ANS-C01 Network Security, Compliance and Governance Practice Test 27 — 15 Questions

Question 1

A security engineer must ensure that all traffic between an application running on Amazon EC2 and an Amazon RDS database is encrypted in transit. The VPC has a public subnet for the EC2 instance and a private subnet for the RDS database. What is the MOST secure way to enforce encryption for this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the RDS DB instance to require SSL/TLS connections and configure the application to connect using SSL.. To enforce encryption in transit between an EC2 instance and an RDS database, the most secure method is to configure the RDS instance to require SSL/TLS connections and ensure the application connects using SSL. This ensures that all data transmitted is encrypted and that the database rejects unencrypted connections. Other options do not enforce encryption or are ineffective.

Answer

Enable IAM database authentication for the RDS instance.

Answer

Use a security group rule that allows traffic only on port 443.

Answer

Place both the EC2 instance and the RDS database in the same subnet and use a network ACL to enforce encryption.

Question 2

A company is designing a VPC with a public subnet for web servers and a private subnet for database servers. The web servers must be able to access the internet for software updates, but the database servers must not have direct internet access. Which solution meets these requirements?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route to it in the private subnet's route table.. A NAT gateway deployed in the public subnet allows instances in the private subnet to initiate outbound internet traffic (e.g., software updates) while preventing inbound connections from the internet. The private subnet's route table must have a route (0.0.0.0/0) pointing to the NAT gateway. This satisfies both requirements: web servers in the public subnet use the internet gateway directly, and database servers in the private subnet use the NAT gateway for outbound-only access.

Answer

Use a VPC endpoint for Amazon S3 to provide internet access to the database servers.

Answer

Set up a VPN connection to an on-premises data center and route traffic through it.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet's route table.

Question 3

A company is using AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection patterns. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. AWS WAF provides a specific SQL injection match condition that inspects request components (e.g., URI, query string, body) for patterns indicative of SQL injection attacks. This rule type is designed to block such requests, aligning with the security team's goal. Other rule types address different threats and do not inspect for SQLi patterns.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 4

A network engineer is troubleshooting connectivity issues between an on-premises network and an Amazon VPC over an AWS Direct Connect connection. The on-premises network uses BGP to advertise routes to the VPC. The VPC is associated with a virtual private gateway (VGW). The on-premises network can reach resources in the VPC, but VPC resources cannot reach on-premises resources. What is the most likely cause?

Accepted Answer

The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.. For traffic to flow bidirectionally over Direct Connect, the VPC route tables must contain a route pointing the on-premises CIDR block to the virtual private gateway. Since on-premises can reach VPC resources (proving the BGP session and VGW attachment are working), the missing piece is the return path route in the VPC route table. Without this route, VPC resources have no path back to the on-premises network.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The BGP session is not established.

Answer

The security group associated with the VPC resources is blocking inbound traffic from on-premises.

Question 5

Refer to the exhibit. An IAM role ARN is shown. A security engineer wants to allow an EC2 instance to assume this role. What is required for the EC2 instance to successfully assume the role?

Accepted Answer

The role's trust policy must allow the EC2 service principal to assume the role, and the EC2 instance must be launched with an instance profile that includes this role.. To allow an EC2 instance to assume an IAM role, two conditions must be met: 1) The role's trust policy must allow the EC2 service principal (ec2.amazonaws.com) to assume the role, 2) The EC2 instance must be launched with an instance profile that includes that role. This is correctly described in option B. Option A is incorrect because the trust policy specifies the service principal, not an IP address. Option C is incorrect because the permissions policy defines what the role can do, not who can assume it; the trust policy controls who can assume the role. Option D is incorrect because the EC2 instance can access the IAM endpoint via private IP as long as it has network connectivity (e.g., through a VPC endpoint or NAT), and a public IP is not required.

Answer

The trust policy must specify the EC2 instance's private IP address.

Answer

The role's permissions policy must include an Allow for the EC2 instance's security group.

Answer

The EC2 instance must have a public IP address to access the IAM endpoint.

Question 6

A company is deploying a web application in a VPC and wants to protect it from common web exploits like cross-site scripting (XSS). Which AWS service should be used to filter and monitor HTTP requests?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that inspects HTTP/HTTPS requests at Layer 7 and can block or monitor common web exploits such as XSS and SQL injection using managed or custom rules. It integrates with ALB, CloudFront, API Gateway, and AppSync, making it the correct tool for filtering and monitoring HTTP traffic. Security groups and NACLs operate at Layers 3/4 and cannot inspect HTTP payloads, and Shield Advanced only mitigates DDoS attacks.

