ANS-C01 Network Security, Compliance and Governance Practice Test 24 — 15 Questions

Question 1

Which TWO AWS services can be used to monitor and log network traffic in a VPC for security analysis? (Choose two.)

Accepted Answer

VPC Flow Logs. Options A and C are correct. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling security analysis of traffic patterns. AWS CloudTrail logs API calls to the AWS Management Console and SDKs, providing visibility into user activity and resource changes. Option B (AWS Config) is incorrect because it evaluates resource configurations for compliance, not network traffic logging. Option D (Amazon Inspector) is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure. Option E (Amazon GuardDuty) is a threat detection service that analyzes data sources like DNS logs and VPC Flow Logs, but it is not itself a logging service for network traffic.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 2

Refer to the exhibit. An AWS IAM policy is attached to an IAM role used by a network administrator. The policy is intended to allow the role to accept a VPC peering connection request only if the accepter VPC is vpc-0abcdef1234567890. However, the administrator reports that the policy does not work as expected. What is the most likely reason?

Accepted Answer

The condition key is misspelled; it should be ec2:AccepterVpc (with capital A). AWS condition keys are case-sensitive. The correct condition key for restricting the accepter VPC is `ec2:AccepterVpc` (with capital A and V). A common mistake is using `ec2:accepterVpc` (lowercase 'a'), which causes the condition to be ignored and the policy to not work as intended. The other options are incorrect: the `ec2:AcceptVpcPeeringConnection` action does not require `ec2:Describe*` permissions; a wildcard in the resource ARN is permissible when the condition restricts access to a specific VPC; and identity-based policies attached to a role do not include a Principal element.

Answer

The policy does not include the ec2:Describe* action, which is required to accept a peering connection

Answer

The resource ARN should include the specific peering connection ID instead of a wildcard

Answer

The Principal element must specify the AWS account ID instead of the IAM role ARN

Question 3

Refer to the exhibit. A network engineer has configured VPC Flow Logs for a VPC and is verifying the logs. The flow logs are being delivered to CloudWatch Logs, but the engineer notices that the logs do not contain the 'srcaddr' and 'dstaddr' fields. What is the most likely cause?

Accepted Answer

The flow log is using the default log format, which does not include source and destination addresses. The default log format for VPC Flow Logs does not include source and destination addresses. To include those fields, you must specify a custom format with `${srcaddr}` and `${dstaddr}`. Since the logs are missing these fields, the flow log is likely using the default format rather than a custom one.

Answer

The flow log is configured with TrafficType set to 'REJECT' only

Answer

The IAM role FlowLogRole does not have permission to write to CloudWatch Logs

Answer

The flow log is configured with a MaxAggregationInterval of 60 seconds, which causes fields to be omitted

Question 4

Refer to the exhibit. A company has an S3 bucket policy that allows public read access only from a specific IP range (203.0.113.0/24). Users outside this range report that they can still access objects in the bucket. What is the most likely reason?

Accepted Answer

The bucket also has a bucket ACL that grants public read access, overriding the policy condition. The most likely reason is that the bucket also has a bucket ACL that grants public read access. When both a bucket policy and an ACL are present, the effective permissions are the union of allowed actions. If the ACL allows everyone to read objects, then the IP restriction in the bucket policy is not effective because the ACL already permits the access. Option D correctly identifies this scenario. Option A is incorrect because the condition key for source IP is aws:SourceIp, not aws:SourceIpAddress, but that is a minor typo; however, the policy would still be evaluated. Option B is incorrect because bucket policies are evaluated regardless of region. Option C is incorrect because server-side encryption does not affect policy evaluation.

Answer

The bucket policy uses the wrong condition key; it should be aws:SourceIpAddress

Answer

The bucket policy is not being evaluated because the bucket is in a different region

Answer

The bucket is configured with server-side encryption, which prevents the policy from being applied

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to avoid using a NAT gateway and ensure that traffic does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and update the route table. The correct solution is to create a VPC endpoint for S3 (Gateway type) and update the route table. This allows the EC2 instance in the private subnet to access S3 privately without traversing the internet or using a NAT gateway. Option A is incorrect because attaching an internet gateway and assigning a public IP would expose the instance to the internet. Option C is incorrect because a VPN connection is not necessary for S3 access and would involve additional complexity. Option D is incorrect because a NAT gateway would route traffic through the internet, which the company wants to avoid.

