ANS-C01 Network Security, Compliance and Governance Practice Test 27 — 15 Questions

Question 1

A company has a VPC with CIDR 10.0.0.0/16. They have public subnets (10.0.1.0/24, 10.0.2.0/24) and private subnets (10.0.3.0/24, 10.0.4.0/24) in two Availability Zones. An Internet Gateway is attached to the VPC, and a NAT Gateway is in public subnet 10.0.1.0/24. The private subnets route 0.0.0.0/0 to the NAT Gateway. The security team notices that instances in private subnet 10.0.3.0/24 can reach the internet, but instances in private subnet 10.0.4.0/24 cannot. Both private subnets have the same route table configuration. The network ACLs for both private subnets are set to allow all inbound and outbound traffic. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route table for the public subnet 10.0.1.0/24 does not have a route to the Internet Gateway.. The NAT Gateway is in the public subnet 10.0.1.0/24. For the NAT Gateway to reach the internet, the route table associated with that public subnet must have a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, the NAT Gateway cannot forward traffic from private subnets to the internet. Since both private subnets have the same route table configuration pointing to the NAT Gateway, the issue is isolated to the NAT Gateway's inability to reach the internet due to the missing route in the public subnet's route table. Options B, C, and D are incorrect: security groups and network ACLs are configured to allow traffic, and the private subnet route tables are correctly set to route to the NAT Gateway.

Answer

The security group on the instances in private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The network ACL for private subnet 10.0.4.0/24 is blocking outbound traffic.

Answer

The route table for private subnet 10.0.4.0/24 does not have a route to the NAT Gateway.

Question 2

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. They have a central inspection VPC that uses AWS Network Firewall to inspect traffic. The security team wants to ensure that all traffic between VPCs and between VPCs and on-premises is routed through the inspection VPC. They have created a transit gateway route table for each VPC and the Direct Connect/VPN attachments. They have configured the route tables to propagate routes from the inspection VPC's attachment. However, traffic is still bypassing the inspection VPC. What should the security team do to ensure traffic is inspected?

Accepted Answer

Create static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and remove any routes that point directly to other attachments.. Creating static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and removing any routes that point directly to other attachments, ensures that all traffic is sent to the inspection VPC. Without static routes, propagated routes from the inspection VPC attachment create routes to the inspection VPC, but other attachments may also propagate routes that allow direct communication, bypassing inspection. Option A is incorrect because enabling route propagation alone does not force traffic through the inspection VPC; it only adds routes automatically, but other routes (e.g., from Direct Connect or VPN attachments) can still allow direct paths. Option C is incorrect because network ACLs in the inspection VPC control traffic to and from its subnets but do not influence routing decisions in the transit gateway; they cannot prevent traffic from bypassing the inspection VPC. Option D is incorrect because VPC peering connections bypass the transit gateway entirely, so traffic would not be inspected by the Network Firewall in the inspection VPC.

Answer

Enable route propagation for all attachments in the transit gateway route tables.

Answer

Configure network ACLs in the inspection VPC to block traffic that does not come from the transit gateway.

Answer

Create VPC peering connections between all VPCs and the inspection VPC.

Question 3

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application stores files in an S3 bucket. The security team wants to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. They have created an IAM role for the EC2 instances with a policy that grants s3:PutObject and s3:GetObject on the specific bucket. They have also attached a VPC endpoint for S3 to the VPC and added a bucket policy that allows access only from the VPC endpoint. Despite this, the EC2 instances can still access other S3 buckets. What is the most likely reason?

Accepted Answer

The VPC endpoint policy does not restrict access to the specific S3 bucket.. The most likely reason is that the VPC endpoint policy is not restricting access to the specific S3 bucket (Option C). Even though the IAM role only grants permissions on the specific bucket, the VPC endpoint policy defaults to allowing access to all S3 resources. Without a restrictive endpoint policy, the EC2 instances can access other S3 buckets if they have any IAM permissions that allow it (e.g., from another attached policy). Option A is incorrect because the VPC endpoint does not require a route table association to function; rather, the route table must have a route pointing to the endpoint for traffic to use it. Option B is incorrect because the security group on the endpoint controls network traffic, not access to S3 buckets. Option D is incorrect because the IAM role must have a trust policy allowing EC2 to assume it, but that is a prerequisite and would not cause the described issue by itself.