Answer

Security Group

Answer

Network ACL

Answer

AWS Shield Advanced

Question 7

A company has a VPC with an internet gateway and wants to restrict outbound traffic from a private subnet to only allow traffic to specific AWS services, such as S3 and DynamoDB. Which solution should be used?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB, and attach a policy to the endpoints to restrict access.. VPC endpoints (specifically Gateway Endpoints for S3 and DynamoDB) allow private subnet resources to reach these AWS services without traversing the internet, NAT, or an internet gateway. Attaching an endpoint policy lets you restrict access to specific buckets, tables, or actions, satisfying the requirement to limit outbound traffic to only those AWS services. This is the AWS-recommended pattern for private access to S3 and DynamoDB.

Answer

Configure a security group on the instances in the private subnet to allow outbound traffic only to the IP ranges of the AWS services.

Answer

Use a NAT gateway in the public subnet and add a route to it in the private subnet.

Answer

Attach an internet gateway to the VPC and add a route to it in the private subnet.

Question 8

Which TWO of the following are valid methods to secure data at rest in Amazon S3? (Choose two.)

Accepted Answer

Use SSE-S3 (Server-Side Encryption with S3 managed keys).. Option A is correct because SSE-S3 (Server-Side Encryption with Amazon S3-managed keys) encrypts objects at rest using AES-256, with S3 handling key management, directly protecting stored data. Option C is correct because client-side encryption encrypts the object data before it is uploaded, so the data is already ciphertext while stored in S3, satisfying data-at-rest protection. Option B is incorrect because SSL/TLS protects data in transit, not data at rest. Option D is incorrect because a VPC endpoint controls network access to S3 but does not encrypt stored objects. Option E is incorrect because network ACLs are stateless subnet-level access controls and do not provide encryption for data at rest.

Answer

Use SSL/TLS to encrypt data during transfer.

Answer

Use a VPC endpoint to restrict access to the bucket.

Answer

Configure a network ACL to block unauthorized access.

Question 9

Which THREE of the following are best practices for securing a VPC? (Choose three.)

Accepted Answer

Enable AWS Shield Advanced for DDoS protection.. Option A is correct because AWS Shield Advanced provides enhanced DDoS protection for resources in a VPC, including Elastic IP addresses and Elastic Load Balancers, and is a recommended best practice for defending against volumetric and application-layer attacks. Option B is correct because security groups act as stateful virtual firewalls at the instance/ENI level, allowing you to define precise inbound and outbound rules that restrict traffic to only what is required. Option C is correct because network ACLs are stateless subnet-level filters that provide an additional defense-in-depth layer, complementing security groups by controlling traffic entering and leaving entire subnets. Option D is not a best practice because allowing all outbound traffic to the internet violates the principle of least privilege and increases exfiltration and data-loss risk; outbound traffic should be restricted to necessary destinations. Option E is not a best practice because the default security group should not be used to allow all traffic; it should be left restrictive or replaced with custom security groups that enforce least-privilege access.

Answer

Allow all outbound traffic from the VPC to the internet.

Answer

Assign a default security group that allows all traffic.

Question 10

Which TWO of the following are valid ways to encrypt data in transit between an on-premises data center and an Amazon VPC? (Choose two.)

Accepted Answer

Use AWS Site-to-Site VPN.. Option A is correct because AWS Site-to-Site VPN creates IPsec tunnels over the public internet between the on-premises customer gateway and the AWS virtual private gateway or transit gateway, encrypting all traffic in transit. Option C is correct because running a VPN (IPsec) tunnel over an AWS Direct Connect connection provides encryption for data in transit while still using the dedicated private connectivity of Direct Connect. Option B is incorrect because a standard AWS Direct Connect connection is a private, dedicated network link but does not encrypt traffic by itself. Option D is incorrect because VPC peering connects VPCs to each other and does not provide encryption between an on-premises data center and a VPC. Option E is incorrect because an internet gateway only enables internet connectivity, and security groups are stateful firewalls that filter traffic but do not encrypt it.

Answer

Use AWS Direct Connect without any additional encryption.

Answer

Use VPC peering.

Answer

Use an internet gateway with a security group.

