ANS-C01 Network Security, Compliance and Governance Practice Test 26 — 15 Questions

Question 1

A company runs a critical application on EC2 instances in a VPC. The application needs to send data to an S3 bucket and an SQS queue, both in the same AWS account. The security team requires that all traffic to these AWS services must stay within the AWS network and not traverse the internet. The VPC has private subnets with no NAT gateway or Internet Gateway. The EC2 instances have an IAM role that grants necessary permissions. The S3 bucket and SQS queue are configured with bucket policies and queue policies that deny all access except from the VPC. However, the application is failing to send data to both S3 and SQS. What should the network engineer do to resolve this issue?

Accepted Answer

Create a gateway endpoint for S3 and an interface endpoint for SQS in the VPC, and update the route tables for S3 and the security groups for SQS. Option C is correct because VPC endpoints for S3 (Gateway endpoint) and SQS (Interface endpoint) provide private connectivity without internet. The policies must also be updated to allow traffic from the endpoints. Option A is wrong because NAT gateways would route traffic over the internet, violating the requirement. Option B is wrong because Direct Connect is overkill and does not solve the immediate issue of private connectivity to S3 and SQS. Option D is wrong because CloudFront is for content delivery and does not provide private access to SQS.

Answer

Deploy an Amazon CloudFront distribution in front of S3 and use its public endpoint

Answer

Create a NAT gateway in a public subnet and update the route tables to send traffic to it

Answer

Set up an AWS Direct Connect connection and route traffic through it

Question 2

A company is using AWS WAF to protect its web application. The security team notices that the WAF logs show a high number of requests from a specific IP address range that are being blocked by the SQL injection rule. However, the application team reports that legitimate users from that IP range are unable to access the application. Which action should the security team take to resolve this issue while maintaining security?

Accepted Answer

Create a rate-based rule to limit requests from the IP range.. Option C is correct because creating a rate-based rule can limit the request rate from the IP range, allowing legitimate traffic while still blocking excessive requests. Option A is wrong because disabling the SQL injection rule removes protection. Option B is wrong because allowing the entire IP range bypasses security. Option D is wrong because increasing the rate limit for the entire WAF is not granular enough.

Answer

Disable the SQL injection rule for the specific IP range.

Answer

Increase the rate limit for the entire WAF.

Answer

Add the IP range to the allow list in the WAF.

Question 3

A financial services company is required to encrypt all data at rest and in transit. They have an Amazon S3 bucket with server-side encryption enabled (SSE-S3) and are using HTTPS for all API calls. During an audit, the auditor points out that the bucket policy does not explicitly deny requests that do not use HTTPS. Which of the following should the company add to the bucket policy to enforce HTTPS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. Option B is correct because the condition block with aws:SecureTransport false and a Deny effect ensures that any request not using HTTPS is denied. Option A is wrong because using Bool with true would allow only HTTPS, but the condition should be false to deny non-HTTPS. Option C is wrong because it allows HTTPS requests but does not deny non-HTTPS. Option D is wrong because it denies when SecureTransport is true, which would block HTTPS requests.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 4

A company has deployed a VPC with public and private subnets. They have an Internet Gateway attached to the VPC and a NAT Gateway in the public subnet. The private subnet instances need to download patches from the internet. Which configuration ensures that the private instances can reach the internet while preventing inbound traffic from the internet?

Accepted Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.. Option A is correct because a route to the NAT Gateway allows outbound traffic to the internet, and the NAT Gateway does not allow inbound traffic initiated from the internet. Option B is wrong because an Internet Gateway would allow inbound traffic. Option C is wrong because a VPC Gateway Endpoint is for specific AWS services like S3 and DynamoDB, not general internet access. Option D is wrong because a VPC Peering connection does not provide internet access.

Answer

Add a VPC Gateway Endpoint for Amazon S3 to the private subnet route table.

Answer

Add a route in the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

Answer

Create a VPC Peering connection to a public VPC and route traffic through it.

Question 5

A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?

Accepted Answer

Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.. Option B is correct because AWS WAF rate-based rules with IP sets allow you to exclude specific IP addresses from rate limiting. Option A is wrong because increasing the rate limit for the entire web ACL may still allow malicious traffic. Option C is wrong because disabling the rate-based rule removes protection. Option D is wrong because Shield Advanced does not have built-in IP whitelisting at the application layer; that is done via WAF.

Answer

Disable the rate-based rule in AWS WAF during the DDoS event.

Answer

Increase the global rate limit in AWS Shield Advanced.

Answer

Add the partners' IP addresses to the AWS Shield Advanced whitelist.

