ANS-C01 Network Security, Compliance and Governance Practice Test 22 — 15 Questions

Question 1

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the AWS account, including calls to authorize security group rule changes (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). This makes it the appropriate service for auditing changes to security group rules. AWS Config (Option B) records resource configurations and can track changes, but it is not the primary service for API-level auditing. VPC Flow Logs (Option C) capture network traffic metadata, not configuration changes. Amazon Inspector (Option D) is a vulnerability assessment service, not an audit service for changes.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 2

A company uses AWS Direct Connect to connect their on-premises network to AWS. They want to encrypt all traffic between their on-premises router and the AWS Direct Connect location. Which solution should they implement?

Accepted Answer

Enable MACsec on the Direct Connect connection.. MACsec (IEEE 802.1AE) provides link-layer encryption on the Direct Connect connection between the on-premises router and the AWS Direct Connect location, which is exactly the requirement to encrypt traffic on that segment. AWS supports MACsec on dedicated 10 Gbps and 100 Gbps connections, and it encrypts all frames on the physical link without requiring an overlay tunnel. This is the only option that encrypts the Direct Connect path itself.

Answer

Use an IPsec VPN over the internet for additional encryption.

Answer

Use AWS PrivateLink to create a secure connection.

Answer

Use TLS to encrypt the traffic at the application layer.

Question 3

A company needs to block traffic from a specific IP address range in their VPC. Which component should be used?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless, subnet-level firewalls that support both allow and deny rules, making them the only VPC component that can explicitly block traffic from a specific IP range. Security groups are stateful and only support allow rules, so they cannot deny traffic. Route tables and internet gateways control routing, not filtering. Thus, to block a CIDR range, you must use a NACL with a deny rule for that range.

Answer

Route table

Answer

Internet gateway

Answer

Security group

Question 4

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which TWO services should they use to protect against common web exploits and DDoS attacks?

Accepted Answer

AWS WAF. AWS WAF (option A) is correct because it is a web application firewall that filters and monitors HTTP(S) requests based on customizable rules, allowing the company to block common web exploits such as SQL injection and cross-site scripting (XSS) at the application layer. AWS Shield Advanced (option B) is correct because it provides enhanced DDoS protection with always-on detection, automatic mitigation, and access to the AWS DDoS Response Team (DRT) for large volumetric and application-layer attacks. Together, WAF and Shield Advanced form a layered defense-in-depth approach for a web application facing both web exploits and DDoS threats. Amazon Inspector (option C) is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not a real-time web exploit or DDoS mitigation tool. AWS Network Firewall (option D) is a managed stateful network firewall for VPC-level traffic filtering, which does not specifically target web application exploits or DDoS mitigation. Amazon GuardDuty (option E) is a threat detection service that identifies malicious activity and unauthorized behavior, but it does not actively block web exploits or absorb DDoS attacks.

Answer

Amazon Inspector

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Question 5

A company is designing a network security architecture for a multi-account environment using AWS Organizations. They need to centrally manage and enforce security policies across all accounts. Which THREE services should they consider?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager (B) is correct because it is purpose-built for multi-account environments in AWS Organizations, allowing centralized deployment and enforcement of AWS WAF, AWS Shield Advanced, security groups, Network Firewall, and Route 53 Resolver DNS Firewall policies across all accounts. AWS Security Hub (C) is correct because it aggregates and normalizes security findings from multiple AWS services and accounts into a single pane of glass, and supports Organizations-integrated multi-account management for compliance standards and security posture. AWS CloudTrail (E) is correct because it can be configured as an organization trail that logs API activity across every account in AWS Organizations into a central S3 bucket, providing centralized auditing and governance. AWS Direct Connect (A) is not a security policy management service; it is a dedicated private network connection between on-premises and AWS, so it does not centrally enforce security policies. Amazon Route 53 Resolver DNS Firewall (D) is a per-VPC DNS filtering capability that can be managed centrally only when driven by Firewall Manager, but by itself it is not a multi-account policy management service, so it does not satisfy the requirement directly.

Answer

AWS Direct Connect

Answer

Amazon Route 53 Resolver DNS Firewall

Question 6

A company is using Amazon S3 to store sensitive data. They want to ensure that data is encrypted at rest and that access is logged. Which TWO services should they enable?

Accepted Answer

S3 Server Access Logs. And E are correct: S3 Server-Side Encryption (SSE) encrypts data at rest, fulfilling the encryption requirement; S3 Server Access Logs log requests to the bucket, fulfilling the logging requirement. Option A (AWS Config) is incorrect because it monitors configuration changes, not data access. Option C (VPC Flow Logs) is incorrect because it captures network traffic, not S3 requests. Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls but S3 Server Access Logs provide more granular object-level logging, and the question asks for access logging, not API call logging.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 7

A security team requires that all traffic between Amazon EC2 instances in different subnets of a VPC be logged. Which AWS service should be used to capture and log the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information going to and from network interfaces in a VPC. They can be configured at the VPC, subnet, or ENI level to log all traffic, including traffic between instances in different subnets. This meets the requirement to log all traffic between EC2 instances in different subnets.

