ANS-C01 Network Security, Compliance and Governance Practice Test 25 — 15 Questions

Question 1

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized security appliance running in a security VPC. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach the VPCs to the Transit Gateway and configure route tables to send inter-VPC traffic to the security VPC via a route pointing to the security VPC's attachment.. The correct approach is to use AWS Transit Gateway route tables to steer inter-VPC traffic through a security VPC. By associating VPC attachments with a TGW route table and adding a route that points to the security VPC's attachment, all traffic between VPCs is forced through the security appliance for inspection. This leverages TGW's native routing capabilities and supports centralized security without modifying individual VPC route tables or using complex peering meshes.

Answer

Configure network ACLs in each VPC to deny traffic directly between VPCs.

Answer

Create VPC peering connections between each VPC and the security VPC, then update route tables.

Answer

Use NAT gateways in each VPC to route traffic through the security VPC.

Question 2

A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block a list of known malicious IP addresses from accessing the application. Which service should they use to implement this protection?

Accepted Answer

AWS WAF with an IP set rule that blocks the malicious IPs. AWS WAF integrates directly with ALB and supports IP set match rules that can block specified IP addresses at Layer 7. The security team can create an IP set containing the malicious addresses and attach a WAF Web ACL to the ALB with a block action. This is the native, scalable way to block IPs on an ALB.

Answer

Network ACLs on the ALB subnet with deny rules

Answer

AWS Shield Advanced with automatic IP blocking

Answer

Security Groups for the ALB with deny rules

Question 3

A company is designing a multi-account architecture using AWS Organizations. They want to centrally manage and enforce network security policies across all accounts. Which THREE services or features should they use together to achieve this? (Choose THREE.)

Accepted Answer

AWS Network Firewall. AWS Firewall Manager (E) is the central management service that lets the organization deploy and enforce firewall rules, including AWS Network Firewall policies, consistently across all accounts in AWS Organizations, which directly satisfies the requirement for centralized network security policy management. AWS Network Firewall (A) provides the actual managed, stateful network filtering (VPC-level traffic inspection, domain filtering, IPS) that Firewall Manager deploys and enforces across accounts. Service Control Policies (B) are an AWS Organizations feature that sets permission guardrails at the OU/account level, preventing accounts from disabling or altering the required security configurations, thereby enforcing policy compliance organization-wide. Security Groups (C) are account- and resource-level stateful instance firewalls and are not a central multi-account policy mechanism, so they do not meet the cross-account enforcement requirement. AWS Config (D) is a resource-configuration recording and compliance-evaluation service, not a network security policy enforcement tool, so it does not provide the centralized network filtering and guardrails described.

Answer

Security Groups

Answer

AWS Config

Question 4

A company has a requirement to encrypt all data in transit between its on-premises network and AWS over a VPN connection. Which solution provides encryption in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (option A) is correct because it creates an IPsec VPN tunnel between the on-premises network and AWS, encrypting all data in transit over the public internet. IPsec provides confidentiality and integrity for traffic traversing the VPN connection. AWS Transit Gateway (B) is a network hub for connecting VPCs and on-premises networks but does not itself encrypt traffic. VPC Peering (C) connects VPCs privately but provides no encryption in transit. AWS Direct Connect (D) is a dedicated private network connection that does not encrypt traffic by default.

Answer

AWS Transit Gateway

Answer

VPC Peering

Answer

AWS Direct Connect

Question 5

A security engineer needs to allow an EC2 instance in a private subnet to access an S3 bucket without traversing the internet. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC gateway endpoint for S3 provides private connectivity from a VPC to S3 without requiring an internet gateway, NAT device, or public IP. It works by adding a prefix list route in the route table that directs S3 traffic to the gateway endpoint, keeping traffic on the AWS network. This meets the requirement of accessing S3 without traversing the internet from a private subnet.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use AWS Direct Connect to connect to S3.

Answer

Deploy a NAT gateway in a public subnet and update the route table.

Question 6

A company wants to centrally manage and enforce security rules for all VPCs in a multi-account environment. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct choice because it provides centralized management of firewall rules across multiple accounts and VPCs in an AWS Organization. It allows you to enforce a common set of security policies, such as AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules, ensuring consistent governance across all VPCs in the multi-account environment.

Answer

Amazon GuardDuty

Answer

AWS Shield

Answer

AWS WAF

Question 7

A company needs to ensure that all API calls to AWS services are logged and monitored for suspicious activity. Additionally, any API call that creates a security group rule should trigger an immediate notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail records all API calls made to AWS services, including those that create or modify security group rules. Amazon CloudWatch Events (now Amazon EventBridge) can match specific API events, such as AuthorizeSecurityGroupIngress, and trigger immediate notifications via SNS or Lambda. Together, they provide comprehensive logging and real-time alerting for suspicious activity.

Answer

VPC Flow Logs and Amazon CloudWatch

Answer

AWS Config and Amazon SNS

Answer

AWS Shield and AWS WAF

Question 8

Which TWO actions should be taken to secure a VPC that hosts a web application? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for S3 to allow private access.. Option D is correct because Security Groups act as stateful virtual firewalls at the instance/ENI level, and restricting inbound rules to only the required ports, protocols, and source CIDRs (e.g., 443 from the load balancer) follows least-privilege and minimizes the attack surface of the web application. Option C is correct because a VPC Gateway Endpoint provides private connectivity to Amazon S3 over the AWS backbone, keeping S3 traffic off the public internet and avoiding the need for NAT gateways, internet gateways, or public IPs for that access. Option A is incorrect because allowing all ICMP from the internet unnecessarily exposes the VPC to reconnaissance and ping-based probing rather than securing it. Option B is incorrect because pointing the default route 0.0.0.0/0 to a virtual private gateway routes internet-bound traffic to a VPN connection instead of the internet gateway, which is not a security hardening action for a public web app. Option E is incorrect because allowing all outbound traffic violates least privilege and permits unrestricted egress, which is not a recommended security control.

