ANS-C01 Network Security, Compliance and Governance Practice Test 25 — 15 Questions

Question 1

A company has a VPC with multiple subnets. They want to block all traffic from the internet to their private subnets, but allow outbound internet traffic from those subnets through a NAT Gateway. Which configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route table with 0.0.0.0/0 -> NAT Gateway. A route table associated with the private subnets should have a default route (0.0.0.0/0) pointing to the NAT Gateway. This allows outbound internet traffic while blocking inbound internet traffic. Option B (Virtual Private Gateway) is for VPN connections. Option C (VPC Peering) is for connectivity between VPCs. Option D (Internet Gateway) would allow inbound internet traffic, which is not desired.

Answer

Route table with 0.0.0.0/0 -> Virtual Private Gateway

Answer

Route table with 0.0.0.0/0 -> VPC Peering Connection

Answer

Route table with 0.0.0.0/0 -> Internet Gateway

Question 2

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a security appliance in a centralized inspection VPC. How should they configure the Transit Gateway route tables?

Accepted Answer

Associate all VPCs with a single route table that has a default route pointing to the inspection VPC attachment, and enable route propagation from the inspection VPC. Using separate route tables for each VPC with a blackhole route pointing to the inspection VPC is not standard; the correct approach is to have a shared route table that propagates routes and uses a static route to the inspection VPC. Option D is correct: associate all VPCs with a single route table that has a default route pointing to the inspection VPC's attachment, and enable route propagation from the inspection VPC. Option A is wrong because it does not force traffic through the inspection VPC. Option B is wrong because it only inspects traffic from one VPC. Option C is wrong because a blackhole route drops traffic.

Answer

Create a route table for the inspection VPC and add blackhole routes for all other VPCs

Answer

Use one route table with all VPC attachments and enable route propagation for all attachments

Answer

Create separate route tables for each VPC and add a static route to the inspection VPC

Question 3

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which type of policy should they use?

Accepted Answer

S3 bucket policy with aws:SourceVpce condition. S3 bucket policies can use the aws:SourceVpce condition key to restrict access to requests originating from a specific VPC endpoint. Option B is incorrect because aws:SourceIp condition is not effective for traffic coming through a VPC endpoint, as the source IP is the endpoint's private IP, not the client's IP. Option C is incorrect because IAM policies control user and role permissions, not network-level access control. Option D is incorrect because VPC endpoint policies control what actions can be performed via the endpoint, but they do not replace bucket policies for restricting access to the S3 bucket itself.

Answer

S3 bucket policy with aws:SourceIp condition

Answer

IAM policy

Answer

VPC endpoint policy

Question 4

A security engineer notices that an EC2 instance in a public subnet is receiving inbound SSH traffic from a range of IP addresses that should be blocked. Which two actions should the engineer take to troubleshoot? (Choose two.)

Accepted Answer

Review the Security Group rules attached to the instance. Options C and E are correct. Reviewing Security Group rules helps determine if the security group is allowing SSH traffic from the unwanted IPs. Checking VPC Flow Logs can reveal the actual source IP addresses of the traffic. Option A is incorrect because instance metadata does not contain network access rules. Option B is incorrect because the route table determines routing, not access control. Option D is incorrect because while Network ACLs can block traffic, they are stateless and affect the entire subnet; the first check should be the security group attached to the instance.

Answer

Check the instance metadata for IP restrictions

Answer

Check the route table associated with the subnet

Answer

Check the Network ACL associated with the subnet

Question 5

A company is using AWS Client VPN to provide remote access to their VPC. They want to ensure that only authenticated users from their corporate Active Directory can access the VPN. Which authentication method should they use?

Accepted Answer

SAML-based federated authentication. AWS Client VPN supports SAML-based federated authentication, which can integrate with your corporate Active Directory to authenticate users. Option A is wrong because IAM authorization is not an authentication method for Client VPN; it is used for controlling access to AWS APIs. Option C is wrong because certificate-based authentication uses client certificates and does not directly tie to Active Directory user identities. Option D is wrong because mutual authentication still relies on certificates and does not inherently provide integration with Active Directory.

Answer

IAM authorization

Answer

Certificate-based authentication using AWS Certificate Manager

Answer

Mutual authentication

Question 6

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

Accepted Answer

Remove any inbound rule that allows TCP port 22. Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22. This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs. Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Answer

Add an inbound rule to deny TCP port 22

Answer

Add an inbound deny rule for TCP port 22 to the network ACL

Answer

Add an outbound rule to deny TCP port 22

Question 7

A company uses AWS Transit Gateway to connect multiple VPCs. Security requirements mandate that traffic between VPCs must be inspected by a centralized firewall appliance in a dedicated inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

Accepted Answer

Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment. Configuring Transit Gateway route tables with blackhole routes for inter-VPC traffic forces that traffic to be dropped unless a more specific route exists. By adding a default route pointing to the inspection VPC attachment, all inter-VPC traffic is routed through the inspection VPC for centralized firewall inspection. This approach is efficient and scalable. Option A is incorrect because deploying AWS Network Firewall in each VPC distributes inspection and does not centralize it. Option B is incorrect because Transit Gateway multicast is designed for one-to-many data replication, not for routing traffic through a central inspection point. Option D is incorrect because VPC peering connections do not provide centralized routing control and do not scale well as the number of VPCs increases.

