ANS-C01 Network Security, Compliance and Governance Practice Test 28 — 15 Questions

Question 1

A company wants to encrypt all data in transit between its on-premises data center and AWS. Which two services or features can provide encryption for data in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN (C) is correct because it creates IPsec tunnels over the public internet between the on-premises customer gateway and an AWS virtual private gateway or transit gateway, encrypting all traffic in transit with IPsec. AWS Direct Connect with MACsec (E) is correct because MACsec (IEEE 802.1AE) provides layer-2 encryption on the dedicated Direct Connect link between the customer's router and the AWS Direct Connect endpoint, protecting data in transit. AWS PrivateLink (A) is not correct here because it privately connects VPCs and services over the AWS backbone without providing encryption of the traffic itself. VPC peering (B) is not correct because it only routes traffic privately between VPCs and does not encrypt it. AWS Transit Gateway (D) is not correct because it is a network transit hub for connecting VPCs and on-premises networks, not an encryption mechanism.

Answer

AWS PrivateLink

Answer

VPC peering

Answer

AWS Transit Gateway

Question 2

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team wants to implement defense in depth. Which three layers of security should be configured?

Accepted Answer

Security groups. Security groups (A) are correct because they act as stateful, instance-level virtual firewalls that allow or deny inbound and outbound traffic based on protocol, port, and source/destination, forming an essential layer of defense in depth within the VPC. AWS WAF (B) is correct because it filters and monitors HTTP(S) requests at the application layer, protecting the multi-tier application from common web exploits such as SQL injection and cross-site scripting. Network ACLs (E) are correct because they provide stateless, subnet-level traffic filtering with allow and deny rules, adding a distinct network-layer control that complements security groups. IAM policies (C) are not a network security layer for VPC traffic; they control authentication and authorization to AWS APIs and resources rather than filtering packets. VPC Flow Logs (D) are a monitoring and diagnostic feature that captures IP traffic metadata, not an enforcement control that blocks or permits traffic.

Answer

AWS Identity and Access Management (IAM) policies

Answer

VPC Flow Logs

Question 3

A company uses AWS Network Firewall to inspect traffic between VPCs in a transit gateway setup. They have a rule group that allows HTTP and HTTPS traffic to a web server in a production VPC. Recently, the security team added a new Suricata IPS rule to block traffic from a specific IP address. After deploying the updated rule group, they notice that all traffic to the web server is being dropped, even from allowed IPs. The firewall logs show the new rule is triggering for all traffic, not just the specific IP. What is the most likely cause?

Accepted Answer

The new rule is placed before the allow rules in the rule group, and due to the order of evaluation, the drop rule matches first and drops all traffic because the rule's source IP is set to 'any' instead of the specific IP.. AWS Network Firewall evaluates rules in a rule group in order, and a Suricata rule with action 'drop' and source 'any' will match all traffic before the allow rules are reached. If the new rule was inserted above the allow rules and its source was mistakenly set to 'any' instead of the specific IP, every packet to the web server matches the drop rule and is discarded. The fix is to correct the source IP and/or reorder the rule below the allow rules.

Answer

The web server's security group is blocking traffic from the firewall's IP range after the firewall adds its source IP.

Answer

The new Suricata rule uses the 'drop' action instead of 'reject', causing all packets to be dropped.

Answer

The rule group is attached to the firewall policy in the wrong direction (e.g., outbound instead of inbound).

Question 4

A company uses AWS Shield Advanced to protect their web application against DDoS attacks. They have configured automatic application layer DDoS mitigation with AWS WAF. During a recent attack, the application experienced increased latency, and some legitimate users were blocked. The security team reviews the WAF logs and finds that many requests from legitimate IPs were rate-limited. The team had set a rate-based rule with a threshold of 100 requests per 5 minutes. What is the most likely reason legitimate users were blocked?

Accepted Answer

The rate-based rule uses the source IP address as the aggregation key, and legitimate users behind a NAT gateway share the same public IP, causing the aggregate rate to exceed the threshold.. The correct answer is C: the rate-based rule aggregates requests by source IP address, so many legitimate users sharing a single public IP through a NAT gateway can collectively exceed the 100-requests-per-5-minutes threshold and get blocked. This is the classic false-positive scenario for rate-based rules, since AWS WAF cannot distinguish individual users behind the same NAT egress IP. Option A is wrong because rate-based rule blocks are temporary (the IP is blocked only while the rate remains above the threshold, not for 24 hours or indefinitely). Option B is irrelevant because sticky sessions and load balancer distribution do not cause legitimate users to be blocked by a rate-based rule. Option D is wrong because a rule action set to 'count' only logs matches and never blocks traffic, so it cannot explain the blocks.