Question 11

A security engineer is designing a hybrid network with an AWS Site-to-Site VPN. The company requires that all traffic between the on-premises network and VPC be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Use AWS Site-to-Site VPN with IPsec tunnels. AWS Site-to-Site VPN uses IPsec tunnels to encrypt all traffic between the on-premises network and the VPC. This ensures that data in transit is encrypted, meeting the security requirement. The VPN connection consists of two IPsec tunnels for redundancy, and all traffic routed through the VPN is encrypted.

Answer

Use VPC peering instead of VPN

Answer

Use AWS Direct Connect with MACsec

Answer

Deploy a Transit Gateway with route tables

Question 12

A company has a VPC with public and private subnets. The public subnet hosts a web server that must be accessible from the internet. The private subnet hosts a database that should only be accessible from the web server. Which security group configuration should be used?

Accepted Answer

Database security group: inbound rule allowing traffic from the web server security group on the database port. Security groups can reference other security groups as sources. Option A is correct because it allows traffic from the web server's security group, which ensures only the web server can access the database. Option B is wrong because it allows all traffic from the VPC CIDR, which is too permissive. Option C is wrong because it allows traffic from a specific private IP, but that IP might change and is less flexible than using the security group. Option D is wrong because it allows traffic from 0.0.0.0/0, which permits inbound traffic from any IP address, making the database publicly accessible.

Answer

Database security group: inbound rule allowing traffic from the VPC CIDR on the database port

Answer

Database security group: inbound rule allowing traffic from the web server's private IP on the database port

Answer

Database security group: inbound rule allowing traffic from 0.0.0.0/0 on the database port

Question 13

A company is deploying a multi-tier web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that the web servers only accept traffic from the ALB and that the ALB only accepts traffic from the internet on ports 80 and 443. Additionally, the web servers should be able to make outbound connections to the internet for updates. Which combination of security group rules meets these requirements?

Accepted Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from ALB SG on app port, outbound to 0.0.0.0/0 on ephemeral. The correct combination requires the ALB security group to allow inbound internet traffic on 80/443 and outbound traffic to the web servers on the application port, while the web server security group allows inbound only from the ALB security group on the app port and outbound to 0.0.0.0/0 on ephemeral ports for updates. Referencing the ALB security group as the source in the web SG inbound rule ensures only ALB traffic reaches the instances, and the outbound ephemeral rule allows return traffic and internet updates.

Answer

Use network ACLs instead: public subnet NACL allow 80/443 inbound, private subnet NACL allow from ALB on app port

Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound deny all; Web SG: inbound from ALB SG on app port, outbound allow all

Answer

ALB SG: inbound 0.0.0.0/0 on 80/443, outbound to web SG on app port; Web SG: inbound from VPC CIDR on app port, outbound to 0.0.0.0/0 on ephemeral

Question 14

A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region and the peering connection is in the 'active' state. Security groups in both VPCs allow all traffic. However, instances in VPC A cannot reach instances in VPC B. What is the most likely cause?

Accepted Answer

Route tables in one or both VPCs do not have routes pointing to the peering connection. For VPC peering to work, both VPCs must have route table entries pointing to the peering connection (pcx-xxxx) for the peer's CIDR range. Even with an 'active' peering connection and permissive security groups, traffic is dropped if no route exists — AWS does not auto-populate route tables for peering. This is the classic 'peering is up but traffic fails' scenario.

Answer

Security groups are blocking traffic between the VPCs

Answer

The VPC peering connection is in the 'pending-acceptance' state

Answer

Network ACLs are blocking traffic between the VPCs

Question 15

A company uses AWS WAF to protect its web application from common exploits. The security team notices that a specific IP address is generating a high volume of requests and should be blocked immediately. Which action should be taken?

Accepted Answer

Update the AWS WAF IP set rule to block the IP address. AWS WAF allows creating IP set rules to block specific IP addresses. Therefore, the correct action is to update the IP set rule to include the problematic IP. Option A is correct. Option B is wrong because security groups operate at the network layer and are not integrated with WAF. Option C is wrong because NACLs are stateless and not suitable for application-layer blocking. Option D is wrong because CloudFront geo-restriction blocks based on geographic location, not individual IPs.

Answer

Add a rule to the security group to deny traffic from that IP

Answer

Add a network ACL rule to deny traffic from that IP in the subnet

Answer

Use AWS CloudFront geo-restriction to block the IP