ANS-C01 Network Security, Compliance and Governance Practice Test 23 — 15 Questions

Question 1

A security engineer reviews the NACL entries above for a subnet. Which statement about incoming SSH traffic (port 22) is correct?

Accepted Answer

SSH traffic is allowed from all IP addresses.. NACLs are stateless and rules are evaluated in order by rule number. Rule 100 allows SSH from all IPs. Rule 200 denies SSH from all IPs, but it is not evaluated because rule 100 already allowed. Rule 300 allows SSH from 10.0.0.0/8 but is not reached. Since rule 100 allows all, SSH is allowed from all IPs. Therefore, option B is correct.

Answer

SSH traffic is allowed only from the 10.0.0.0/8 range.

Answer

SSH traffic is allowed from 10.0.0.0/8 and denied from all others.

Answer

SSH traffic is denied from all IP addresses.

Question 2

A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?

Accepted Answer

NAT Gateway. (NAT Gateway) is correct because a NAT Gateway allows instances in a private subnet to initiate outbound internet traffic (e.g., for software updates) while preventing any inbound traffic from the internet. Option B (AWS Direct Connect) is a dedicated private connection between on-premises and AWS, not for internet access. Option C (VPC Peering) connects VPCs privately, not providing internet access. Option D (Internet Gateway) allows both inbound and outbound traffic, which would expose private instances to inbound internet traffic, violating the requirement.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 3

A security engineer is configuring Network Access Control Lists (NACLs) for a VPC with multiple subnets. The engineer wants to block SSH access (port 22) from a specific IP range 10.0.0.0/8 to the entire VPC CIDR (172.16.0.0/16). What is the most effective approach?

Accepted Answer

Add inbound and outbound NACL rules denying SSH from 10.0.0.0/8. NACLs are stateless, so to block SSH from 10.0.0.0/8 to the entire VPC, both inbound and outbound rules are needed. Option A correctly adds both rules. Option B is incorrect because security groups are stateful and only allow traffic; they cannot deny. Option C is incorrect because an inbound rule alone does not block return traffic. Option D is incorrect because security groups cannot block outbound traffic based on destination IP effectively.

Answer

Add a security group rule to deny inbound SSH from 10.0.0.0/8

Answer

Add an inbound NACL rule denying SSH from 10.0.0.0/8

Answer

Add an outbound security group rule denying SSH to 10.0.0.0/8

Question 4

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They require that the encryption keys are managed by AWS and rotated automatically. Which encryption option should they choose?

Accepted Answer

SSE-S3. SSE-S3 (Option C) is the correct choice because it uses server-side encryption with Amazon S3-managed keys that are automatically rotated. SSE-C (Option A) requires the customer to provide and manage their own encryption keys. SSE-KMS (Option D) uses AWS Key Management Service (KMS) keys, which are managed by AWS but do not automatically rotate unless you enable automatic key rotation. Client-side encryption (Option B) is not a form of server-side encryption, as the data is encrypted before being sent to S3.

Answer

SSE-C

Answer

Client-side encryption

Answer

SSE-KMS

Question 5

A company has a VPC with a VPN connection to an on-premises data center. They want to ensure that traffic between the VPC and on-premises is encrypted and authenticated. Which two components are required to establish the VPN tunnel?

Accepted Answer

Virtual Private Gateway and Customer Gateway. A Virtual Private Gateway (VPG) is the AWS-side endpoint, and a Customer Gateway (CGW) represents the on-premises router. Option A (Internet Gateway) is for internet traffic. Option C (Direct Connect) is a different service. Option D (Transit Gateway) is optional.

Answer

AWS Direct Connect and Direct Connect Gateway

Answer

Internet Gateway and NAT Gateway

Answer

Transit Gateway and VPN Attachment

Question 6

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?

Accepted Answer

Managed rule group for SQL injection. AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.

Answer

IP set rule

Answer

Rate-based rule

Answer

Geographic match rule

Question 7

A company needs to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which policy element should be used in an IAM policy to deny access if MFA is not present?

Accepted Answer

Condition. The Condition element in an IAM policy allows you to specify conditions for when a policy is in effect. To deny access if MFA is not present, you use the `aws:MultiFactorAuthPresent` condition key with a Boolean value of `false`. This ensures that only requests authenticated with MFA are allowed, enforcing the security requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 8

A company is using Amazon Route 53 for DNS resolution. They want to restrict access to a private hosted zone so that only authorized VPCs can query it. Which configuration should they use?

Accepted Answer

Associate the private hosted zone with the authorized VPCs. Associating a private hosted zone with authorized VPCs allows only those VPCs to resolve records within the zone, restricting access as required. Option A is incorrect because network ACLs control traffic at the subnet level but do not restrict DNS queries to a specific hosted zone. Option B is incorrect because IAM policies control permissions for API actions (e.g., creating or modifying hosted zones), not the actual DNS query traffic. Option C is incorrect because security groups regulate traffic to and from network interfaces, not the resolution of DNS records in Route 53.

