ANS-C01 Network Security, Compliance and Governance Practice Test 25 — 15 Questions

Question 1

A company is using AWS Client VPN to provide remote access to their VPC. They want to ensure that only authenticated users from their corporate Active Directory can access the VPN. Which authentication method should they use?

Accepted Answer

SAML-based federated authentication. Option C is correct because AWS Client VPN supports SAML-based federated authentication with Active Directory. Option A is wrong because certificate-based authentication does not tie to Active Directory users. Option B is wrong because mutual authentication still uses certificates. Option D is wrong because IAM authorization is for AWS API access, not VPN authentication.

Answer

IAM authorization

Answer

Certificate-based authentication using AWS Certificate Manager

Answer

Mutual authentication

Question 2

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

Accepted Answer

Remove any inbound rule that allows TCP port 22. Option A is correct because inbound rules are evaluated permissive: denying SSH by not having an allow rule means SSH is implicitly blocked. Option B is wrong because outbound rules control egress, not inbound. Option C is wrong because network ACLs are stateless and require explicit deny rules, but the question asks about security groups. Option D is wrong because only inbound rules affect inbound traffic for security groups.

Answer

Add an inbound rule to deny TCP port 22

Answer

Add an inbound deny rule for TCP port 22 to the network ACL

Answer

Add an outbound rule to deny TCP port 22

Question 3

A company uses AWS Transit Gateway to connect multiple VPCs. Security requirements mandate that traffic between VPCs must be inspected by a centralized firewall appliance in a dedicated inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

Accepted Answer

Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment. Option B is correct because Transit Gateway route tables with blackhole routes for inter-VPC traffic force traffic to the inspection VPC via a default route. Option A is wrong because VPC peering does not scale and lacks centralized inspection. Option C is wrong because it bypasses the firewall. Option D is wrong because Network Firewall can inspect, but the question asks for routing to a firewall appliance in an inspection VPC.

Answer

Deploy AWS Network Firewall in each VPC and configure central logging

Answer

Use Transit Gateway multicast to replicate traffic to the inspection VPC

Answer

Create VPC peering connections between all VPCs and the inspection VPC, then configure route tables to send traffic through the peering connection

Question 4

A company's security team is designing a solution to restrict S3 bucket access based on the requester's network. The company has a set of on-premises IP ranges and wants to ensure that only requests originating from those IPs can access the bucket. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket. Options A and C are correct. A bucket policy with a source IP condition restricts access to requests from specified IPs. A VPC endpoint with a VPC endpoint policy restricting to the bucket ensures that requests from within the VPC (which may have different IPs due to NAT) are only allowed if they come through the endpoint and meet the policy. Option B is wrong because EC2 instance IPs are dynamic. Option D is wrong because it does not restrict IPs. Option E is wrong because AWS WAF is for web traffic, not S3 access control.

Answer

Configure the EC2 instances in the VPC to use Elastic IPs and allow those IPs in the bucket policy

Answer

Use AWS WAF to inspect HTTP requests to the bucket

Answer

Enable S3 Block Public Access on the bucket

Question 5

A company is designing a security group rule to allow outbound HTTPS traffic (TCP 443) to a specific external service IP range 203.0.113.0/24. The security group is attached to a fleet of EC2 instances. Which rule should be added?

Accepted Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/24. Option D is correct because security group outbound rules require a destination CIDR. Option A is wrong because source is for inbound rules. Option B is wrong because security groups do not use prefix lists for destinations. Option C is wrong because the IP range is /24, not /32.

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/32

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: pl-12345 (prefix list for the IP range)

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Source: 203.0.113.0/24

Question 6

A company wants to audit all Network Load Balancer (NLB) operations performed in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls for AWS services, including NLB. Option A is wrong because VPC Flow Logs capture network traffic, not API operations. Option B is wrong because Config records resource configurations, not API calls. Option D is wrong because CloudWatch Logs stores logs but does not capture API calls natively.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 7

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables. Option B is correct because VPC endpoints for S3 and DynamoDB are free to create and avoid NAT gateway costs. Option A is wrong because NAT gateway incurs hourly charges and data processing fees. Option C is wrong because an HTTP proxy is unnecessary and adds complexity. Option D is wrong because it incurs NAT costs.

Answer

Set up an HTTP proxy in the private subnets and configure the applications to use it

Answer

Use a NAT instance instead of a NAT gateway

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it

Question 8

A security engineer is troubleshooting why an EC2 instance cannot communicate with the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The security group for the instance allows all outbound traffic. What should the engineer check NEXT?

Accepted Answer

Check the network ACL associated with the private subnet. Option C is correct because network ACLs are stateless and must allow both inbound and outbound traffic for the response. Option A is wrong because security group already allows outbound. Option B is wrong because the route is configured. Option D is wrong because flow logs are for analysis, not a next step in troubleshooting connectivity.

Answer

Verify that the security group inbound rules allow return traffic

Answer

Verify that the NAT gateway has an Elastic IP

Answer

Enable VPC Flow Logs to analyze traffic

Question 9

A company wants to restrict access to an S3 bucket so that only requests originating from a specific AWS account can read objects. Which bucket policy condition should be used?