Question 6

A company is setting up a cross-account VPC peering connection between VPC A (account 1) and VPC B (account 2). The security team wants to ensure that only specific TCP ports are allowed between the VPCs. They have configured the route tables and the VPC peering connection is active. Which additional configuration is required to enforce the port restriction?

Accepted Answer

Update the security groups in both VPCs to allow inbound traffic only on the required ports from the peered VPC's CIDR or security group.. Option B is correct because security groups can be used to control traffic at the instance level based on ports. Option A is wrong because VPC peering does not support security group referencing across accounts by default; you need to update the security group to reference the peered VPC's security group. Option C is wrong because network ACLs are stateless and apply at the subnet level, not at the instance level, and they cannot reference security groups. Option D is wrong because network ACLs do not support stateful inspection like security groups.

Answer

Modify the network ACLs in both VPCs to allow inbound traffic only on the required ports.

Answer

Use network ACLs with stateful filtering to allow only the required ports.

Answer

Configure the route tables to deny traffic on all ports except the allowed ones.

Question 7

A company is using AWS Secrets Manager to store database credentials. They want to ensure that the credentials are automatically rotated every 30 days. Which configuration is required?

Accepted Answer

Enable automatic rotation in the secret configuration and provide a Lambda rotation function.. Option A is correct because Secrets Manager can automatically rotate secrets with a Lambda function. Option B is wrong because Systems Manager Parameter Store does not have built-in rotation. Option C is wrong because IAM Access Analyzer does not rotate credentials. Option D is wrong because CloudHSM is for hardware security modules, not automated rotation.

Answer

Store the secret in AWS Systems Manager Parameter Store and configure a rotation schedule.

Answer

Store the secret in AWS CloudHSM and use a scheduled Lambda to rotate.

Answer

Use IAM Access Analyzer to rotate the credentials periodically.

Question 8

A company has a VPC with multiple subnets. They have an Application Load Balancer (ALB) in a public subnet and a web server fleet in private subnets. The security team wants to ensure that only the ALB can communicate with the web servers. Which security group configuration should be used?

Accepted Answer

Set the web server security group inbound rule to allow traffic from the ALB's security group.. Option B is correct because referencing the ALB's security group as the source allows only traffic from the ALB. Option A is wrong because allowing all traffic from the VPC CIDR is too broad. Option C is wrong because allowing all traffic from the public subnet is still broad. Option D is wrong because allowing from 0.0.0.0/0 allows all inbound traffic.

Answer

Set the web server security group inbound rule to allow traffic from the public subnet CIDR.

Answer

Set the web server security group inbound rule to allow traffic from the VPC CIDR.

Answer

Set the web server security group inbound rule to allow traffic from 0.0.0.0/0.

Question 9

A company is using AWS Direct Connect to connect their on-premises network to AWS. They have a virtual private gateway (VGW) attached to their VPC and a Direct Connect virtual interface (VIF) configured. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures that traffic automatically uses the VPN if the Direct Connect connection fails?

Accepted Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the Direct Connect VIF with a higher metric.. Option D is correct because propagating BGP routes from both the Direct Connect VIF and the VPN, and creating a static route with a higher metric (less preferred) for the Direct Connect route, allows automatic failover. Option A is wrong because the VPN must be configured to handle failover. Option B is wrong because the VPN alone does not provide automatic failover without route propagation. Option C is wrong because the VPN must be attached to the VGW.

Answer

Configure the VPN connection but attach it to a separate VGW, and use a transit gateway with failover routing.

Answer

Configure the VPN connection and propagate routes from both the Direct Connect and VPN. Create a static route in the route table for the on-premises CIDR pointing to the VPN.

Answer

Configure the VPN connection but do not propagate routes; use static routes in the route table.

Question 10

A company wants to centrally manage firewall rules across multiple VPCs in different AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager. Option C is correct because AWS Network Firewall can be centrally managed using AWS Firewall Manager. Option A is wrong because Security Groups are per-VPC and not centrally managed. Option B is wrong because Network ACLs are per-subnet. Option D is wrong because AWS WAF is for web application layer, not network firewall.

Answer

Security Groups

Answer

AWS WAF

Answer

Network ACLs

Question 11

A company is designing a network security architecture for a multi-tier application. They want to ensure that the web tier can communicate with the application tier only on specific ports, and the application tier can communicate with the database tier only on specific ports. Which TWO configurations should be implemented?

Accepted Answer

Use network ACLs to provide a secondary layer of stateless filtering at the subnet level.. Options A and B are correct. Security groups are used to control traffic between tiers based on security group IDs. Network ACLs are stateless and can be used as a secondary layer. Option C is wrong because a single security group cannot differentiate between tiers; multiple security groups are needed. Option D is wrong because VPC peering is for connecting VPCs, not for traffic filtering within a VPC. Option E is wrong because a transit gateway is for connecting multiple VPCs, not for security filtering.

