ANS-C01 Network Security, Compliance and Governance Practice Test 27 — 15 Questions

Question 1

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application stores files in an S3 bucket. The security team wants to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. They have created an IAM role for the EC2 instances with a policy that grants s3:PutObject and s3:GetObject on the specific bucket. They have also attached a VPC endpoint for S3 to the VPC and added a bucket policy that allows access only from the VPC endpoint. Despite this, the EC2 instances can still access other S3 buckets. What is the most likely reason?

Accepted Answer

The VPC endpoint policy does not restrict access to the specific S3 bucket.. Option D is correct because the S3 bucket policy restricting access to the VPC endpoint only applies to that bucket, but the EC2 instances can still access other buckets if the IAM policy allows it, unless a VPC endpoint policy restricts access to only the specific bucket. Option A is wrong because the IAM policy only grants access to the specific bucket, but if the instances have other IAM policies attached, they might allow broader access. However, the question implies only this policy is attached. Option B is wrong because the route table for the private subnets must have a route to the VPC endpoint for S3; if it doesn't, traffic would go through the NAT Gateway and not use the endpoint, but that would not allow access to other buckets if the IAM policy is restrictive. Actually, the most likely reason is that the VPC endpoint policy is not set to restrict access to only the specific bucket. Option C is wrong because the security group on the endpoint controls traffic to the endpoint, not what can be accessed through it.

Answer

The VPC endpoint does not have a route table associated with the private subnets.

Answer

The security group on the VPC endpoint is allowing all traffic.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 2

A company is designing a VPC with private subnets for databases and public subnets for web servers. They need to allow the web servers to make outbound internet requests for software updates but prevent inbound traffic from the internet. Which configuration should they use?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.. Option C is correct because a NAT Gateway in a public subnet allows outbound internet traffic from private subnets while blocking unsolicited inbound traffic. Option A is wrong because an Internet Gateway alone would allow inbound traffic. Option B is wrong because a NAT Gateway in a private subnet cannot access the internet. Option D is wrong because a proxy in a public subnet could work but is more complex and not the simplest solution.

Answer

Deploy a NAT Gateway in the private subnet and route the private subnet traffic through it.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through it.

Answer

Deploy a proxy server in the private subnet and configure the web servers to use it.

Question 3

A security engineer is troubleshooting connectivity issues between two VPCs connected via a VPC Peering connection. The VPCs are in different accounts. The security groups in both VPCs allow traffic between the CIDRs. The route tables have the appropriate entries. However, instances in VPC A cannot communicate with instances in VPC B. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.. Option B is correct because VPC Peering connections do not support transitive routing, so if there is an intermediate gateway, traffic will not flow. Option A is incorrect because security groups are stateful and allow return traffic automatically. Option C is incorrect because VPC Peering does not require an IAM role. Option D is incorrect because NACLs are stateless and return traffic must be allowed, but the problem states security groups allow traffic, not NACLs.

Answer

The VPC Peering connection requires an IAM role to be assumed for cross-account communication.

Answer

The security group in VPC A does not allow inbound traffic from VPC B's CIDR.

Answer

The network ACL in VPC A does not allow return traffic from VPC B.

Question 4

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should they use?

Accepted Answer

Add a bucket policy with a condition that requires aws:SourceVpc to be the VPC ID.. Option D is correct because S3 bucket policies can use aws:SourceVpc condition key to restrict access to a specific VPC. Option A is wrong because security groups are not used for S3. Option B is wrong because VPC Endpoint policies control actions but not source VPC. Option C is wrong because IAM policies are attached to users/roles, not to the bucket.

Answer

Create an IAM policy that restricts access to the VPC and attach it to all users.

Answer

Attach a security group to the S3 bucket that allows traffic from the VPC.

Answer

Create a VPC Endpoint policy that allows access only from the VPC.

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via a VPN. They want to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the network?

