ANS-C01 Network Security, Compliance and Governance Practice Test 26 — 15 Questions

Question 1

A company wants to encrypt all data in transit between an Application Load Balancer (ALB) and its target EC2 instances. Which TWO actions should be taken?

Accepted Answer

Configure the target group to use HTTPS as the protocol. To encrypt data in transit between an Application Load Balancer (ALB) and its target EC2 instances, only the target group protocol needs to be configured to use HTTPS (Option B). The ALB listener protocol (HTTPS) encrypts traffic between the client and the ALB, not between the ALB and targets, so Option D is not required for this specific goal. Option A is incorrect because Client Certificate Authentication is for mutual TLS between client and ALB. Option C is incorrect because adding a listener rule based on path affects traffic routing, not encryption. Option E is incorrect because security group rules control access but do not encrypt traffic.

Answer

Enable Client Certificate Authentication on the ALB

Answer

Add a listener rule to forward traffic based on path

Answer

Configure the ALB listener to use HTTPS

Answer

Configure security groups to allow only HTTPS traffic

Question 2

Refer to the exhibit. A company has attached this bucket policy to an S3 bucket. An EC2 instance in VPC vpc-12345 is trying to access the bucket but is getting access denied. The EC2 instance has a public IP of 198.51.100.10. What is the MOST likely reason?

Accepted Answer

The EC2 instance's source IP is not in the allowed IP range. The policy has two allow statements: one for source IP range and one for source VPC. The EC2 instance's source IP (198.51.100.10) is not in the allowed IP range (203.0.113.0/24). The second statement allows requests from the VPC, but the condition aws:SourceVpc is only present when the request comes through a VPC endpoint (Gateway or Interface endpoint). If the EC2 instance accesses S3 via the internet (public IP), the aws:SourceVpc condition is not satisfied, so the second statement does not apply. The first statement does not allow the IP, resulting in implicit deny. Option A is wrong because the policy allows GetObject. Option C is wrong because the policy does not require both conditions. Option D is wrong because there is no explicit deny.

Answer

The policy does not have an explicit allow for the instance's IP

Answer

Both conditions must be met for access

Answer

The EC2 instance does not have the s3:GetObject permission

Question 3

Refer to the exhibit. A network engineer runs the above command and sees this network ACL configuration. The subnet associated with this ACL contains an EC2 instance that is failing to receive inbound HTTP traffic (TCP 80) from the internet. What is the MOST likely cause?

Accepted Answer

The inbound deny rule for TCP (port range) blocks all TCP traffic. The inbound deny rule (Rule 100) for TCP (Protocol 6) from 0.0.0.0/0 denies all TCP traffic, including HTTP on port 80. Network ACLs evaluate rules in ascending order, so this deny rule is evaluated before any allow rules. Even though Rule 200 allows all traffic, the deny rule takes precedence because it comes first. Therefore, inbound HTTP traffic from the internet is blocked. Option A is incorrect because the subnet association does not affect the rule order; the deny rule applies to the subnet. Option C is incorrect because the outbound rule allows all traffic, so return traffic is not the issue. Option D is incorrect because the allow rule is wide enough (all traffic), but it is evaluated after the deny rule.

Answer

The inbound deny rule is associated with the wrong subnet

Answer

The outbound rule does not allow return traffic

Answer

The inbound allow rule is not wide enough

Question 4

A company runs a critical application on EC2 instances in a VPC. The application needs to send data to an S3 bucket and an SQS queue, both in the same AWS account. The security team requires that all traffic to these AWS services must stay within the AWS network and not traverse the internet. The VPC has private subnets with no NAT gateway or Internet Gateway. The EC2 instances have an IAM role that grants necessary permissions. The S3 bucket and SQS queue are configured with bucket policies and queue policies that deny all access except from the VPC. However, the application is failing to send data to both S3 and SQS. What should the network engineer do to resolve this issue?

Accepted Answer

Create a gateway endpoint for S3 and an interface endpoint for SQS in the VPC, and update the route tables for S3 and the security groups for SQS. VPC endpoints for S3 (Gateway endpoint) and SQS (Interface endpoint) provide private connectivity within the AWS network, meeting the security requirement. Option D is correct because it creates the necessary endpoints and updates route tables and security groups. For the Gateway endpoint, route tables must be updated to direct S3 traffic through the endpoint. For the Interface endpoint, security groups must allow inbound traffic from the EC2 instances. Option A is wrong because CloudFront is a content delivery service, not a private connectivity solution for S3 or SQS. Option B is wrong because a NAT gateway would route traffic over the internet, violating the requirement. Option C is wrong because Direct Connect is an overkill and does not directly provide VPC endpoint connectivity for S3 and SQS.

Answer

Deploy an Amazon CloudFront distribution in front of S3 and use its public endpoint

Answer

Create a NAT gateway in a public subnet and update the route tables to send traffic to it

Answer

Set up an AWS Direct Connect connection and route traffic through it

Question 5

A company is using AWS WAF to protect its web application. The security team notices that the WAF logs show a high number of requests from a specific IP address range that are being blocked by the SQL injection rule. However, the application team reports that legitimate users from that IP range are unable to access the application. Which action should the security team take to resolve this issue while maintaining security?