Answer

Deploy AWS Network Firewall in each VPC and configure central logging

Answer

Use Transit Gateway multicast to replicate traffic to the inspection VPC

Answer

Create VPC peering connections between all VPCs and the inspection VPC, then configure route tables to send traffic through the peering connection

Question 8

A company's security team is designing a solution to restrict S3 bucket access based on the requester's network. The company has a set of on-premises IP ranges and wants to ensure that only requests originating from those IPs can access the bucket. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket. To restrict S3 bucket access based on the requester's network, you can use an S3 bucket policy with the aws:SourceIp condition to allow only requests from specified on-premises IP ranges (option E). However, if requests originate from within a VPC, they might appear to come from the VPC's public IPs (e.g., through a NAT gateway) rather than the on-premises IPs. To handle this, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket (option B). This ensures traffic from the VPC to S3 goes through the endpoint and can be controlled separately. Option A is incorrect because using Elastic IPs does not reliably restrict access; the bucket policy would need to allow specific Elastic IPs, but this does not account for on-premises IPs. Option C is incorrect because AWS WAF is for web application traffic, not S3 bucket access. Option D is incorrect because S3 Block Public Access prevents public access but does not restrict based on the requester's network.

Answer

Configure the EC2 instances in the VPC to use Elastic IPs and allow those IPs in the bucket policy

Answer

Use AWS WAF to inspect HTTP requests to the bucket

Answer

Enable S3 Block Public Access on the bucket

Question 9

A company wants to audit all Network Load Balancer (NLB) operations performed in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for all AWS services, including Network Load Balancer (NLB) operations. Therefore, to audit NLB operations, CloudTrail should be used. Option B (Amazon CloudWatch Logs) stores logs but does not natively capture API calls. Option C (AWS Config) tracks resource configurations and changes, not API operations. Option D (VPC Flow Logs) captures network traffic information, not API calls. Hence, Option A is correct.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 10

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables. VPC endpoints for S3 and DynamoDB allow private connectivity without incurring data transfer costs or NAT gateway fees. Option A is wrong because an HTTP proxy adds complexity and cost. Option B is wrong because a NAT instance still incurs instance costs and management overhead. Option D is wrong because a NAT gateway incurs hourly and data processing charges.

Answer

Set up an HTTP proxy in the private subnets and configure the applications to use it

Answer

Use a NAT instance instead of a NAT gateway

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it

Question 11

A security engineer is troubleshooting why an EC2 instance cannot communicate with the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The security group for the instance allows all outbound traffic. What should the engineer check NEXT?

Accepted Answer

Check the network ACL associated with the private subnet. Network ACLs are stateless and must allow both inbound and outbound traffic for the response. Option A is wrong because security group already allows outbound. Option B is wrong because the route is configured. Option D is wrong because flow logs are for analysis, not a next step in troubleshooting connectivity.

Answer

Verify that the security group inbound rules allow return traffic

Answer

Verify that the NAT gateway has an Elastic IP

Answer

Enable VPC Flow Logs to analyze traffic

Question 12

A company wants to restrict access to an S3 bucket so that only requests originating from a specific AWS account can read objects. Which bucket policy condition should be used?

Accepted Answer

aws:SourceAccount. (aws:SourceAccount). The aws:SourceAccount condition key is used in S3 bucket policies to restrict access to requests originating from a specific AWS account. Option A (aws:Referer) is used to restrict based on HTTP referer header, not account. Option B (aws:PrincipalAccount) is not a valid condition key in S3 policies. Option D (aws:SourceArn) restricts based on the ARN of the source resource, not the account. Therefore, Option C is the correct choice.

Answer

aws:Referer

Answer

aws:PrincipalAccount

Answer

aws:SourceArn

Question 13

A company has a VPC with multiple subnets. They want to block all traffic from the internet to their private subnets, but allow outbound internet traffic from those subnets through a NAT Gateway. Which configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The stateless default action is set to drop. Network Firewall evaluates stateless rules first, and a stateless default drop action would drop traffic before stateful rules are considered. Option A is wrong because stateful rules allow all. Option B is wrong because route table directs traffic to firewall. Option D is wrong because AWS Shield is for DDoS protection.

Answer

The stateful rule group has an implicit deny for that IP

Answer

AWS Shield Advanced is blocking the traffic

Answer

The subnet's route table does not have a route to the firewall endpoint

Question 14

A company's security team is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Place application and database servers in private subnets. A public subnet with an Internet Gateway allows web servers to be accessed from the internet. Private subnets isolate application and database tiers from direct internet access. Option A is incorrect because placing application and database servers in a public subnet exposes them to the internet. Option B is incorrect because web servers in a private subnet cannot be reached from the internet; NAT Gateway only provides outbound access. Option E is incorrect because security group rules alone do not provide subnet-level isolation; they are used for instance-level traffic control.

Answer

Place application and database servers in a public subnet with a VPC endpoint

Answer

Place web servers in a private subnet with a NAT Gateway

Answer

Use security group rules to allow traffic only between tiers

Question 15

A company needs to ensure that all outbound internet traffic from a VPC goes through a centralized inspection appliance. The VPC has multiple subnets. Which THREE steps are required to implement this?

Accepted Answer

Configure security groups to allow outbound traffic from the instances. To ensure all outbound internet traffic goes through a centralized inspection appliance, the required steps are: configure security groups to allow outbound traffic (Option A) and launch a NAT gateway in a public subnet with an Elastic IP (Option B) to provide outbound connectivity. The third step, which is not listed among the options, is to route private subnet traffic to the inspection appliance rather than directly to the NAT gateway. Option E is incorrect because routing 0.0.0.0/0 to a NAT gateway would bypass the inspection appliance, failing the requirement.

Answer

Attach an Internet Gateway to the VPC and route all traffic to it

Answer

Create VPC endpoints for all required AWS services

Answer

Configure route tables in each private subnet to send 0.0.0.0/0 traffic to a NAT gateway in a public subnet