Accepted Answer

Configure Transit Gateway with appliance mode and route traffic through a dedicated inspection VPC.. Option B is correct because Transit Gateway supports appliance mode that forces traffic to be routed through a specific VPC where the security appliance resides. Option A is wrong because VPC Peering does not support transitive routing. Option C is wrong because Network Firewall can inspect traffic but does not require Transit Gateway; however, the question specifically asks for a design with Transit Gateway. Option D is wrong because Security Groups cannot inspect traffic at the network level.

Answer

Create VPC Peering connections between each VPC and the inspection VPC.

Answer

Use security groups in each VPC to restrict traffic and enable VPC Flow Logs for auditing.

Answer

Place the security appliance in each VPC and use Network Firewall to inspect traffic.

Question 6

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from an S3 bucket in the same AWS region. The company wants to ensure that traffic does not traverse the internet. Which solution is MOST cost-effective?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the private subnet's route table to the endpoint.. Option D is correct because a Gateway VPC Endpoint for S3 allows private connectivity to S3 without cost, and it does not require a NAT Gateway or Internet Gateway. Option A is wrong because a NAT Gateway would incur hourly charges and data processing fees. Option B is wrong because an Internet Gateway is not needed and would allow internet traffic. Option C is wrong because an Interface VPC Endpoint for S3 incurs hourly charges.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic directly to S3.

Answer

Create an Interface VPC Endpoint for S3 in the private subnet.

Answer

Deploy a NAT Gateway in a public subnet and route the private subnet traffic through it to access S3.

Question 7

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that only authorized users can access them. Which combination of actions should they take?

Accepted Answer

Enable default encryption (SSE-S3) on the S3 bucket and attach a bucket policy that restricts access to authorized IAM principals.. Option A is correct because enabling SSE-S3 provides encryption at rest, and a bucket policy with principal conditions restricts access. Option B is wrong because CloudTrail does not natively integrate with KMS for SSE-C. Option C is wrong because SSE-C requires managing your own keys. Option D is wrong because disabling public access alone does not encrypt the logs.

Answer

Use SSE-KMS with a customer managed key and allow CloudTrail to use the key.

Answer

Disable public access to the S3 bucket and enable versioning.

Answer

Enable SSE-C on the S3 bucket and provide the encryption key in each API call.

Question 8

A company wants to allow an external auditor to access a specific EC2 instance in their VPC for a limited time. The auditor will connect via SSH from a known IP address. What is the MOST secure way to grant access?

Accepted Answer

Create a bastion host in a public subnet with a security group allowing SSH from the auditor's IP, and allow SSH from the bastion to the instance.. Option B is correct because using a bastion host with a security group that restricts the source IP is a secure practice. Option A is wrong because opening port 22 to 0.0.0.0/0 is insecure. Option C is wrong because a VPN still exposes the instance to the VPC network. Option D is wrong because a security group with a wide CIDR is less restrictive.

Answer

Assign a public IP to the instance and create a security group rule allowing SSH from the auditor's IP.

Answer

Configure a security group for the instance that allows SSH from the VPC CIDR.

Answer

Set up a client VPN endpoint and allow the auditor to connect to the VPC, then SSH to the instance.

Question 9

A company has a Direct Connect connection to AWS. They want to encrypt all traffic between their on-premises network and their VPC. Which solution meets this requirement?

Accepted Answer

Set up a VPN connection over the Direct Connect link using IPsec.. Option D is correct because Direct Connect does not provide encryption; you must use IPsec VPN over the Direct Connect link or a MACsec at the physical layer. Option A is wrong because Direct Connect itself does not encrypt traffic. Option B is wrong because TLS is for application layer, not all traffic. Option C is wrong because AWS Site-to-Site VPN can be used over Direct Connect to encrypt traffic.

Answer

Use MACsec on the Direct Connect connection.

Answer

Enable encryption on the Direct Connect virtual interface.

Answer

Use TLS for all traffic between on-premises and AWS.

Question 10

A security engineer reviews the above security group configuration for a web server. What is a security concern with this configuration?