Accepted Answer

Create a rate-based rule to limit requests from the IP range.. Creating a rate-based rule can limit the request rate from the specific IP range, allowing legitimate traffic while still blocking excessive requests that may be part of a SQL injection attempt. This maintains security by not outright allowing the IP range or disabling protections. Option A is wrong because disabling the SQL injection rule for the IP range removes protection against actual SQL injection attacks from that range. Option B is wrong because increasing the rate limit for the entire WAF is not granular and may affect other traffic. Option C is wrong because adding the IP range to the allow list completely bypasses security, leaving the application vulnerable.

Answer

Disable the SQL injection rule for the specific IP range.

Answer

Increase the rate limit for the entire WAF.

Answer

Add the IP range to the allow list in the WAF.

Question 6

A financial services company is required to encrypt all data at rest and in transit. They have an Amazon S3 bucket with server-side encryption enabled (SSE-S3) and are using HTTPS for all API calls. During an audit, the auditor points out that the bucket policy does not explicitly deny requests that do not use HTTPS. Which of the following should the company add to the bucket policy to enforce HTTPS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. It uses a Deny effect with the condition aws:SecureTransport set to 'false'. This denies any request that is not using HTTPS, effectively enforcing that all requests must be made over HTTPS. Options A and C are incorrect because they deny requests when SecureTransport is 'true', which would block legitimate HTTPS requests. Option B is incorrect because it uses an Allow effect; while it would allow HTTPS requests, it does not explicitly deny non-HTTPS requests, so non-HTTPS requests could still be allowed if another policy grants access.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 7

A company has deployed a VPC with public and private subnets. They have an Internet Gateway attached to the VPC and a NAT Gateway in the public subnet. The private subnet instances need to download patches from the internet. Which configuration ensures that the private instances can reach the internet while preventing inbound traffic from the internet?

Accepted Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.. Adding a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway allows private instances to initiate outbound traffic to the internet while preventing inbound connections from the internet. Option A is incorrect because a VPC Gateway Endpoint only provides access to specific AWS services (e.g., S3, DynamoDB), not general internet traffic. Option B is incorrect because routing 0.0.0.0/0 to the Internet Gateway would expose the private instances to inbound traffic from the internet (assuming the route is in the private subnet route table, it would still allow inbound traffic if the instances have public IPs, but more importantly, it bypasses the NAT Gateway's security). Option D is incorrect because VPC Peering does not provide internet access; it only connects two VPCs.

Answer

Add a VPC Gateway Endpoint for Amazon S3 to the private subnet route table.

Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

Answer

Create a VPC Peering connection to a public VPC and route traffic through it.

Question 8

A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?

Accepted Answer

Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.. AWS WAF allows you to create rate-based rules that can include an IP set with the partners' IPs and set a high rate limit for that specific rule, thereby excluding legitimate traffic from rate limiting while maintaining protection against DDoS. Option A is wrong because disabling rate-based rules removes protection against DDoS. Option B is wrong because increasing the global rate limit may still throttle legitimate traffic and is not a precise solution. Option C is wrong because AWS Shield Advanced does not have a whitelist for individual IPs at the application layer; IP whitelisting is done via AWS WAF.

Answer

Disable the rate-based rule in AWS WAF during the DDoS event.

Answer

Increase the global rate limit in AWS Shield Advanced.

Answer

Add the partners' IP addresses to the AWS Shield Advanced whitelist.

Question 9

A company is setting up a cross-account VPC peering connection between VPC A (account 1) and VPC B (account 2). The security team wants to ensure that only specific TCP ports are allowed between the VPCs. They have configured the route tables and the VPC peering connection is active. Which additional configuration is required to enforce the port restriction?

Accepted Answer

Update the security groups in both VPCs to allow inbound traffic only on the required ports from the peered VPC's CIDR or security group.. Security groups can reference security groups from peered VPCs across accounts when the VPC peering connection is active, allowing fine-grained control over specific TCP ports at the instance level. Option A is incorrect because modifying network ACLs is possible but they are stateless and apply at the subnet level, not instance level; also, network ACLs cannot reference security groups from peered VPCs. Option B is incorrect because network ACLs are stateless, not stateful; security groups are stateful. Option D is incorrect because route tables control the path of traffic, not port-level filtering; they cannot deny traffic based on ports.

Answer

Modify the network ACLs in both VPCs to allow inbound traffic only on the required ports.

Answer

Use network ACLs with stateful filtering to allow only the required ports.

Answer

Configure the route tables to deny traffic on all ports except the allowed ones.

Question 10

A company is using AWS Secrets Manager to store database credentials. They want to ensure that the credentials are automatically rotated every 30 days. Which configuration is required?

Accepted Answer

Enable automatic rotation in the secret configuration and provide a Lambda rotation function.. AWS Secrets Manager provides built-in automatic rotation using a Lambda function. Option B is incorrect because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it is designed for configuration management. Option C is incorrect because AWS CloudHSM is a hardware security module for storing cryptographic keys, not for automating credential rotation. Option D is incorrect because IAM Access Analyzer analyzes resource policies to identify unintended access, not to rotate credentials.