Answer

The rate-based rule is set to block requests for 24 hours after the threshold is exceeded, and once triggered, all requests from that IP are blocked indefinitely.

Answer

The WAF web ACL is associated with an Application Load Balancer that is not configured for sticky sessions, causing requests from the same user to be distributed across multiple IPs.

Answer

The rate-based rule is evaluating requests before the WAF allows them, and the threshold is too low, but the rule action is set to 'count' instead of 'block', so it should not block traffic.

Question 5

A company wants to securely store and manage secrets such as database passwords and API keys. They need to automatically rotate secrets every 30 days and ensure that only specific IAM roles can access them. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating secrets such as database passwords and API keys. It supports native rotation with AWS Lambda, enforces fine-grained access control via IAM roles, and can rotate secrets on a schedule (e.g., every 30 days) without custom scripting.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Question 6

A company has an S3 bucket that stores sensitive documents. They need to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, they want to prevent any uploads that do not specify the required KMS key. Which combination of bucket policy and default encryption should they implement?

Accepted Answer

Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.. It combines S3 default encryption with SSE-KMS using the required KMS key, ensuring all objects are encrypted at rest with that key, and a bucket policy that explicitly denies s3:PutObject requests lacking the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN. This enforces that uploads must specify the correct KMS key, preventing any uploads that do not meet the encryption requirement. The bucket policy denial is evaluated before the request is allowed, providing a hard enforcement mechanism.

Answer

Enable default encryption with SSE-S3, and add a bucket policy that denies s3:PutObject unless the request uses the required KMS key.

Answer

Use a bucket policy that requires the kms:Encrypt permission for the required key, but do not enable default encryption.

Answer

Enable default encryption with SSE-KMS using the required key, and rely on IAM policies to enforce encryption, not bucket policies.

Question 7

A company wants to allow their employees to access internal web applications hosted on EC2 instances in a private subnet. The employees are outside the corporate network and connect via the internet. Which AWS service would provide secure, managed remote access without requiring a VPN client on each employee's device?

Accepted Answer

AWS Application Load Balancer with AWS WAF and Cognito authentication. An Application Load Balancer with AWS WAF and Cognito authentication provides secure, managed access to internal web applications without requiring a VPN client. Cognito handles user authentication (including integration with corporate identity providers), WAF filters malicious traffic, and the ALB routes requests to EC2 instances in private subnets. Employees simply use a browser, so no client software is needed on each device.

Answer

AWS Direct Connect

Answer

AWS Client VPN

Answer

AWS Site-to-Site VPN

Question 8

A company uses AWS Direct Connect to connect their on-premises network to AWS. They have a VPC with a virtual private gateway (VGW) and a private VIF attached to it. They recently added a second Direct Connect connection for redundancy. Both connections are active and advertised via BGP. The on-premises network uses BGP with the same AS number. After configuration, they notice that traffic is not load-balanced as expected; instead, all traffic flows through one connection. What is the most likely cause?

Accepted Answer

The on-premises router is configured with a higher local preference for one of the BGP sessions, causing it to prefer that path.. When two BGP sessions advertise the same prefixes with the same AS path length, the on-premises router chooses a single best path based on BGP attributes — and local preference is evaluated before AS path length, MED, and other tiebreakers. If one session has a higher local preference, all traffic for those prefixes will use that path, defeating load balancing. Equal-cost multipath (ECMP) across the two Direct Connect connections requires equal local preference, equal AS path, and multipath enabled.

Answer

The on-premises router has a static route pointing to the primary connection, overriding BGP learned routes.

Answer

Both Direct Connect connections are in the same AWS region and use the same VGW, so traffic cannot be load-balanced.

Answer

The Direct Connect connections are using different VLANs, causing asymmetric routing.

Question 9

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.. AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Answer

Use AWS Trusted Advisor to check for security group changes and send email alerts.

Answer

Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.