Answer

The VPC endpoint does not have a route table associated with the private subnets.

Answer

The security group on the VPC endpoint is allowing all traffic.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 4

A company is designing a VPC with private subnets for databases and public subnets for web servers. They need to allow the web servers to make outbound internet requests for software updates but prevent inbound traffic from the internet. Which configuration should they use?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway.. Deploying a NAT Gateway in a public subnet allows instances in private subnets to initiate outbound internet traffic (e.g., for software updates) while blocking unsolicited inbound traffic from the internet. Option B is incorrect because a NAT Gateway must be in a public subnet to access the internet. Option C is incorrect because an Internet Gateway allows both inbound and outbound traffic, which would expose the private subnets to inbound internet traffic. Option D is incorrect because while a proxy server could work, it is more complex and not the simplest or recommended AWS solution.

Answer

Deploy a NAT Gateway in the private subnet and route the private subnet traffic through it.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic through it.

Answer

Deploy a proxy server in the private subnet and configure the web servers to use it.

Question 5

A security engineer is troubleshooting connectivity issues between two VPCs connected via a VPC Peering connection. The VPCs are in different accounts. The security groups in both VPCs allow traffic between the CIDRs. The route tables have the appropriate entries. However, instances in VPC A cannot communicate with instances in VPC B. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.. VPC Peering connections do not support transitive routing. If traffic must pass through an intermediate VPC or on-premises network, the peering connection alone cannot route it. Option B is incorrect because VPC Peering does not require an IAM role for cross-account communication; instead, the accepter must accept the request and route tables must be updated. Option C is incorrect because security groups are stateful and automatically allow return traffic, and the scenario states security groups allow traffic between CIDRs. Option D is incorrect because the issue is not about NACLs; if NACLs were blocking traffic, the problem would likely be related to stateless filtering, but the question focuses on security groups and routing.

Answer

The VPC Peering connection requires an IAM role to be assumed for cross-account communication.

Answer

The security group in VPC A does not allow inbound traffic from VPC B's CIDR.

Answer

The network ACL in VPC A does not allow return traffic from VPC B.

Question 6

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. Which policy should they use?

Accepted Answer

Add a bucket policy with a condition that requires aws:SourceVpc to be the VPC ID.. S3 bucket policies can use the aws:SourceVpc condition key to restrict access to requests originating from a specific VPC. Option A is wrong because IAM policies are attached to users, roles, or groups, not to the bucket itself, and they cannot restrict based on VPC directly. Option B is wrong because security groups cannot be attached to S3 buckets; they are used for EC2 instances and other resources. Option D is wrong because a VPC Endpoint policy controls what actions are allowed through the endpoint, but it does not restrict access based on the source VPC; the bucket policy is required for that.

Answer

Create an IAM policy that restricts access to the VPC and attach it to all users.

Answer

Attach a security group to the S3 bucket that allows traffic from the VPC.

Answer

Create a VPC Endpoint policy that allows access only from the VPC.

Question 7

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from an S3 bucket in the same AWS region. The company wants to ensure that traffic does not traverse the internet. Which solution is MOST cost-effective?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the private subnet's route table to the endpoint.. The most cost-effective solution because a Gateway VPC Endpoint for S3 provides private connectivity to S3 without any hourly charges, and it does not require a NAT Gateway or Internet Gateway. Option A is incorrect because an Internet Gateway would route traffic through the internet, which violates the requirement and is not cost-effective. Option C is incorrect because an Interface VPC Endpoint for S3 incurs hourly charges, making it more expensive than a Gateway Endpoint. Option D is incorrect because a NAT Gateway also incurs hourly and data processing charges, and it routes traffic through the internet, which is not desired.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic directly to S3.

Answer

Create an Interface VPC Endpoint for S3 in the private subnet.

Answer

Deploy a NAT Gateway in a public subnet and route the private subnet traffic through it to access S3.

Question 8

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that only authorized users can access them. Which combination of actions should they take?

Accepted Answer

Enable default encryption (SSE-S3) on the S3 bucket and attach a bucket policy that restricts access to authorized IAM principals.. Enabling default encryption (SSE-S3) on the S3 bucket ensures logs are encrypted at rest. Attaching a bucket policy that restricts access to authorized IAM principals ensures only authorized users can access them. This combination fully satisfies both requirements. Option A (SSE-KMS with a customer managed key) encrypts the logs at rest, but it does not include the access controls needed to ensure only authorized users can access the logs—additional measures would be required. Option B (disable public access and enable versioning) does not encrypt the logs. Option D (SSE-C) is impractical for CloudTrail logs because it requires you to supply encryption keys with every API call and does not inherently restrict access. Therefore, option C is the correct combination.

Answer

Use SSE-KMS with a customer managed key and allow CloudTrail to use the key.

Answer

Disable public access to the S3 bucket and enable versioning.

Answer

Enable SSE-C on the S3 bucket and provide the encryption key in each API call.

Question 9

A company wants to allow an external auditor to access a specific EC2 instance in their VPC for a limited time. The auditor will connect via SSH from a known IP address. What is the MOST secure way to grant access?

Accepted Answer

Create a bastion host in a public subnet with a security group allowing SSH from the auditor's IP, and allow SSH from the bastion to the instance.. The most secure approach is to use a bastion host (jump box) in a public subnet. The bastion host's security group restricts SSH access to only the auditor's known IP address. The target EC2 instance's security group allows SSH only from the bastion host's private IP, minimizing direct exposure. Option A (assigning a public IP to the instance) exposes the instance directly to the internet, even with a restricted security group, increasing attack surface. Option B (allowing SSH from the entire VPC CIDR) is insecure because any compromised resource within the VPC could access the instance. Option D (client VPN) is secure but adds complexity and cost for a temporary single-instance access; the bastion host is simpler and more direct.

Answer

Assign a public IP to the instance and create a security group rule allowing SSH from the auditor's IP.

Answer

Configure a security group for the instance that allows SSH from the VPC CIDR.

Answer

Set up a client VPN endpoint and allow the auditor to connect to the VPC, then SSH to the instance.

Question 10

A company has a Direct Connect connection to AWS. They want to encrypt all traffic between their on-premises network and their VPC. Which solution meets this requirement?

Accepted Answer

Set up a VPN connection over the Direct Connect link using IPsec.. Direct Connect does not inherently encrypt traffic. To encrypt all traffic between on-premises and the VPC, you can establish an IPsec VPN tunnel over the Direct Connect link. This encrypts traffic at the network layer. Option A is incorrect: MACsec provides physical-layer encryption but is not supported on all Direct Connect connections and does not encrypt all traffic end-to-end. Option C is incorrect: Direct Connect virtual interfaces do not provide encryption. Option D is incorrect: TLS is an application-layer protocol; it would require individual applications to support it and does not encrypt all traffic at the network layer.

Answer

Use MACsec on the Direct Connect connection.

Answer

Enable encryption on the Direct Connect virtual interface.

Answer

Use TLS for all traffic between on-premises and AWS.

Question 11

A security engineer reviews the above security group configuration for a web server. What is a security concern with this configuration?

Accepted Answer

The outbound rule allows all traffic, which could be used for data exfiltration if the server is compromised.. The security concern is that the outbound rule allows all traffic to any destination, which could be used for data exfiltration if the server is compromised. This is option A. Option D is not a concern because allowing HTTP from anywhere is typical for a web server. Option B is incorrect because SSH from 10.0.0.0/8 is internal and acceptable. Option C is incorrect because the outbound rule is overly permissive, not necessary.

Answer

The inbound rule for SSH allows traffic from a large CIDR block (10.0.0.0/8), which could include unauthorized internal hosts.

Answer

The outbound rule allows all traffic, which is necessary for the server to function.

Answer

The inbound rule for HTTP is too permissive because it allows traffic from all IP addresses.

Question 12

A company applies the above S3 bucket policy. An administrator reports that an application using the AWS SDK is unable to upload objects to the bucket from an EC2 instance in the same account. The EC2 instance has an IAM role with s3:PutObject permission. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS.. The bucket policy includes a condition 'aws:SecureTransport': 'true', which requires all requests to use HTTPS. If the AWS SDK is configured to use HTTP instead of HTTPS, the request will be denied even though the IAM role has s3:PutObject permission. Option A is incorrect because the bucket policy likely grants access to all users in the account or to the IAM role specifically, not just the root user. Option B is incorrect because server-side encryption is not required by the policy; only HTTPS is enforced. Option C is incorrect because the policy resource typically covers both the bucket and its objects, so access to the bucket is granted.

Answer

The bucket policy grants access to the root user only, not the IAM role.

Answer

The application is not using server-side encryption.

Answer

The bucket policy does not grant access to the bucket itself, only to objects.

Question 13

A CloudFormation stack created a VPC Gateway Endpoint for S3 with the above policy. An EC2 instance in the VPC is unable to download objects from the S3 bucket using the AWS CLI. The instance has an IAM role with s3:GetObject permission. What is the most likely cause?

Accepted Answer

The VPC Endpoint policy does not allow s3:ListBucket, which is needed for the CLI to list objects.. The VPC Endpoint policy shown in the CloudFormation stack (typically allows only s3:GetObject) does not include s3:ListBucket, which is required by the AWS CLI to list objects in a bucket before downloading them. Even though the IAM role has s3:GetObject, the endpoint policy is an additional layer that must also allow the action. Option A is incorrect because Gateway Endpoints do not use security groups. Option B is incorrect because the endpoint policy does allow s3:GetObject, but the issue is missing ListBucket. Option D is incorrect because the route table must have a route to the endpoint, but the question implies the endpoint is created and associated; the problem is the policy.

Answer

The security group associated with the VPC Endpoint blocks traffic.

Answer

The VPC Endpoint policy does not allow s3:GetObject.

Answer

The route table for the private subnet does not have a route to the VPC Endpoint.

Question 14

Which TWO actions improve the security of an AWS account's root user? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use it for daily tasks.. Options A and B are correct. Enabling MFA on the root user is a critical security best practice that adds an extra layer of protection. Creating an IAM user with administrative privileges and using it for daily tasks reduces the need to use the root user, which should be reserved for only a few account and service management tasks. Option D is incorrect because while a strong password is important, it is not sufficient on its own; MFA provides additional security. Option C is incorrect because sharing the root password violates security best practices. Option E is incorrect because generating an Access Key for the root user is not recommended and increases risk.

Answer

Share the root user password with the security team.

Answer

Set a strong password for the root user.

Answer

Generate an Access Key for the root user and use it for programmatic access.

Question 15

Which THREE are valid methods to secure data in transit between a VPC and an on-premises network over the internet? (Choose three.)

Accepted Answer

AWS Direct Connect with a VPN. To secure data in transit between a VPC and an on-premises network over the internet, the valid methods are AWS Direct Connect with a VPN (B), AWS Client VPN (C), and AWS Site-to-Site VPN (E). 
- AWS Site‑to‑Site VPN creates an IPsec VPN tunnel over the internet between the VPC and the on‑premises network, encrypting all traffic.
- AWS Client VPN is a managed service that allows individual clients to securely connect to the VPC over the internet using an OpenVPN tunnel.
- AWS Direct Connect with a VPN combines a dedicated physical connection (Direct Connect) with an IPsec VPN to provide both low latency and encryption. While Direct Connect itself is not over the internet, the VPN layer secures the data in transit. 
- Option A (VPC Endpoint) is used to access AWS services privately within the VPC, not for on‑premises connectivity. 
- Option D (VPC Peering) connects VPCs, not on‑premises networks.

Answer

VPC Endpoint (Gateway or Interface)

Answer

VPC Peering