ANS-C01 Network Security, Compliance and Governance Practice Test 23 — 15 Questions

Question 1

A company's security team is investigating a potential data exfiltration incident. They notice that an EC2 instance in a private subnet is making HTTPS connections to an unknown external IP address. The instance's security group only allows outbound HTTPS to a specific set of IPs. What is the MOST likely cause of the traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance is routing traffic through a NAT Gateway that has a route to the internet. A NAT Gateway in a public subnet can allow outbound traffic to any destination, bypassing security group restrictions if the security group allows traffic to the NAT Gateway. Option B is wrong because security groups are stateful; outbound rules apply regardless. Option C is wrong because an Internet Gateway is not in a private subnet. Option D is wrong because a VPC Endpoint is for AWS services, not external IPs.

Answer

The instance is using a VPC Endpoint to connect to the external IP

Answer

The security group outbound rules are being overridden by a Network ACL

Answer

The instance has a public IP address and is using an Internet Gateway directly

Question 2

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to enforce this policy?

Accepted Answer

IAM policy with a condition for aws:MultiFactorAuthPresent. An IAM policy with a condition on aws:MultiFactorAuthPresent (and often aws:MultiFactorAuthAge) enforces MFA by denying actions unless the principal authenticated with MFA. This is the standard, granular way to require MFA for IAM users, and it can be applied to users, groups, or roles. The condition key evaluates to true only when the request is signed with MFA.

Answer

AWS Organizations SCP

Answer

AWS Config

Answer

AWS CloudTrail

Question 3

Which TWO statements are correct regarding the use of AWS Network Firewall? (Choose 2)

Accepted Answer

It supports stateful inspection using Suricata-compatible rules. A: Correct. AWS Network Firewall supports stateful inspection using Suricata-compatible rules, allowing deep packet inspection for threat detection. B: Correct. Network Firewall can be integrated with AWS Transit Gateway to enable centralized inspection of traffic across multiple VPCs. C: Incorrect. Network Firewall is deployed within a VPC, not as a standalone service, and it requires a VPC to inspect traffic; it cannot inspect traffic between on-premises and AWS without a VPC. D: Incorrect. Network Firewall does not provide automatic SSL/TLS decryption; it can only inspect traffic that is not encrypted or after decryption is performed by another service. E: Incorrect. Network Firewall is a managed service, but it is always deployed inside a VPC, not outside.

Answer

It can be used to inspect traffic between on-premises and AWS without a VPC

Answer

It provides automatic SSL/TLS decryption

Answer

It is a managed service that can be deployed outside of a VPC

Question 4

Which THREE actions can AWS Config perform to help with network security compliance? (Choose 3)

Accepted Answer

Evaluate whether security groups allow unrestricted SSH access. AWS Config can evaluate whether security groups allow unrestricted SSH access using managed rules like 'restricted-ssh'. Option C is correct because Config records configuration changes to Network ACLs and security groups, enabling tracking. Option D is correct because Config can trigger custom rules or send notifications via Amazon SNS when a security group rule is modified. Option B is incorrect because Config does not block traffic; it only evaluates and can trigger remediation actions via other services. Option E is incorrect because Config evaluates resources after creation; it cannot prevent creation, though it can trigger automated remediation via Lambda or Systems Manager.

Answer

Automatically block non-compliant traffic

Answer

Prevent creation of VPCs that do not have a specific tag

Question 5

Which TWO features are provided by AWS Shield Advanced that are not available in AWS Shield Standard? (Choose 2)

Accepted Answer

DDoS cost protection. Shield Advanced provides DDoS cost protection (option B) and 24/7 access to the AWS DDoS Response Team (option D). Option A is incorrect because automatic web application firewall rule updates are not a feature of Shield Advanced; AWS WAF can be integrated but rules are not automatically updated. Option C is incorrect because detailed DDoS logs are not a distinct feature of Shield Advanced; both Standard and Advanced provide access to AWS Shield logs. Option E is incorrect because network-layer DDoS protection (e.g., SYN flood, UDP flood) is provided by both Shield Standard and Shield Advanced; Advanced adds application-layer protection and other benefits.