Answer

Enable VPC Flow Logs and analyze logs for changes to security group rules.

Question 10

A company wants to restrict access to their S3 bucket so that only users from their corporate network (with a specific IP range) can read objects. They also want to ensure that the objects are encrypted in transit. Which combination of bucket policy and encryption should they use?

Accepted Answer

Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.. A bucket policy with a condition key `aws:SourceIp` can restrict access to the corporate IP range, and requiring HTTPS (via a `aws:SecureTransport` condition) ensures encryption in transit. This combination directly meets both requirements without relying on additional infrastructure like VPC endpoints or CloudFront.

Answer

Use a VPC endpoint with a bucket policy that restricts access to the VPC endpoint.

Answer

Use an IAM policy that restricts access to the corporate IP range and enable default encryption on the bucket.

Answer

Enable CloudFront with geographic restrictions and use HTTPS.

Question 11

A company wants to securely store database credentials and automatically rotate them every 90 days. Which TWO AWS services can work together to achieve this? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it is purpose-built to store and manage secrets such as database credentials, and it includes native, built-in rotation support that can automatically rotate secrets on a schedule (for example, every 90 days) using a rotation Lambda function. AWS Lambda (D) is correct because Secrets Manager invokes a Lambda rotation function to perform the actual rotation logic, connecting to the database and updating both the credential and the stored secret value. Together, Secrets Manager schedules and stores the secret while Lambda executes the rotation, satisfying the 90-day automatic rotation requirement. AWS CloudHSM (B) provides dedicated hardware security modules for cryptographic key operations but does not store or rotate database credentials on a schedule. AWS KMS (C) is an encryption key management service used to encrypt secrets at rest, not a credential store with rotation scheduling. AWS Systems Manager Parameter Store (E) can store parameters and SecureString values, but it lacks native automatic credential rotation, so it cannot meet the 90-day rotation requirement on its own.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 12

A company has a VPC with public and private subnets. They use a NAT Gateway in the public subnet to allow instances in the private subnet to access the internet. The security team wants to ensure that all outbound traffic from the private subnet is logged and inspected. Which THREE services should they use together to achieve this? (Choose THREE.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (A) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, ACCEPT/REJECT) for the private subnet's ENIs, providing the logging and visibility the security team requires. AWS Network Firewall (C) is correct because it is a managed, stateful firewall deployed in the VPC that can inspect and filter outbound traffic from the private subnet before it reaches the NAT Gateway, satisfying the inspection requirement. Amazon Route 53 Resolver DNS Firewall (D) is correct because it inspects and filters DNS queries from the private subnet, blocking resolution of malicious domains and adding a DNS-layer control to the outbound traffic path. AWS Direct Connect (B) is not correct because it is a dedicated private network connection to AWS, not a logging or inspection service for outbound internet traffic. AWS Transit Gateway (E) is not correct because it is a hub for connecting VPCs and on-premises networks, not a traffic logging or inspection mechanism.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 13

A security engineer needs to block traffic from a specific country from reaching an Application Load Balancer. Which AWS service should be used to accomplish this?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF is the only service in the list that operates at Layer 7 and supports geographic (geo-match) conditions to block traffic from specific countries. A WAF web ACL is associated directly with the ALB, so requests from the blocked country are denied before reaching the backend. Network ACLs and security groups work at Layers 3/4 and cannot match on country of origin.

Answer

Network ACLs on the VPC subnet

Answer

Security groups associated with the ALB

Answer

Route 53 Resolver DNS Firewall

Question 14

A company is using AWS Shield Advanced to protect against DDoS attacks. The security team wants to receive notifications when an attack is detected. Which service should be used to send these notifications?

Accepted Answer

Amazon SNS. AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service. Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

Answer

AWS Lambda

Answer

AWS Config

Answer

Amazon SQS

Question 15

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted at rest. Which S3 bucket property should be enabled?

Accepted Answer

Default encryption. Default encryption on an S3 bucket automatically encrypts all objects at rest using either SSE-S3 (AES-256) or SSE-KMS, without requiring the uploader to specify encryption headers. This directly satisfies the requirement that all data be encrypted at rest. Since it applies at the bucket level, any object PUT into the bucket is encrypted by default, ensuring consistent enforcement.

Answer

Versioning

Answer

MFA Delete

Answer

Server access logging