Answer

Allow all ICMP traffic from the internet to the VPC.

Answer

Set the default route (0.0.0.0/0) to a virtual private gateway.

Answer

Allow all outbound traffic from the application instances.

Question 9

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Accepted Answer

AWS Firewall Manager. AWS Shield Advanced (C) is the primary AWS service purpose-built for DDoS detection and mitigation, providing enhanced protection for resources like CloudFront, Route 53, and ELB with 24/7 access to the AWS DDoS Response Team and real-time attack diagnostics. AWS WAF (D) protects against application-layer (Layer 7) DDoS attacks such as HTTP floods by filtering malicious web requests using customizable rules, rate-based rules, and managed rule groups. AWS Firewall Manager (A) centrally manages and enforces AWS WAF, Shield Advanced, and security group policies across accounts in an AWS Organization, enabling consistent DDoS protection deployment at scale. AWS Config (B) is a configuration compliance and auditing service that records resource changes but does not detect or mitigate DDoS traffic. VPC Flow Logs (E) capture IP traffic metadata for network monitoring and forensics, but they are a logging feature, not a protective or DDoS-mitigation service.

Answer

AWS Config

Answer

VPC Flow Logs

Question 10

Refer to the exhibit. A security engineer applies this S3 bucket policy. What is the result of this policy?

Accepted Answer

All PutObject requests must use SSE-KMS encryption.. The bucket policy shown in the exhibit includes a condition that requires PutObject requests to use SSE-KMS encryption (e.g., 's3:x-amz-server-side-encryption' equals 'aws:kms'). If the policy denies PutObject when the encryption header is not SSE-KMS, then all PutObject requests must use SSE-KMS to succeed. This is a common pattern to enforce a specific encryption type at the bucket level.

Answer

All objects must be encrypted with SSE-S3 or SSE-KMS.

Answer

All objects must be encrypted with a specific KMS key.

Answer

All PutObject requests are allowed regardless of encryption.

Question 11

Refer to the exhibit. A network engineer reviews the NACL entries for a subnet. What is the effect of this NACL on inbound traffic?

Accepted Answer

Only SSH from the internal network and HTTPS from any IP are allowed.. Inbound rules: Rule 100 allows SSH from 10.0.0.0/16 (internal network). Rule 200 allows HTTPS from 0.0.0.0/0 (any IP). Rule 300 (implicit deny) denies all other inbound traffic. Therefore, only SSH from the internal network and HTTPS from any IP are allowed. Option B is incorrect because not all inbound traffic is allowed; SSH from external networks is denied. Option C is incorrect because HTTPS is allowed from anywhere. Option D is incorrect because the NACL does not deny all traffic; it allows specific traffic.

Answer

All inbound traffic is allowed.

Answer

Only HTTPS traffic is allowed from any IP.

Answer

All inbound traffic is denied.

Question 12

A company has a VPC with public and private subnets. They launch an Application Load Balancer (ALB) in the public subnets and targets in private subnets. Security requirements dictate that the targets should only accept traffic from the ALB. Which security group configuration meets this requirement?

Accepted Answer

Set the target security group inbound rule to allow HTTP from the ALB security group ID.. Referencing the ALB security group by ID in the target security group inbound rule allows traffic only from that specific security group, ensuring that only the ALB can reach the targets. This is a best practice for securing traffic between an ALB and its targets. Option A is incorrect because allowing HTTP from 0.0.0.0/0 would permit traffic from any source, not just the ALB. Option C is incorrect because the ALB's traffic originates from its elastic network interfaces (ENIs), which are associated with the ALB security group, not a fixed public IP. Option D is incorrect because allowing traffic from the entire VPC CIDR would permit any resource in the VPC to reach the targets, not just the ALB.

Answer

Set the target security group inbound rule to allow HTTP from 0.0.0.0/0.

Answer

Set the target security group inbound rule to allow HTTP from the ALB's public IP address.

Answer

Set the target security group inbound rule to allow HTTP from the VPC CIDR.

Question 13

A company is designing a network security architecture for a multi-account AWS environment. They need to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which AWS service should they use to route traffic through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks, allowing traffic to be routed through a centralized inspection VPC. It supports route tables and appliance mode, enabling traffic to be redirected to a third-party firewall appliance for inspection.

Answer

VPC Peering

Answer

AWS Direct Connect

Answer

VPC Endpoints

Question 14

A company uses AWS Shield Advanced and AWS WAF to protect its web application. The security team notices that some legitimate traffic is being blocked. They want to allow traffic from a specific set of IP addresses used by their partners. How can they ensure that partner traffic is not blocked by WAF rules?

Accepted Answer

Create a WAF IP set and add a rule to allow traffic from that IP set, with a higher priority than blocking rules.. AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF. Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.

Answer

Add the partner IPs to a Network ACL allow rule in the VPC.

Answer

Remove the blocking WAF rules and rely on Shield Advanced only.

Answer

Add the partner IPs to an AWS Shield Advanced IP whitelist.

Question 15

A company wants to audit all changes to security groups in their AWS account. Which AWS service should they use to track API calls that modify security groups?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including the identity of the caller, the time of the call, the source IP, and the request parameters. Security group modifications (AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, etc.) are API calls, so CloudTrail is the correct service to audit who changed what and when.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs