer is designing a network security architecture for a hybrid cloud environment. The company has an AWS Direct Connect connection to its on-premises data center. They want to ensure that all traffic between on-premises and AWS is encrypted and that the encryption is enforced at the network layer. Which TWO solutions should the engineer consider?

Accepted Answer

Enable MACsec on the Direct Connect dedicated connection.. Option A (IPsec VPN over Direct Connect) is correct because it creates an encrypted tunnel over the Direct Connect link. Option D (MACsec) is correct because it provides encryption at Layer 2 on the Direct Connect connection. TLS is Layer 5+ and not network layer. SSL VPN is not relevant. VPC Peering does not apply to on-premises.

Answer

Set up an SSL VPN between on-premises and AWS.

Answer

Use VPC Peering to connect on-premises to AWS.

Answer

Use TLS encryption at the application layer.