Answer

AWS CloudTrail

Answer

VPC Traffic Mirroring

Answer

AWS Config

Question 8

A company wants to allow its developers to access Amazon RDS databases from their on-premises network without traversing the public internet. Which solution meets this requirement?

Accepted Answer

Establish an AWS Site-to-Site VPN connection. A Site-to-Site VPN connection between the on-premises network and the AWS VPC provides a private, encrypted tunnel over the internet, allowing on-premises developers to reach RDS without exposing the database publicly. This is the standard hybrid connectivity solution when dedicated private circuits are not required.

Answer

Use a NAT gateway in the VPC

Answer

Create a VPC endpoint for RDS

Answer

Configure VPC Peering between the on-premises network and the VPC

Question 9

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. They need to centrally manage and enforce VPC security group rules across all accounts. Which service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is designed to centrally manage and enforce security group rules, AWS WAF rules, AWS Shield Advanced protections, and Network Firewall policies across all accounts in an AWS Organization. It integrates with AWS Organizations to apply policies organization-wide, which is exactly what the company needs for centralized VPC security group rule management.

Answer

AWS CloudFormation StackSets

Answer

AWS Config

Answer

AWS Service Catalog

Question 10

A company wants to ensure that all traffic to and from its Amazon EC2 instances in a VPC is inspected by a third-party security appliance. The instances are in private subnets and must maintain their private IP addresses. Which solution should be used?

Accepted Answer

Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC. Gateway Load Balancer (GWLB) with Gateway Load Balancer endpoints (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' private IP addresses. The GWLB acts as a transparent layer between the VPC and the appliance, inspecting all traffic. Option A is incorrect because a Transit Gateway with a site-to-site VPN does not provide inline inspection without modifying the routing and IP addresses. Option C is incorrect because VPC Peering does not inherently provide traffic inspection; you would still need to route traffic through an appliance. Option D is incorrect because a Network Load Balancer is designed for load balancing, not for inline inspection of all traffic.

Answer

Deploy a Transit Gateway with a site-to-site VPN to the appliance

Answer

Use VPC Peering to connect to a central inspection VPC

Answer

Set up a Network Load Balancer in front of the instances

Question 11

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?

Accepted Answer

IP set match condition in AWS WAF. AWS WAF allows you to create IP set match conditions, which can be used to block or allow requests based on IP addresses or ranges. This is the correct component to block a specific IP address range at the application layer.

Answer

Security group associated with the ALB

Answer

AWS Shield Advanced

Answer

Network ACL on the ALB's subnets

Question 12

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?

Accepted Answer

Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC. AWS PrivateLink (VPC endpoint services) allows consumers in one VPC to reach a service in another VPC via an elastic network interface backed by a private IP, without requiring non-overlapping CIDRs. Because the traffic is delivered through the endpoint's ENI rather than routed by CIDR, overlapping 10.0.0.0/16 ranges in the two VPCs do not conflict. This satisfies the requirement to enable communication between specific instances without re-addressing either VPC.

Answer

Configure a NAT gateway in each VPC

Answer

Use security group references to allow traffic between the instances

Answer

Create a Transit Gateway and attach both VPCs

Question 13

A company is using AWS Organizations and wants to centrally manage and enforce the use of VPC endpoints for S3 across all accounts. Which THREE services/tools can be combined to achieve this?

Accepted Answer

AWS Config rules. To centrally manage and enforce the use of VPC endpoints for S3 across all accounts in AWS Organizations, you can combine AWS Service Control Policies (SCPs) to allow or deny VPC endpoint creation at the organizational level, AWS CloudFormation StackSets to deploy VPC endpoints consistently across multiple accounts, and AWS Config rules to detect non-compliant resources such as missing VPC endpoints. Option B (AWS Config rules) is correct because it can evaluate compliance and trigger remediation. Option C (AWS CloudFormation StackSets) is correct because it automates deployment of VPC endpoints in target accounts. Option D (AWS SCPs) is correct because it enforces policies on endpoint creation. Option A (VPC Flow Logs) is wrong because it only logs traffic, not enforce policies. Option E (AWS Transit Gateway) is wrong because it provides network connectivity, not endpoint management.

Answer

VPC Flow Logs

Answer

AWS Transit Gateway

Question 14

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for logging and compliance. Which service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway provides outbound internet access for instances in private subnets while using a single Elastic IP address, ensuring all outbound traffic appears to originate from that IP. This satisfies the requirement for a single IP for logging and compliance. NAT Gateway is highly available within an AZ and scales automatically.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPC Endpoint

Question 15

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices that a specific IP address is generating a high number of requests and wants to block it immediately. What is the MOST efficient way to block this IP address?

Accepted Answer

Add the IP address to an IP set in AWS WAF and update the rule to block it. AWS WAF IP sets are designed for exactly this use case: you maintain a named set of IP addresses and reference it in a rule, so adding the offending IP to the set and ensuring the rule action is Block takes effect within seconds across all associated resources. This is the native, lowest-friction mechanism for dynamic IP blocking at Layer 7.

Answer

Add a deny rule in the security group attached to the ALB

Answer

Update the Network ACL associated with the ALB subnets to deny inbound traffic from the IP address

Answer

Create a new web ACL in AWS WAF and associate it with the ALB