Answer

Use a transit gateway with network ACLs to filter traffic between tiers.

Answer

Use VPC peering to connect the tiers and apply security groups on the peering connection.

Answer

Use a single security group for all tiers and define rules based on CIDR blocks.

Question 12

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3 or SSE-KMS. Which THREE steps should they take to implement this policy?

Accepted Answer

Attach the SCP to the root organizational unit (OU) to apply to all accounts.. Options A, B, and C are correct. Creating an SCP in the root OU denies the creation of unencrypted buckets. Additionally, using AWS Config rules and remediation actions can enforce encryption on existing buckets. Option D is wrong because a bucket policy is per bucket, not organizational. Option E is wrong because a VPC endpoint policy controls access to S3 from a VPC, not encryption.

Answer

Apply a bucket policy in each account that denies PutObject without encryption.

Answer

Use a VPC endpoint policy to enforce encryption for all S3 access from the VPC.

Question 13

A company is deploying a web application that must be accessible over HTTPS only. They are using an Application Load Balancer (ALB) with an SSL certificate from AWS Certificate Manager (ACM). Which TWO configurations are necessary to ensure that only HTTPS traffic reaches the application?

Accepted Answer

Configure the security group for the ALB to allow inbound traffic on port 443 from 0.0.0.0/0.. Options A and D are correct. The ALB listener must be configured for HTTPS on port 443, and the security group for the ALB should only allow inbound HTTPS traffic. Option B is wrong because HTTP listener is not needed. Option C is wrong because the security group for instances should allow traffic from the ALB, not from the internet. Option E is wrong because redirecting HTTP to HTTPS is not sufficient if the listener accepts HTTP; the listener should not accept HTTP at all.

Answer

Configure the security group for the ALB to allow inbound traffic on port 80 from 0.0.0.0/0.

Answer

Configure the ALB listener to accept traffic on port 80.

Answer

Configure the ALB to redirect HTTP traffic to HTTPS.

Question 14

A company has a VPC with CIDR 10.0.0.0/16. They have public subnets (10.0.1.0/24, 10.0.2.0/24) and private subnets (10.0.3.0/24, 10.0.4.0/24) in two Availability Zones. An Internet Gateway is attached to the VPC, and a NAT Gateway is in public subnet 10.0.1.0/24. The private subnets route 0.0.0.0/0 to the NAT Gateway. The security team notices that instances in private subnet 10.0.3.0/24 can reach the internet, but instances in private subnet 10.0.4.0/24 cannot. Both private subnets have the same route table configuration. The network ACLs for both private subnets are set to allow all inbound and outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The route table for the public subnet 10.0.1.0/24 does not have a route to the Internet Gateway.. Option B is correct because if the NAT Gateway is in subnet 10.0.1.0/24, the route table for that subnet must have a route to the Internet Gateway for the NAT Gateway to work. Without that route, the NAT Gateway cannot send traffic to the internet. Option A is wrong because the route tables for private subnets are correct. Option C is wrong because the network ACLs allow all traffic. Option D is wrong because security groups on the instances would affect both subnets equally.

Answer

The security group on the instances in private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The network ACL for private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The route table for private subnet 10.0.4.0/24 does not have a route to the NAT Gateway.

Question 15

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. They have a central inspection VPC that uses AWS Network Firewall to inspect traffic. The security team wants to ensure that all traffic between VPCs and between VPCs and on-premises is routed through the inspection VPC. They have created a transit gateway route table for each VPC and the Direct Connect/VPN attachments. They have configured the route tables to propagate routes from the inspection VPC's attachment. However, traffic is still bypassing the inspection VPC. What should the security team do to ensure traffic is inspected?

Accepted Answer

Create static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and remove any routes that point directly to other attachments.. Option C is correct because to force traffic through the inspection VPC, you must use transit gateway route tables with specific routes pointing to the inspection VPC's attachment, and ensure that no other routes allow direct communication. Option A is wrong because enabling route propagation alone does not force traffic through inspection; the inspection VPC must be the next hop. Option B is wrong because VPC peering bypasses the transit gateway. Option D is wrong because network ACLs in the inspection VPC do not affect routing in the transit gateway.

Answer

Enable route propagation for all attachments in the transit gateway route tables.

Answer

Configure network ACLs in the inspection VPC to block traffic that does not come from the transit gateway.

Answer

Create VPC peering connections between all VPCs and the inspection VPC.