Answer

Configure a network ACL to block UDP port 53 from other VPCs

Answer

Create an IAM policy to deny DNS queries from other VPCs

Answer

Configure a security group to block DNS traffic from other VPCs

Question 9

A company is using AWS Shield Advanced to protect against DDoS attacks. They want to receive notifications when an attack is detected. Which AWS service should they integrate with to receive notifications?

Accepted Answer

Amazon CloudWatch and Amazon Simple Notification Service (SNS). AWS Shield Advanced sends metrics to CloudWatch, and you can create CloudWatch alarms to trigger SNS notifications. Option A (SQS) is for queuing. Option B (Lambda) can be triggered but SNS is simpler. Option D (Kinesis) is for streaming.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon Kinesis Data Streams

Question 10

A company wants to securely store secrets such as database credentials and API keys. Which TWO AWS services can be used for this purpose? (Choose two.)

Accepted Answer

AWS Systems Manager Parameter Store. (AWS Systems Manager Parameter Store) and Option D (AWS Secrets Manager) are correct. Parameter Store can store secrets securely with encryption and integrates with AWS KMS. Secrets Manager is designed for secrets with automatic rotation and fine-grained access control. Option B (Amazon S3) is not secure by default and requires additional configuration. Option C (AWS CloudFormation) is for infrastructure as code, not for storing secrets. Option E (AWS Identity and Access Management) is for managing users and roles, not for storing secrets.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS Identity and Access Management (IAM)

Question 11

A company is designing a network security architecture for a multi-tier web application. Which THREE best practices should they implement? (Choose three.)

Accepted Answer

Use network ACLs as a stateless firewall for subnet-level traffic. The correct answers are C, D, and E. Option C is correct because network ACLs provide a stateless firewall at the subnet level. Option D is correct because databases in private subnets have no direct internet access, enhancing security. Option E is correct because security groups control traffic at the instance level. Option A is wrong because internet gateways should be attached to public subnets, not private. Option B is wrong because security groups are stateful, not stateless.

Answer

Attach an internet gateway to the private subnet for outbound traffic

Answer

Use security groups as a stateless firewall

Question 12

Which TWO statements about AWS Key Management Service (KMS) are correct? (Choose two.)

Accepted Answer

Customer master keys (CMKs) can be automatically rotated every year.. Options A and D are correct. AWS KMS allows automatic yearly rotation of customer master keys (CMKs) (A). KMS is a regional service, meaning CMKs are tied to a specific AWS Region (D). Option B is incorrect because KMS supports both symmetric and asymmetric encryption. Option C is incorrect because KMS does not store encrypted data; it manages encryption keys. Option E is incorrect because you can import your own key material into KMS using the 'import key material' feature.

Answer

KMS uses symmetric encryption only.

Answer

KMS can store encrypted data.

Answer

You cannot import your own key material into KMS.

Question 13

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that all outbound traffic is logged and that only specific destinations are allowed. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in a public subnet and enable VPC Flow Logs. A NAT gateway in a public subnet allows outbound internet access from private instances, and VPC Flow Logs can capture traffic metadata. Option B is wrong because a proxy server in a public subnet requires additional configuration and is not the default AWS solution. Option C is wrong because a NAT instance can also work but requires manual management and does not inherently provide logging; Flow Logs still need to be enabled. Option D is wrong because an internet gateway alone does not provide private subnet access.

Answer

Deploy a proxy server in a public subnet and configure the EC2 instance to use it

Answer

Deploy a NAT instance in a public subnet and enable VPC Flow Logs

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance

Question 14

A security engineer is designing a network architecture for a multi-account AWS environment using AWS Organizations. The company requires that all inter-VPC traffic be inspected by a centralized firewall appliance. Which solution provides the most scalable and maintainable inspection architecture?

Accepted Answer

Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall. Using a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall provides a scalable and maintainable architecture. Transit Gateway allows all VPCs to connect through a central hub, and AWS Network Firewall provides managed, scalable deep packet inspection. Option B is incorrect because VPC peering does not scale well and requires complex routing. Option C is incorrect because Network ACLs are stateless and cannot perform deep packet inspection. Option D is incorrect because third-party firewall appliances in a single VPC can become a bottleneck and are less scalable than the managed AWS Network Firewall solution.

Answer

Create VPC peering connections between all VPCs and route traffic through a security VPC with a firewall

Answer

Use Network ACLs in each VPC to filter traffic between subnets

Answer

Use a Transit Gateway and attach all VPCs to a centralized inspection VPC that hosts a third-party firewall

Question 15

Which THREE components are necessary to enable encryption in transit for traffic between an on-premises data center and an Amazon VPC over AWS Site-to-Site VPN? (Choose three.)

Accepted Answer

A customer gateway (CGW) in the on-premises network. The correct answers are A, D, and E. A customer gateway (CGW) represents the on-premises device, a virtual private gateway (VGW) is the AWS endpoint, and an IPsec VPN tunnel between them provides encryption in transit. Option B is wrong because an internet gateway is used for internet connectivity, not VPN. Option C is wrong because SSL/TLS is not used for Site-to-Site VPN; it uses IPsec with pre-shared keys or certificates.

Answer

An internet gateway (IGW) attached to the VPC

Answer

An SSL/TLS certificate for the VPN tunnel