Answer

Store the secret in AWS Systems Manager Parameter Store and configure a rotation schedule.

Answer

Store the secret in AWS CloudHSM and use a scheduled Lambda to rotate.

Answer

Use IAM Access Analyzer to rotate the credentials periodically.

Question 11

A company has a VPC with multiple subnets. They have an Application Load Balancer (ALB) in a public subnet and a web server fleet in private subnets. The security team wants to ensure that only the ALB can communicate with the web servers. Which security group configuration should be used?

Accepted Answer

Set the web server security group inbound rule to allow traffic from the ALB's security group.. Referencing the ALB's security group as the source allows only traffic from instances or resources associated with that security group, strictly limiting access to the web servers. This follows the principle of least privilege. Option B is wrong because allowing traffic from the public subnet CIDR is too broad and would permit any instance in that subnet, not just the ALB. Option C is wrong because allowing traffic from the VPC CIDR permits any resource in the VPC, which is overly permissive. Option D is wrong because allowing traffic from 0.0.0.0/0 exposes the web servers to the internet.

Answer

Set the web server security group inbound rule to allow traffic from the public subnet CIDR.

Answer

Set the web server security group inbound rule to allow traffic from the VPC CIDR.

Answer

Set the web server security group inbound rule to allow traffic from 0.0.0.0/0.

Question 12

A company wants to centrally manage firewall rules across multiple VPCs in different AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager. AWS Network Firewall can be centrally managed using AWS Firewall Manager, which provides a single pane of glass to apply firewall rules across multiple VPCs and accounts. Option B is wrong because Security Groups are per-VPC and not centrally managed. Option C is wrong because AWS WAF is for web application layer protection, not network firewall. Option D is wrong because Network ACLs are per-subnet and cannot be centrally managed across accounts.

Answer

Security Groups

Answer

AWS WAF

Answer

Network ACLs

Question 13

A company is designing a network security architecture for a multi-tier application. They want to ensure that the web tier can communicate with the application tier only on specific ports, and the application tier can communicate with the database tier only on specific ports. Which TWO configurations should be implemented?

Accepted Answer

Use network ACLs to provide a secondary layer of stateless filtering at the subnet level.. The correct answers are C and E. Security groups (E) are stateful and can reference other security groups as a source, allowing traffic between tiers only on required ports. Network ACLs (C) are stateless and provide a secondary layer of filtering at the subnet level. Option A is wrong because a transit gateway is used to connect multiple VPCs, not for filtering within a VPC. Option B is wrong because VPC peering connects VPCs, and security groups cannot be applied to a peering connection. Option D is wrong because a single security group cannot differentiate traffic between tiers; each tier needs its own security group.

Answer

Use a transit gateway with network ACLs to filter traffic between tiers.

Answer

Use VPC peering to connect the tiers and apply security groups on the peering connection.

Answer

Use a single security group for all tiers and define rules based on CIDR blocks.

Question 14

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3 or SSE-KMS. Which THREE steps should they take to implement this policy?

Accepted Answer

Attach the SCP to the root organizational unit (OU) to apply to all accounts.. Service control policies (SCPs) can be applied at the root organizational unit (OU) to deny actions that create or modify S3 buckets without encryption (SSE-S3 or SSE-KMS), as in options B and E. AWS Config rules can detect unencrypted buckets and trigger automated remediation, such as enabling default encryption, which addresses existing buckets (option D). Option A is incorrect because bucket policies are account-specific and cannot enforce organization-wide policies. Option C is incorrect because VPC endpoint policies control network access, not encryption enforcement.

Answer

Apply a bucket policy in each account that denies PutObject without encryption.

Answer

Use a VPC endpoint policy to enforce encryption for all S3 access from the VPC.

Question 15

A company is deploying a web application that must be accessible over HTTPS only. They are using an Application Load Balancer (ALB) with an SSL certificate from AWS Certificate Manager (ACM). Which TWO configurations are necessary to ensure that only HTTPS traffic reaches the application?

Accepted Answer

Configure the security group for the ALB to allow inbound traffic on port 443 from 0.0.0.0/0.. To ensure only HTTPS traffic reaches the application, the security group for the ALB should allow inbound traffic on port 443 from anywhere (option C), and the ALB listener must be configured to accept traffic on port 443 using the SSL certificate from ACM (option E). Option A is incorrect because allowing port 80 would permit HTTP traffic. Option B is incorrect because an HTTP listener would accept unencrypted traffic. Option D is incorrect because redirecting HTTP to HTTPS still allows HTTP traffic to reach the ALB initially; the proper approach is to not accept HTTP at all.

Answer

Configure the security group for the ALB to allow inbound traffic on port 80 from 0.0.0.0/0.

Answer

Configure the ALB listener to accept traffic on port 80.

Answer

Configure the ALB to redirect HTTP traffic to HTTPS.