ANS-C01 Network Security, Compliance and Governance Practice Test 22 — 15 Questions

Question 1

A company has a security requirement to log and monitor all DNS queries made by EC2 instances in a VPC. Which TWO AWS solutions can meet this requirement?

Accepted Answer

Enable Amazon Route 53 Resolver Query Logging.. Option A (Amazon Route 53 Resolver DNS Firewall) provides DNS query logging. Option D (Amazon Route 53 Resolver Query Logging) specifically logs queries. VPC Flow Logs log IP traffic, not DNS. CloudWatch Logs can store logs but does not capture DNS queries natively. AWS CloudTrail logs API calls, not DNS queries.

Answer

Use AWS CloudTrail to log DNS queries.

Answer

Use Amazon CloudWatch Logs with a custom agent to capture DNS logs.

Answer

Enable VPC Flow Logs.

Question 2

A company wants to protect its web application running on Amazon EC2 behind an Application Load Balancer (ALB) from common web exploits like SQL injection and cross-site scripting (XSS). Which THREE AWS services should be used together to provide comprehensive protection?

Accepted Answer

AWS WAF. Option A (AWS WAF) protects against web exploits. Option B (ALB) is the endpoint. Option D (AWS Shield) provides DDoS protection. Route 53 is DNS, not security. CloudFront can be used with WAF but is not a service for protection against web exploits itself.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Question 3

A security engineer attaches the above IAM policy to an IAM user. The user then attempts to launch an EC2 instance from an IP address outside the 10.0.0.0/8 range. What will happen?

Accepted Answer

The request will be denied because the condition is not satisfied.. The policy allows ec2:* only when the source IP is within 10.0.0.0/8. If the user is coming from outside that range, the condition is not met, so the action is not allowed. The default is implicit deny, so the request will be denied. Option B is correct. Option A is wrong because the condition is not met. Option C is wrong because the policy does not deny explicitly; it just doesn't allow. Option D is wrong because the condition evaluates to false.

Answer

The request will be allowed because the policy allows ec2:* on all resources.

Answer

The request will be denied because the policy does not include a Deny statement.

Answer

The request will be allowed because the condition evaluates to true.

Question 4

A security engineer reviews the CloudTrail log entry above. What security concern does this event raise?

Accepted Answer

The root user is being used to perform administrative actions.. The event shows the AWS root user creating a security group. Best practice is to not use root for daily tasks. The source IP is external, but that is not necessarily a concern. The security group name is not the issue. The region is us-east-1, not a concern.

Answer

The security group was created with a permissive name.

Answer

The event took place in a region that is not used by the company.

Answer

The event originated from an external IP address.

Question 5

A security engineer reviews the NACL entries above for a subnet. Which statement about incoming SSH traffic (port 22) is correct?

Accepted Answer

SSH traffic is allowed from all IP addresses.. NACLs are stateless and rules are evaluated in order by rule number. Rule 100 allows SSH from all IPs. Rule 200 denies SSH from all IPs, but it is not evaluated because rule 100 already allowed. Rule 300 allows SSH from 10.0.0.0/8 but is not reached. Since rule 100 allows all, SSH is allowed from all IPs. Option A is correct.

Answer

SSH traffic is allowed only from the 10.0.0.0/8 range.

Answer

SSH traffic is allowed from 10.0.0.0/8 and denied from all others.

Answer

SSH traffic is denied from all IP addresses.

Question 6

A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?

Accepted Answer

NAT Gateway. Option B is correct because a NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic. Option A (Internet Gateway) would allow inbound traffic. Option C (VPC Peering) does not provide internet access. Option D (Direct Connect) is a dedicated connection, not for internet access.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 7

A security engineer is configuring Network Access Control Lists (NACLs) for a VPC with multiple subnets. The engineer wants to block SSH access (port 22) from a specific IP range 10.0.0.0/8 to the entire VPC CIDR (172.16.0.0/16). What is the most effective approach?

Accepted Answer

Add inbound and outbound NACL rules denying SSH from 10.0.0.0/8. Option C is correct because NACLs are stateless, so you must add inbound and outbound rules for each direction. Option A is wrong because NACLs are subnet-level, not instance-level. Option B is wrong because a single rule cannot block both directions. Option D is wrong because security groups are stateful and cannot block traffic based on source IP in the outbound rule easily.