Answer

Automatic web application firewall rule updates

Answer

Access to detailed DDoS logs

Answer

Network-layer DDoS protection

Question 6

Refer to the exhibit. A security engineer applies this SCP to an AWS account. What is the effect of this policy?

Accepted Answer

All API calls that are not made over HTTPS will be denied. The SCP shown likely denies all API calls that are not made over HTTPS. In AWS, SCPs can enforce conditions such as aws:SecureTransport, which when set to false, denies requests that are not using SSL/TLS. The policy effect is that any API call not using HTTPS is denied, while HTTPS calls are allowed (unless other restrictions apply).

Answer

All API calls over HTTPS will be allowed

Answer

Only S3 API calls will be affected

Answer

The policy requires multi-factor authentication

Question 7

A company has a VPC with public and private subnets. The security team wants to allow instances in a private subnet to download software updates from the internet but prevent inbound internet traffic. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway allows outbound internet traffic from private subnets while blocking unsolicited inbound traffic. Option D is correct. Option A is wrong because an internet gateway enables bidirectional traffic, which would allow inbound traffic. Option B is wrong because AWS Site-to-Site VPN is used for hybrid connectivity between on-premises and AWS, not for outbound internet access from private subnets. Option C is wrong because VPC peering connects VPCs together, not to the internet.

Answer

Internet gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 8

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. The security team wants to minimize the attack surface. Which design should they choose?

Accepted Answer

Place the web tier in public subnets with an internet gateway, and the app and DB tiers in private subnets. Use security groups to allow traffic only from the web tier to the app tier and from the app tier to the DB tier.. Option A is correct because it places only the web tier in public subnets behind an internet gateway while keeping the app and DB tiers in private subnets with no direct internet exposure, and it uses security groups as stateful, instance-level firewalls that allow only the required tier-to-tier flows (web→app, app→DB). This layered segmentation minimizes the attack surface by preventing inbound internet access to the app and DB tiers. Option B is wrong because putting the web tier in a private subnet with only a NAT gateway makes it unreachable from the internet, since NAT gateways only allow outbound-initiated traffic. Option C is wrong because a single subnet and single security group removes all tier isolation and lets any instance reach any other. Option D is wrong because placing all tiers in public subnets exposes the app and DB tiers to the internet, and network ACLs are stateless subnet-level controls that are less precise than security groups for this tiered restriction.

Answer

Place all tiers in private subnets and use a NAT gateway for internet access.

Answer

Place all tiers in the same subnet and use a single security group for all instances.

Answer

Place all tiers in public subnets and use network ACLs to restrict inbound traffic to the app and DB tiers.

Question 9

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to ensure that traffic between the on-premises network and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN tunnel over the Direct Connect connection using a public VIF or transit VIF.. Direct Connect by itself does not encrypt traffic — it is a private dedicated network connection, but data traverses it in plaintext. To encrypt traffic over Direct Connect, you run an IPSec VPN tunnel over the Direct Connect connection using a public VIF (for VPN termination on the AWS side) or a transit VIF (when using AWS Transit Gateway). This combines the private, consistent path of Direct Connect with the confidentiality of IPSec.

Answer

Establish a VPC peering connection between the on-premises network and the VPC.

Answer

Use a private virtual interface (VIF) over Direct Connect.

Answer

Use an IPSec VPN connection over the internet.

Question 10

A security engineer needs to centrally manage and enforce rules for network traffic between VPCs in a large AWS environment. Which AWS service provides this capability?

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed, stateful network firewall and intrusion prevention service that can be deployed centrally in a VPC (often via AWS Transit Gateway or a shared services VPC) to inspect and filter traffic between many VPCs. It supports Suricata-compatible rules, domain lists, and centralized policy management through Firewall Manager, making it the correct choice for enforcing rules across a large multi-VPC environment.

