ANS-C01 Network Security, Compliance and Governance Practice Test 22 — 15 Questions

Question 1

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team needs to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS WAF. AWS WAF (Option B) is the correct service because it integrates with Application Load Balancers to filter HTTP/HTTPS requests and can block common web exploits such as SQL injection and cross-site scripting. AWS Shield Advanced (Option A) provides enhanced DDoS protection, which does not mitigate web application layer attacks like SQL injection or XSS. AWS Network Firewall (Option C) operates at the network layer and is not designed for application-layer threats. Amazon GuardDuty (Option D) is a threat detection service, not a prevention tool. AWS Firewall Manager (Option E) centralizes firewall rule management but does not directly protect against web exploits. Therefore, only Option B is correct for this requirement.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 2

A company uses AWS Organizations with SCPs to enforce security controls. The security team wants to prevent users from disabling Amazon GuardDuty or modifying its configuration in any member account. Which SCP effect should be used?

Accepted Answer

Deny. 'Deny' because SCPs use Deny to explicitly block actions. Allow is used to whitelist, but SCPs default to Allow, so Deny is needed to override. 'Block' and 'Prevent' are not valid SCP effects.

Answer

Prevent

Answer

Allow

Answer

Block

Question 3

A company is designing a network security architecture for a multi-account AWS environment using AWS Transit Gateway. They need to ensure that all traffic between VPCs must be inspected by a centralized security appliance (e.g., firewall) in a shared services VPC. Which routing design meets this requirement?

Accepted Answer

Attach the inspection VPC and all spoke VPCs to the same Transit Gateway route table, and add a static route for the spoke VPC CIDRs pointing to the inspection VPC attachment, with blackhole routes for the same CIDRs.. By attaching both the inspection VPC and the spoke VPCs to the same route table with blackhole routes, traffic between spokes is forced to go through the inspection VPC. Option A is incorrect because it uses separate route tables, which would allow direct routing. Option B allows direct traffic. Option D is not a standard practice.

Answer

Attach all VPCs to a single route table and enable VPC peering for inspection VPC.

Answer

Use a centralized NAT gateway in the inspection VPC and configure all spokes to route traffic through it.

Answer

Create separate route tables for each VPC attachment and propagate routes from all VPCs.

Question 4

A company is using AWS WAF to protect a web application. They want to block requests that originate from known malicious IP addresses. Which WAF rule type should be used?

Accepted Answer

IP set match condition. IP set match conditions are used to match the source IP address of a request against a list of IP addresses. Regex, string match, and SQL injection are for other attack types.

Answer

String match condition

Answer

Regex match condition

Answer

SQL injection match condition

Question 5

A company uses AWS Shield Advanced for DDoS protection. They want to receive near real-time notifications when a DDoS attack is detected. Which AWS service should be used to trigger the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). AWS Shield Advanced integrates with CloudWatch to send metrics and alarms. Shield can send events to EventBridge, but for near real-time notifications, CloudWatch Alarms are typically used to trigger SNS topics. Lambda and SQS are not direct notification services for Shield events.

Answer

Amazon EventBridge

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 6

A security engineer is troubleshooting an issue where Amazon Inspector is not finding any vulnerabilities in an EC2 instance. The instance has the AWS Systems Manager Agent (SSM Agent) installed and is managed by AWS Systems Manager. What is the most likely reason for Inspector not reporting findings?

Accepted Answer

The EC2 instance does not have an IAM role that allows Inspector to scan it.. Amazon Inspector requires an IAM role that grants it permission to assess the EC2 instance. Without such a role, Inspector cannot perform vulnerability scans, even if the SSM Agent is installed and the instance is managed by Systems Manager. The other options are incorrect: the instance is managed by SSM (contradicting D), and missing NAT gateway or security group outbound rules do not prevent Inspector from scanning (Inspector initiates scans internally).

Answer

The EC2 instance is in a private subnet without a NAT gateway.

Answer

The EC2 instance's security group blocks outbound traffic to the Inspector service.

Answer

The EC2 instance is not managed by AWS Systems Manager.

Question 7

A company wants to enforce that all Amazon S3 buckets in an AWS account are encrypted at rest. Which AWS service can be used to automatically detect and report unencrypted buckets?

Accepted Answer

AWS Config. AWS Config can evaluate resources against rules. The 's3-bucket-server-side-encryption-enabled' managed rule checks for encryption. CloudTrail logs API calls, GuardDuty detects threats, and Inspector assesses vulnerabilities.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 8

A company has a VPC with public and private subnets. The security team wants to block all outbound traffic to the internet from the private subnets except for traffic to an AWS service like Amazon S3. Which configuration should be used?

Accepted Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route table.. A VPC endpoint for S3 allows private subnet instances to access S3 without going through an internet gateway. A NAT gateway would allow all internet traffic, not just S3. A proxy server would allow all traffic unless configured to restrict. Internet gateway alone does not provide granular control.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet route table.

Answer

Place a proxy server in the private subnet and configure all instances to use it.

Answer

Configure a NAT gateway in the public subnet and update the route table to send 0.0.0.0/0 traffic to the NAT gateway.

Question 9

A company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates for an Application Load Balancer (ALB). The security team notices that an ACM-issued certificate is about to expire. How can they automate renewal?