Answer

Add a security group rule to deny inbound SSH from 10.0.0.0/8

Answer

Add an inbound NACL rule denying SSH from 10.0.0.0/8

Answer

Add an outbound security group rule denying SSH to 10.0.0.0/8

Question 8

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They require that the encryption keys are managed by AWS and rotated automatically. Which encryption option should they choose?

Accepted Answer

SSE-S3. Option B is correct because SSE-S3 uses keys managed by AWS with automatic rotation. SSE-C (Option A) requires customer-provided keys. SSE-KMS (Option C) uses AWS KMS but key rotation is optional. Client-side (Option D) is not server-side.

Answer

SSE-C

Answer

Client-side encryption

Answer

SSE-KMS

Question 9

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should they use?

Accepted Answer

S3 server-side encryption and CloudTrail log file validation. Option A is correct because S3 server-side encryption (SSE-S3 or SSE-KMS) encrypts logs at rest, and CloudTrail log file validation provides integrity verification. Option B (KMS with CloudWatch) does not provide integrity. Option C (IAM roles) is not relevant. Option D (S3 bucket policies) does not encrypt or validate.

Answer

AWS KMS and CloudWatch Logs

Answer

S3 bucket policies and versioning

Answer

IAM roles and S3 bucket policies

Question 10

A company has a VPC with a VPN connection to an on-premises data center. They want to ensure that traffic between the VPC and on-premises is encrypted and authenticated. Which two components are required to establish the VPN tunnel?

Accepted Answer

Virtual Private Gateway and Customer Gateway. Option B is correct because a Virtual Private Gateway (VPG) is the AWS-side endpoint, and a Customer Gateway (CGW) represents the on-premises router. Option A (Internet Gateway) is for internet traffic. Option C (Direct Connect) is a different service. Option D (Transit Gateway) is optional.

Answer

AWS Direct Connect and Direct Connect Gateway

Answer

Internet Gateway and NAT Gateway

Answer

Transit Gateway and VPN Attachment

Question 11

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?

Accepted Answer

Managed rule group for SQL injection. AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.

Answer

IP set rule

Answer

Rate-based rule

Answer

Geographic match rule

Question 12

A company needs to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which policy element should be used in an IAM policy to deny access if MFA is not present?

Accepted Answer

Condition. The Condition element in an IAM policy allows you to specify conditions for when a policy is in effect. To deny access if MFA is not present, you use the `aws:MultiFactorAuthPresent` condition key with a Boolean value of `false`. This ensures that only requests authenticated with MFA are allowed, enforcing the security requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 13

A company is using Amazon Route 53 for DNS resolution. They want to restrict access to a private hosted zone so that only authorized VPCs can query it. Which configuration should they use?

Accepted Answer

Associate the private hosted zone with the authorized VPCs. Option A is correct because associating a private hosted zone with VPCs allows only those VPCs to resolve records. Option B (IAM policy) affects API calls, not DNS queries. Option C (security group) is for network interfaces. Option D (NACL) is subnet-level.

Answer

Configure a network ACL to block UDP port 53 from other VPCs

Answer

Create an IAM policy to deny DNS queries from other VPCs

Answer

Configure a security group to block DNS traffic from other VPCs

Question 14

A company is using AWS Shield Advanced to protect against DDoS attacks. They want to receive notifications when an attack is detected. Which AWS service should they integrate with to receive notifications?

Accepted Answer

Amazon CloudWatch and Amazon Simple Notification Service (SNS). Option C is correct because AWS Shield Advanced sends metrics to CloudWatch, and you can create CloudWatch alarms to trigger SNS notifications. Option A (SQS) is for queuing. Option B (Lambda) can be triggered but SNS is simpler. Option D (Kinesis) is for streaming.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon Kinesis Data Streams

Question 15

A company wants to securely store secrets such as database credentials and API keys. Which TWO AWS services can be used for this purpose? (Choose two.)

Accepted Answer

AWS Systems Manager Parameter Store. Option B (AWS Secrets Manager) and Option D (AWS Systems Manager Parameter Store) are correct. Secrets Manager is designed for secrets with automatic rotation. Parameter Store can store secrets securely with encryption. Option A (S3) is not secure by default. Option C (CloudFormation) is for infrastructure as code. Option E (IAM) is for users and roles.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS Identity and Access Management (IAM)