Accepted Answer

aws:SourceAccount. Option A is correct because aws:SourceAccount is the condition key for specifying the source account. Option B is wrong because aws:SourceArn is for services like SNS. Option C is wrong because aws:PrincipalAccount is not a valid condition key. Option D is wrong because aws:Referer is for HTTP referer header.

Answer

aws:Referer

Answer

aws:PrincipalAccount

Answer

aws:SourceArn

Question 10

A company has a VPC with multiple subnets and uses AWS Network Firewall to inspect traffic. The security team notices that traffic to a specific IP (10.0.0.10) is being dropped unexpectedly. The firewall policy has a stateful rule group that allows all traffic. What is the MOST likely cause?

Accepted Answer

The stateless default action is set to drop. Option C is correct because Network Firewall evaluates stateless rules first, and a stateless default drop action would drop traffic before stateful rules are considered. Option A is wrong because stateful rules allow all. Option B is wrong because route table directs traffic to firewall. Option D is wrong because AWS Shield is for DDoS protection.

Answer

The stateful rule group has an implicit deny for that IP

Answer

AWS Shield Advanced is blocking the traffic

Answer

The subnet's route table does not have a route to the firewall endpoint

Question 11

A company's security team is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Place application and database servers in private subnets. Options A and D are correct. Public subnets for the web tier allow internet access via an Internet Gateway. Private subnets for app and database tiers isolate them. Option B is wrong because NAT gateway is for outbound internet access, not inbound. Option C is wrong because VPC endpoints are for AWS services, not internet. Option E is wrong because security groups alone do not provide subnet isolation.

Answer

Place application and database servers in a public subnet with a VPC endpoint

Answer

Place web servers in a private subnet with a NAT Gateway

Answer

Use security group rules to allow traffic only between tiers

Question 12

A company needs to ensure that all outbound internet traffic from a VPC goes through a centralized inspection appliance. The VPC has multiple subnets. Which THREE steps are required to implement this?

Accepted Answer

Configure security groups to allow outbound traffic from the instances. Options A, C, and D are correct. An egress-only Internet Gateway is used for IPv6, but for IPv4, the default route points to a NAT gateway or appliance. However, the question implies IPv4; using a NAT gateway is common. Option A (route table) is essential. Option C (security groups) allows traffic. Option D (NAT gateway in public subnet) provides outbound connectivity. Option B is wrong because VPC endpoints are for AWS services, not internet. Option E is wrong because IGW is for inbound, not outbound inspection.

Answer

Attach an Internet Gateway to the VPC and route all traffic to it

Answer

Create VPC endpoints for all required AWS services

Question 13

A company wants to encrypt all data in transit between an Application Load Balancer (ALB) and its target EC2 instances. Which TWO actions should be taken?

Accepted Answer

Configure the target group to use HTTPS as the protocol. Options A and D are correct. The ALB listener must use HTTPS to terminate SSL. The target group for the ALB must use HTTPS protocol to encrypt traffic to targets. Option B is wrong because listener rules do not affect encryption. Option C is wrong because security group rules do not encrypt traffic. Option E is wrong because Client Certificate Authentication is for client-to-ALB, not ALB-to-target.

Answer

Enable Client Certificate Authentication on the ALB

Answer

Add a listener rule to forward traffic based on path

Answer

Configure security groups to allow only HTTPS traffic

Question 14

Refer to the exhibit. A company has attached this bucket policy to an S3 bucket. An EC2 instance in VPC vpc-12345 is trying to access the bucket but is getting access denied. The EC2 instance has a public IP of 198.51.100.10. What is the MOST likely reason?

Accepted Answer

The EC2 instance's source IP is not in the allowed IP range. Option B is correct. The policy has two allow statements: one for source IP range and one for source VPC. The EC2 instance's source IP (198.51.100.10) is not in the allowed IP range (203.0.113.0/24). The second statement allows requests from the VPC, but the condition aws:SourceVpc is only present when the request comes through a VPC endpoint (Gateway or Interface endpoint). If the EC2 instance accesses S3 via the internet (public IP), the aws:SourceVpc condition is not satisfied, so the second statement does not apply. The first statement does not allow the IP, resulting in implicit deny. Option A is wrong because the policy allows GetObject. Option C is wrong because the policy does not require both conditions. Option D is wrong because there is no explicit deny.

Answer

The policy does not have an explicit allow for the instance's IP

Answer

Both conditions must be met for access

Answer

The EC2 instance does not have the s3:GetObject permission

Question 15

Refer to the exhibit. A network engineer runs the above command and sees this network ACL configuration. The subnet associated with this ACL contains an EC2 instance that is failing to receive inbound HTTP traffic (TCP 80) from the internet. What is the MOST likely cause?

Accepted Answer

The inbound deny rule for TCP (port range) blocks all TCP traffic. Option A is correct. The inbound deny rule (Rule 100) for TCP (Protocol 6) from 0.0.0.0/0 denies all TCP traffic, including HTTP. Even though there is a later allow-all rule (Rule 200), network ACLs evaluate rules in ascending order, so the deny rule is evaluated first and blocks the traffic. Option B is wrong because the outbound rule allows all traffic. Option C is wrong because the allow rule exists but is after the deny. Option D is wrong because the deny rule applies to all CIDR blocks.

Answer

The inbound deny rule is associated with the wrong subnet

Answer

The outbound rule does not allow return traffic

Answer

The inbound allow rule is not wide enough