Accepted Answer

The outbound rule allows all traffic, which could be used for data exfiltration if the server is compromised.. Option D is correct because the egress rule allows all outbound traffic to any destination, which could allow data exfiltration if the instance is compromised. Option A is incorrect because HTTP is allowed from anywhere, which is typical for a web server. Option B is incorrect because SSH from 10.0.0.0/8 is internal and acceptable. Option C is incorrect because the egress rule allows all traffic, not just HTTP.

Answer

The inbound rule for SSH allows traffic from a large CIDR block (10.0.0.0/8), which could include unauthorized internal hosts.

Answer

The outbound rule allows all traffic, which is necessary for the server to function.

Answer

The inbound rule for HTTP is too permissive because it allows traffic from all IP addresses.

Question 11

A company applies the above S3 bucket policy. An administrator reports that an application using the AWS SDK is unable to upload objects to the bucket from an EC2 instance in the same account. The EC2 instance has an IAM role with s3:PutObject permission. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS.. Option C is correct because the condition aws:SecureTransport: true requires HTTPS, but the SDK must explicitly use HTTPS; if it uses HTTP, the request is denied. Option A is wrong because the principal is the account root, which does not apply to the EC2 role. Option B is wrong because the resource includes the bucket and objects. Option D is wrong because the condition does not require encryption at rest; it only requires secure transport.

Answer

The bucket policy grants access to the root user only, not the IAM role.

Answer

The application is not using server-side encryption.

Answer

The bucket policy does not grant access to the bucket itself, only to objects.

Question 12

A CloudFormation stack created a VPC Gateway Endpoint for S3 with the above policy. An EC2 instance in the VPC is unable to download objects from the S3 bucket using the AWS CLI. The instance has an IAM role with s3:GetObject permission. What is the most likely cause?

Accepted Answer

The VPC Endpoint policy does not allow s3:ListBucket, which is needed for the CLI to list objects.. Option B is correct because the VPC Endpoint policy allows only s3:GetObject, but the CLI often requires s3:ListBucket to list objects, and also the endpoint policy must be combined with IAM; the instance role may not have the correct permissions. Option A is wrong because the endpoint policy allows GetObject. Option C is wrong because Gateway Endpoints do not use security groups. Option D is wrong because the route table must have a route to the endpoint, but the question implies it's configured.

Answer

The security group associated with the VPC Endpoint blocks traffic.

Answer

The VPC Endpoint policy does not allow s3:GetObject.

Answer

The route table for the private subnet does not have a route to the VPC Endpoint.

Question 13

Which TWO actions improve the security of an AWS account's root user? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use it for daily tasks.. Options A and D are correct. Enabling MFA on the root user is a critical security best practice. Creating an IAM admin user and not using the root user for daily tasks reduces exposure. Option B is wrong because a strong password alone is insufficient; MFA is also needed. Option C is wrong because sharing the password is insecure. Option E is wrong because the Access Key is not needed and should be avoided.

Answer

Share the root user password with the security team.

Answer

Set a strong password for the root user.

Answer

Generate an Access Key for the root user and use it for programmatic access.

Question 14

Which THREE are valid methods to secure data in transit between a VPC and an on-premises network over the internet? (Choose three.)

Accepted Answer

AWS Direct Connect with a VPN. Options A, C, and D are correct. A VPN connection uses IPsec to encrypt traffic. Client VPN provides secure tunnels for individual clients. Direct Connect is a physical connection but does not encrypt; however, a VPN over Direct Connect does encrypt. Option B is wrong because VPC Peering is for VPC-to-VPC, not for on-premises. Option E is wrong because VPC Endpoints are for private AWS service access, not for on-premises connectivity.

Answer

VPC Endpoint (Gateway or Interface)

Answer

VPC Peering

Question 15

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple accounts? (Choose two.)

Accepted Answer

AWS Config. Options B and C are correct. AWS Organizations allows you to centrally manage accounts and apply service control policies (SCPs). AWS Config can enforce rules across accounts. Option A is wrong because IAM is per-account. Option D is wrong because CloudTrail is for logging, not policy enforcement. Option E is wrong because VPC Flow Logs are for network monitoring.

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM)