ANS-C01 Network Security, Compliance and Governance Practice Test 24 — 15 Questions

Question 1

A company wants to encrypt all data in transit between its on-premises data center and AWS. They are using AWS Direct Connect for connectivity. Which additional configuration is required to ensure encryption?

Accepted Answer

Set up an IPsec VPN over the Direct Connect connection. Option C is correct. Direct Connect does not provide encryption by default; you need to establish an IPsec VPN over the Direct Connect connection. Option A is wrong because Direct Connect itself does not encrypt. Option B is wrong because TLS is for application-level. Option D is wrong because MACsec is for encryption of Direct Connect at Layer 1, but it is not commonly used; IPsec is the standard.

Answer

Use MACsec to encrypt the Direct Connect connection

Answer

Configure TLS on all applications

Answer

No additional configuration is needed; Direct Connect encrypts traffic automatically

Question 2

Which TWO measures can be taken to protect an AWS account's root user credentials? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use that instead of the root user. Options B and D are correct. Enabling MFA and creating an IAM admin user are best practices. Option A is wrong because using root user regularly is not recommended. Option C is wrong because deleting the root user is not possible. Option E is wrong because sharing credentials is insecure.

Answer

Use the root user for daily administrative tasks

Answer

Delete the root user account after creating IAM users

Answer

Store the root user credentials in a shared password manager

Question 3

Which THREE components are required to enable AWS Shield Advanced automatic application layer DDoS mitigation for an Application Load Balancer? (Choose three.)

Accepted Answer

AWS Shield Advanced subscription. Options A, B, and C are correct. Shield Advanced integrates with WAF for automatic mitigation, requires a web ACL, and must be associated with the ALB. Option D is wrong because CloudFront is not required. Option E is wrong because Route53 is not required.

Answer

Amazon CloudFront distribution in front of the ALB

Answer

Amazon Route53 DNS configuration

Question 4

A company has a VPC with a public subnet containing a NAT gateway and a private subnet with EC2 instances. The EC2 instances need to access an S3 bucket. The security team wants to log all S3 API calls made by the instances. Which approach should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and enable AWS CloudTrail to log S3 API calls. Option B is correct. VPC endpoint for S3 with bucket policies and CloudTrail can log API calls. Option A is wrong because Flow Logs capture network traffic, not API calls. Option C is wrong because a proxy would add complexity. Option D is wrong because CloudWatch alone does not log API calls.

Answer

Enable Amazon CloudWatch Logs on the instances to capture application logs

Answer

Configure a proxy server in the public subnet and use it for S3 access

Answer

Enable VPC Flow Logs on the private subnet

Question 5

A company wants to block outbound traffic from a VPC to the internet except through a NAT Gateway for updates to specific software repositories. Which AWS service should be used to control outbound traffic?

Accepted Answer

Network ACLs. Option B is correct because Network ACLs can be attached to subnets to control inbound and outbound traffic at the subnet level, and can be used to block outbound internet traffic except through the NAT Gateway. Option A is wrong because VPC endpoints are for private connectivity to AWS services, not for controlling outbound internet traffic. Option C is wrong because Security Groups are stateful and cannot block outbound traffic based on destination IP ranges in a granular manner. Option D is wrong because Route Tables control routing, not filtering.

Answer

Security Groups

Answer

Route Tables

Answer

VPC Endpoints

Question 6

A security team needs to log all rejected traffic to an internet-facing Network Load Balancer (NLB) for compliance. Which configuration should they use?

Accepted Answer

Enable access logs on the NLB. Option D is correct because NLB access logs capture information about rejected traffic when enabled. Option A is wrong because VPC Flow Logs do not capture traffic that is rejected by the NLB itself before reaching the target. Option B is wrong because CloudTrail logs API calls, not network traffic. Option C is wrong because ALB is a different load balancer type and does not apply to NLB.

Answer

Enable VPC Flow Logs on the NLB subnets

Answer

Enable AWS CloudTrail for the NLB

Answer

Enable access logs on an Application Load Balancer in front of the NLB

Question 7

A company has a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets are encrypted with SSE-KMS using a specific KMS key. Which policy should they use?

Accepted Answer

SCP in AWS Organizations. Option C is correct because a Service Control Policy (SCP) can be applied at the organizational unit level to deny creation of S3 buckets that do not have the required encryption. Option A is wrong because IAM policies are per account and not centrally enforceable across all accounts. Option B is wrong because bucket policies are per bucket and cannot prevent creation. Option D is wrong because AWS Config rules can detect non-compliant buckets after creation but cannot prevent creation.

Answer

S3 bucket policy on each bucket

Answer

IAM policy in each account

Answer

AWS Config rule with auto-remediation

Question 8

A company has a VPC peered with another VPC in a different account. They want to ensure that only specific ports are allowed from the peered VPC to their application servers. Which configuration should they use?

Accepted Answer

Configure a Security Group rule with the security group ID of the peered VPC. Option B is correct because Security Groups can reference a peered VPC security group as a source, allowing fine-grained control. Option A is wrong because Security Groups cannot reference a CIDR block of a peered VPC directly. Option C is wrong because Network ACLs are stateless and require rules in both directions, and they cannot reference security groups. Option D is wrong because VPC peering does not have built-in filtering; you need security groups or NACLs.

Answer

Use a VPC peering route table to restrict traffic

Answer

Configure a Security Group rule with the CIDR of the peered VPC

Answer

Configure a Network ACL rule with the CIDR of the peered VPC

Question 9

A company is using AWS Direct Connect to connect their on-premises network to AWS. They need to ensure that traffic from a specific on-premises subnet can only access a specific VPC subnet. Which two components must be configured? (Choose two.)

Accepted Answer

Route tables with specific routes. Options A and D are correct. A private VIF is required for accessing VPCs, and a route table with specific routes ensures traffic from the on-premises subnet is directed to the correct VPC subnet. Option B is wrong because a public VIF is for public AWS endpoints. Option C is wrong because a VPN connection is not needed with Direct Connect. Option E is wrong because a transit VIF is for connecting to multiple VPCs via a transit gateway, not for a single VPC subnet.

Answer

VPN connection

Answer

Public virtual interface (VIF)

Answer

Transit virtual interface (VIF)

Question 10

A company needs to audit all changes to security groups in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls, including changes to security groups. Option A is wrong because AWS Config records resource configuration changes but is not primarily for auditing API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because CloudWatch Logs stores logs but does not capture API calls by default.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 11

A company has a VPC with multiple subnets. They want to block all traffic from the internet to their private subnets, but allow outbound internet traffic from those subnets through a NAT Gateway. Which configuration should they use?

Accepted Answer

Route table with 0.0.0.0/0 -> NAT Gateway. Option B is correct because a route table associated with the private subnets should have a default route (0.0.0.0/0) pointing to the NAT Gateway. Option A is wrong because a public subnet route to an Internet Gateway would allow inbound traffic. Option C is wrong because a route to a Virtual Private Gateway is for VPN connections. Option D is wrong because a route to a VPC peering connection is for peered VPCs.

Answer

Route table with 0.0.0.0/0 -> Virtual Private Gateway

Answer

Route table with 0.0.0.0/0 -> VPC Peering Connection

Answer

Route table with 0.0.0.0/0 -> Internet Gateway

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a security appliance in a centralized inspection VPC. How should they configure the Transit Gateway route tables?

Accepted Answer

Associate all VPCs with a single route table that has a default route pointing to the inspection VPC attachment, and enable route propagation from the inspection VPC. Option D is correct because using separate route tables for each VPC with a blackhole route pointing to the inspection VPC is not standard; the correct approach is to have a shared route table that propagates routes and uses a static route to the inspection VPC. Option D is correct: associate all VPCs with a single route table that has a default route pointing to the inspection VPC's attachment, and enable route propagation from the inspection VPC. Option A is wrong because it does not force traffic through the inspection VPC. Option B is wrong because it only inspects traffic from one VPC. Option C is wrong because a blackhole route drops traffic.

Answer

Create a route table for the inspection VPC and add blackhole routes for all other VPCs

Answer

Use one route table with all VPC attachments and enable route propagation for all attachments

Answer

Create separate route tables for each VPC and add a static route to the inspection VPC

Question 13

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which type of policy should they use?

Accepted Answer

S3 bucket policy with aws:SourceVpce condition. Option B is correct because S3 bucket policies can use conditions like aws:SourceVpce to restrict access to a specific VPC endpoint. Option A is wrong because IAM policies are for users/roles, not network-level restrictions. Option C is wrong because bucket policies cannot use aws:SourceIp for VPC endpoint traffic. Option D is wrong because VPC endpoint policies apply to the endpoint itself, not to the S3 bucket.

Answer

S3 bucket policy with aws:SourceIp condition

Answer

IAM policy

Answer

VPC endpoint policy

Question 14

A security engineer notices that an EC2 instance in a public subnet is receiving inbound SSH traffic from a range of IP addresses that should be blocked. Which two actions should the engineer take to troubleshoot? (Choose two.)

Accepted Answer

Review the Security Group rules attached to the instance. Options A and D are correct. Checking VPC Flow Logs helps identify the source IP of the traffic. Reviewing Security Group rules ensures that the security group is not allowing the unwanted SSH traffic. Option B is wrong because Network ACLs are stateless and might be blocking, but they are not the first place to check for inbound traffic to an instance. Option C is wrong because the route table does not affect inbound traffic to the instance. Option E is wrong because the instance metadata does not contain network access rules.

Answer

Check the instance metadata for IP restrictions

Answer

Check the route table associated with the subnet

Answer

Check the Network ACL associated with the subnet

Question 15

A company has a VPC with an internet-facing Application Load Balancer (ALB) that routes traffic to EC2 instances in private subnets. The security team wants to block traffic from specific geographic regions. Which AWS service should they use?

Accepted Answer

AWS WAF. Option A is correct because AWS WAF can be associated with an ALB to filter traffic based on geographic location. Option B is wrong because Security Groups do not support geographic blocking. Option C is wrong because Network ACLs do not support geographic blocking. Option D is wrong because AWS Shield Advanced provides DDoS protection, not geographic filtering.

Answer

AWS Shield Advanced

Answer

Network ACLs

Answer

Security Groups