Accepted Answer

Use AWS Certificate Manager's automatic renewal feature; no additional configuration is required if the certificate was issued by ACM.. ACM automatically renews certificates issued by ACM if the domain is validated with DNS or email. No manual action is needed. Imported certificates must be manually renewed. Removing and re-adding is not automatic. Lambda is unnecessary.

Answer

Set a CloudWatch alarm to send a notification when the certificate is about to expire, then manually renew.

Answer

Manually remove the certificate from ACM and re-issue a new one.

Answer

Configure an AWS Lambda function to monitor certificate expiration and re-issue the certificate.

Question 10

A company uses an AWS Network Firewall to inspect traffic between VPCs and the internet. They want to allow outbound HTTPS traffic only to specific domains. Which rule configuration should be used?

Accepted Answer

Create a stateful rule group with a 'pass' action for the allowed domains using domain list rule group.. Domain list rule group in AWS Network Firewall can match FQDNs. Stateful rule groups inspect traffic states. Suricata compatible rules allow custom domain matching. IP set would match by IP, not domain.

Answer

Create a stateless rule group with a 'forward' action for the allowed IP addresses.

Answer

Create a stateful rule group with a 'drop' action for all traffic and then 'pass' for the allowed domains using Suricata compatible rules.

Answer

Create an IP set rule group with the allowed domain IP addresses.

Question 11

A security engineer is designing a network security architecture for a hybrid cloud environment. The company has an AWS Direct Connect connection to its on-premises data center. They want to ensure that all traffic between on-premises and AWS is encrypted and that the encryption is enforced at the network layer. Which TWO solutions should the engineer consider?

Accepted Answer

Enable MACsec on the Direct Connect dedicated connection.. (MACsec) is correct because it provides encryption at Layer 2 on the Direct Connect connection. Option D (IPsec VPN over Direct Connect) is correct because it creates an encrypted tunnel over the Direct Connect link. TLS is Layer 5+ and not network layer. SSL VPN is not relevant. VPC Peering does not apply to on-premises.

Answer

Set up an SSL VPN between on-premises and AWS.

Answer

Use VPC Peering to connect on-premises to AWS.

Answer

Use TLS encryption at the application layer.

Question 12

A company has a security requirement to log and monitor all DNS queries made by EC2 instances in a VPC. Which TWO AWS solutions can meet this requirement?

Accepted Answer

Enable Amazon Route 53 Resolver Query Logging.. Amazon Route 53 Resolver Query Logging (Option A) logs all DNS queries that are forwarded by the Route 53 Resolver within a VPC. Amazon Route 53 Resolver DNS Firewall (Option C) provides DNS filtering and can log DNS queries that match the firewall rules. Both are valid AWS solutions for logging DNS queries from EC2 instances. Option B (AWS CloudTrail) logs API calls, not DNS queries. Option D (Amazon CloudWatch Logs with a custom agent) is not a native AWS service for DNS logging; it requires custom configuration and is not a managed solution. Option E (VPC Flow Logs) captures IP traffic metadata, not DNS queries.

Answer

Use AWS CloudTrail to log DNS queries.

Answer

Use Amazon CloudWatch Logs with a custom agent to capture DNS logs.

Answer

Enable VPC Flow Logs.

Question 13

A company wants to protect its web application running on Amazon EC2 behind an Application Load Balancer (ALB) from common web exploits like SQL injection and cross-site scripting (XSS). Which THREE AWS services should be used together to provide comprehensive protection?

Accepted Answer

AWS WAF. AWS WAF (Option A) protects against web exploits like SQL injection and XSS. AWS Shield (Option C) provides DDoS protection. The Application Load Balancer (Option E) is the target for the web application and can be integrated with WAF and Shield for comprehensive protection. Amazon Route 53 (Option B) is a DNS service and does not directly provide security against web exploits. Amazon CloudFront (Option D) is a CDN that can be used with WAF, but it is not required since the ALB is already in place; the question asks for three services that together provide comprehensive protection, and the combination of WAF, Shield, and ALB covers web application firewall, DDoS protection, and traffic distribution.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Question 14

A security engineer attaches the above IAM policy to an IAM user. The user then attempts to launch an EC2 instance from an IP address outside the 10.0.0.0/8 range. What will happen?

Accepted Answer

The request will be denied because the condition is not satisfied.. The policy allows ec2:* only when the source IP is within 10.0.0.0/8. If the user is coming from outside that range, the condition is not met, so the action is not allowed. The default is implicit deny, so the request will be denied. Option B is correct. Option A is wrong because the condition is not met. Option C is wrong because the policy does not deny explicitly; it just doesn't allow. Option D is wrong because the condition evaluates to false.

Answer

The request will be allowed because the policy allows ec2:* on all resources.

Answer

The request will be denied because the policy does not include a Deny statement.

Answer

The request will be allowed because the condition evaluates to true.

Question 15

A security engineer reviews the CloudTrail log entry above. What security concern does this event raise?

Accepted Answer

The root user is being used to perform administrative actions.. The event shows the AWS root user creating a security group. Best practice is to not use root for daily tasks. The source IP is external, but that is not necessarily a concern. The security group name is not the issue. The region is us-east-1, not a concern.

Answer

The security group was created with a permissive name.

Answer

The event took place in a region that is not used by the company.

Answer

The event originated from an external IP address.