Answer

Attach an internet gateway to the VPC and assign a public IP to the instance

Answer

Set up a VPN connection to the S3 bucket

Answer

Deploy a NAT gateway in the public subnet and route traffic through it

Question 6

A security team is designing a network architecture that must meet PCI DSS compliance. They have a VPC with multiple subnets and need to ensure that all traffic between subnets is inspected by a stateful firewall. The solution must also support scalability and high availability. Which AWS service should they use?

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides stateful inspection, scales automatically, and supports high availability, making it suitable for PCI DSS compliance. Option B (security groups) is wrong because security groups are stateful but operate at the instance level and do not provide centralized traffic inspection between subnets. Option C (AWS WAF) is wrong because it focuses on web application layer (HTTP/S) traffic, not network-layer inspection. Option D (Network ACLs) is wrong because they are stateless and only provide basic allow/deny rules without stateful inspection.

Answer

Security groups on each subnet

Answer

AWS WAF

Answer

Network ACLs on each subnet

Question 7

A company uses AWS Organizations and has multiple VPCs in different accounts. They want to centrally manage network firewall rules for all VPCs using a single firewall policy. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager allows you to centrally manage firewall rules across accounts and VPCs. Option B is wrong because Network Firewall is a per-VPC service. Option C is wrong because Shield is for DDoS. Option D is wrong because WAF is for web ACLs, not network firewalls.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 8

A company wants to encrypt all data in transit between its on-premises data center and AWS. They are using AWS Direct Connect for connectivity. Which additional configuration is required to ensure encryption?

Accepted Answer

Set up an IPsec VPN over the Direct Connect connection. Direct Connect does not provide encryption by default. To encrypt data in transit over Direct Connect, you need to set up an IPsec VPN over the Direct Connect connection. Option A is incorrect because MACsec encrypts at Layer 2, but it is not available on all Direct Connect connections and is different from IPsec. Option B is incorrect because TLS is for application-level encryption, which may not cover all traffic. Option C is incorrect because Direct Connect does not encrypt traffic automatically. Therefore, option D is correct.

Answer

Use MACsec to encrypt the Direct Connect connection

Answer

Configure TLS on all applications

Answer

No additional configuration is needed; Direct Connect encrypts traffic automatically

Question 9

Which TWO measures can be taken to protect an AWS account's root user credentials? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use that instead of the root user. Options A and D are correct. Creating an IAM user with administrative privileges allows you to avoid using the root user for daily tasks, which is a best practice. Enabling MFA on the root user adds an extra layer of security. Option B is incorrect because using the root user for daily administrative tasks increases risk and violates security best practices. Option C is incorrect because the root user cannot be deleted. Option E is incorrect because storing credentials in a shared password manager is insecure and not recommended.

Answer

Use the root user for daily administrative tasks

Answer

Delete the root user account after creating IAM users

Answer

Store the root user credentials in a shared password manager

Question 10

Which THREE components are required to enable AWS Shield Advanced automatic application layer DDoS mitigation for an Application Load Balancer? (Choose three.)

Accepted Answer

AWS Shield Advanced subscription. Options A, D, and E are correct. AWS Shield Advanced requires an active subscription (A) to enable automatic application layer DDoS mitigation. It integrates with AWS WAF, so a web ACL (E) must be associated with the ALB, and a rate-based rule (D) is needed to trigger automatic mitigation. Option B (CloudFront) is not required because Shield Advanced can directly protect ALBs without a CDN. Option C (Route53) is also not required for this specific feature.

Answer

Amazon CloudFront distribution in front of the ALB

Answer

Amazon Route53 DNS configuration

Question 11

A company wants to block outbound traffic from a VPC to the internet except through a NAT Gateway for updates to specific software repositories. Which AWS service should be used to control outbound traffic?