Answer

VPC peering

Answer

Security groups

Answer

Network ACLs

Question 11

A company has an AWS account with multiple VPCs. The security team wants to ensure that no VPC has an internet gateway attached. Which AWS service can be used to automatically detect and remediate non-compliant VPCs?

Accepted Answer

AWS Config with a managed rule to detect internet gateways and an automatic remediation action to detach them.. AWS Config with a managed rule (e.g., vpc-internet-gateway-check or internet-gateway-authorized) can continuously evaluate VPCs and detect any with an internet gateway attached. Config supports automatic remediation actions via SSM Automation documents, which can detach the internet gateway automatically, satisfying the detect-and-remediate requirement.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Service control policies (SCPs)

Question 12

A company wants to audit all changes to security group rules in a VPC. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including all changes to security group rules (such as AuthorizeSecurityGroupIngress and RevokeSecurityGroupIngress). This makes it the correct service for auditing who made changes, when, and from where. CloudTrail logs are the authoritative audit trail for control-plane operations.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch

Question 13

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to enforce that all VPCs use a specific set of security group rules for inbound SSH access. Which TWO steps should the team take? (Choose two.)

Accepted Answer

Use AWS Config rules to detect non-compliant security groups and trigger automatic remediation.. SCPs can deny the ec2:AuthorizeSecurityGroupIngress action if the rule does not comply with the standard, enforcing compliance at the organization level (Option D). AWS Config rules can detect non-compliant security groups and trigger automatic remediation via AWS Systems Manager Automation (Option A). Option B is incorrect because CloudTrail logs but does not enforce. Option C is incorrect because GuardDuty monitors for threats, not compliance. Option E is incorrect because IAM roles per account are not centralized and do not enforce across accounts.

Answer

Enable AWS CloudTrail to log all security group changes and send alerts.

Answer

Enable Amazon GuardDuty to monitor for malicious traffic.

Answer

Create an IAM role in each account that only allows creation of compliant security groups.

Question 14

A security engineer reviews VPC Flow Logs and sees the entries shown. The last entry shows a REJECT for traffic from 203.0.113.5 to 10.0.1.5 on port 443. However, the third entry shows ACCEPT for traffic from 10.0.1.5 to 203.0.113.5 on port 443. What is the most likely reason for the REJECT?

Accepted Answer

The network ACL associated with the subnet of 10.0.1.5 does not allow inbound traffic from 203.0.113.5.. The VPC Flow Logs show outbound traffic from 10.0.1.5 to 203.0.113.5 on port 443 was allowed (ACCEPT), but the inbound response was rejected. Security groups are stateful, so they automatically allow return traffic for established connections. Therefore, a security group (Option C) would not cause this REJECT. Network ACLs are stateless and require explicit inbound rules; if the inbound rule for traffic from 203.0.113.5 is missing, the response is dropped, resulting in a REJECT. Option A correctly identifies this. Option B (AWS WAF) operates at the application layer (Layer 7) and is not reflected in VPC Flow Logs, which capture Layer 3/4 traffic. Option D (route table) would cause a lack of connectivity, not a REJECT entry in flow logs.

Answer

AWS WAF is blocking the inbound traffic.

Answer

The security group attached to the instance 10.0.1.5 does not allow inbound traffic from 203.0.113.5.

Answer

The route table for the subnet of 10.0.1.5 does not have a route to the internet.

Question 15

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic, making it the correct choice. Option A (VPC Peering) is incorrect because it does not provide internet access. Option C (Internet Gateway) is incorrect because it allows inbound traffic from the internet. Option D (VPN Connection) is incorrect because it typically provides private connectivity to an on-premises network, not direct internet access.

Answer

VPC Peering

Answer

Internet Gateway

Answer

VPN Connection