Accepted Answer

Network ACLs. Network ACLs can be attached to subnets to control inbound and outbound traffic at the subnet level, and can be used to block outbound internet traffic except through the NAT Gateway. Option A is wrong because Security Groups are stateful and cannot block outbound traffic based on destination IP ranges in a granular manner. Option B is wrong because Route Tables control routing, not filtering. Option C is wrong because VPC Endpoints are for private connectivity to AWS services, not for controlling outbound internet traffic.

Answer

Security Groups

Answer

Route Tables

Answer

VPC Endpoints

Question 12

A security team needs to log all rejected traffic to an internet-facing Network Load Balancer (NLB) for compliance. Which configuration should they use?

Accepted Answer

Enable access logs on the NLB. NLB access logs capture information about rejected traffic when enabled. Option A is wrong because VPC Flow Logs do not capture traffic that is rejected by the NLB itself before reaching the target. Option B is wrong because CloudTrail logs API calls, not network traffic. Option C is wrong because ALB is a different load balancer type and does not apply to NLB.

Answer

Enable VPC Flow Logs on the NLB subnets

Answer

Enable AWS CloudTrail for the NLB

Answer

Enable access logs on an Application Load Balancer in front of the NLB

Question 13

A company has a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets are encrypted with SSE-KMS using a specific KMS key. Which policy should they use?

Accepted Answer

SCP in AWS Organizations. A Service Control Policy (SCP) in AWS Organizations can be attached to the root or an OU to deny the creation of S3 buckets that do not use a specific KMS key for encryption. This is a preventive control that applies across all accounts in the organization. Option A (S3 bucket policy) is incorrect because bucket policies are applied at the bucket level after creation and cannot prevent the creation of the bucket. Option B (IAM policy) is incorrect because IAM policies are per-account and cannot be enforced centrally across all accounts. Option C (AWS Config rule with auto-remediation) is incorrect because Config rules are detective and can only trigger remediation after a non-compliant bucket is created, not prevent the creation.

Answer

S3 bucket policy on each bucket

Answer

IAM policy in each account

Answer

AWS Config rule with auto-remediation

Question 14

A company has a VPC peered with another VPC in a different account. They want to ensure that only specific ports are allowed from the peered VPC to their application servers. Which configuration should they use?

Accepted Answer

Configure a Security Group rule with the security group ID of the peered VPC. You can reference a security group from a peered VPC as the source in a security group rule, allowing fine-grained control based on the security group ID rather than CIDR blocks. Option A is wrong because VPC peering route tables control routing, not traffic filtering. Option B is wrong because security groups can reference the CIDR of a peered VPC, but that does not allow specifying individual ports from the peered VPC's resources; it's less specific than referencing the security group ID. Option D is wrong because Network ACLs cannot reference security groups; they only allow CIDR-based rules, and they are stateless.

Answer

Use a VPC peering route table to restrict traffic

Answer

Configure a Security Group rule with the CIDR of the peered VPC

Answer

Configure a Network ACL rule with the CIDR of the peered VPC

Question 15

A company is using AWS Direct Connect to connect their on-premises network to AWS. They need to ensure that traffic from a specific on-premises subnet can only access a specific VPC subnet. Which two components must be configured? (Choose two.)

Accepted Answer

Route tables with specific routes. To restrict traffic from a specific on-premises subnet to a specific VPC subnet using AWS Direct Connect, you need two components. First, a private virtual interface (VIF) is required because it provides connectivity to VPCs (as opposed to public or transit VIFs). Second, route tables with specific routes must be configured on both the on-premises router and the VPC route tables to ensure that traffic is directed to the correct destination subnet. Option B (Route tables with specific routes) and Option D (Private virtual interface) are correct. Option A (VPN connection) is not needed because Direct Connect itself provides the private connectivity. Option C (Public virtual interface) is incorrect as it is used for accessing public AWS endpoints, not VPC subnets. Option E (Transit virtual interface) is used for connecting to multiple VPCs via a transit gateway, not for a single VPC subnet.

Answer

VPN connection

Answer

Public virtual interface (VIF)

Answer

Transit virtual interface (VIF)