ANS-C01 Network Security, Compliance and Governance Practice Test 28 — 15 Questions

Question 1

A company has a VPC with public and private subnets. They have a web application running on EC2 instances in an Auto Scaling group in the public subnets. The application needs to read and write data to an S3 bucket. They want to ensure that traffic to S3 does not traverse the internet. The security team also requires that all traffic to S3 be logged. The current setup uses a NAT Gateway for outbound internet access. However, the NAT Gateway is a single point of failure and costs are high. They want to replace it with a more cost-effective and highly available solution that meets the logging requirement. What should they do?

Accepted Answer

Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and remove the NAT Gateway after verifying no other outbound internet traffic is needed.. Option C is correct. A Gateway VPC Endpoint for S3 is free, highly available by design, and does not require a NAT Gateway. VPC Flow Logs can capture traffic to the endpoint for logging. Option A is wrong because an Interface Endpoint incurs costs. Option B is wrong because removing the NAT Gateway would break other internet access. Option D is wrong because a VPN does not provide direct S3 access and adds complexity.

Answer

Set up a VPN connection to an on-premises data center and route S3 traffic through the VPN, enabling VPC Flow Logs.

Answer

Create an Interface VPC Endpoint for S3 in each Availability Zone, enable VPC Flow Logs, and remove the NAT Gateway.

Answer

Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and keep the NAT Gateway for other outbound traffic.

Question 2

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Create an S3 bucket policy with a condition that allows access only from the VPC endpoint.. Option A is correct because an S3 bucket policy can use the aws:SourceVpce condition key to allow access only from a specific VPC endpoint. Option C is correct because a VPC endpoint policy controls what actions principals within the VPC can perform on the S3 bucket. Option B is wrong because NACLs are stateless and not designed for this purpose; they control traffic at the subnet level but cannot enforce S3 bucket access. Option D is wrong because Security Groups do not apply to VPC endpoints; they are for EC2 instances. Option E is wrong because IAM roles do not restrict traffic origin; they grant permissions to identities.

Answer

Assign a security group to the VPC endpoint that allows inbound traffic from the VPC.

Answer

Configure a network ACL on the subnet to deny all inbound traffic except from the VPC.

Answer

Use an IAM role to grant the VPC access to the S3 bucket.

Question 3

A security team needs to block outbound traffic from an EC2 instance to known malicious IP addresses while allowing all other outbound traffic. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Update the VPC route table to send traffic for the malicious IPs to a network firewall appliance.. Option A is correct because the VPC route table directs traffic; the malicious IPs must be routed to a network firewall appliance. Option B is correct because a network firewall (like AWS Network Firewall) can inspect and block traffic to specific IPs. Option D is correct because the firewall rule should explicitly deny traffic to the malicious IPs. Option C is wrong because Security Groups are stateful and can only allow/deny inbound/outbound based on source/destination, not specific IPs in a scalable way; they are not designed for blocklists. Option E is wrong because NACLs are stateless and do not support stateful inspection or application-layer filtering.

Answer

Configure network ACLs to deny outbound traffic to the malicious IPs.

Answer

Modify the security group for the EC2 instance to deny outbound traffic to the malicious IPs.

Question 4

A company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all new S3 buckets created across accounts have encryption enabled and block public access. Which TWO approaches meet these requirements? (Choose two.)

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the configuration does not meet requirements.. Option A is correct because SCPs can deny actions that create buckets without encryption or with public access allowed, enforcing the policy across all accounts. Option C is correct because AWS Config rules can be applied via a conformance pack to detect and remediate non-compliant buckets. Option B is wrong because CloudTrail only logs API calls; it cannot enforce or remediate. Option D is wrong because IAM roles in individual accounts cannot enforce organization-wide policies; they grant permissions to principals. Option E is wrong because bucket policies are per-bucket and cannot be enforced globally across all accounts.

Answer

Use an S3 bucket policy that denies all principals unless encryption is enabled.

Answer

Enable AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM role in each account that requires MFA for creating S3 buckets.

Question 5

A network engineer is troubleshooting connectivity between two VPCs connected via a VPC peering connection. Security groups and NACLs are configured correctly. The engineer verifies that the route tables have the necessary entries. However, traffic from an EC2 instance in VPC A to an RDS instance in VPC B fails. Which TWO additional checks should be performed? (Choose two.)

Accepted Answer

Check that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A.. Option B is correct because a VPC peering connection must accept the request; if it's in 'pending-acceptance' or 'rejected' state, traffic will not flow. Option D is correct because security group rules must allow inbound traffic from the peer VPC's CIDR; misconfigured rules can block traffic. Option A is wrong because NACLs are stateless and if correctly configured should allow traffic; but the issue is likely elsewhere. Option C is wrong because IAM roles are not required for VPC peering. Option E is wrong because the issue is not about Internet Gateway; it's about VPC peering.

Answer

Verify that the network ACLs in both VPCs have appropriate inbound and outbound rules for the traffic.

Answer

Confirm that the VPCs have an Internet Gateway attached.

Answer

Check that the EC2 instance has an IAM role that allows it to communicate with RDS.

Question 6

A financial services company must meet PCI DSS compliance. They have a VPC with public and private subnets. The private subnets host applications that process credit card data. The security team wants to ensure that no data leaves the VPC to the internet except through a controlled egress point. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Implement a central inspection VPC with AWS Network Firewall to inspect all outbound traffic.. Option A is correct because a NAT gateway allows outbound traffic from private subnets but the team wants to control egress; however, combined with other measures it can be part of a controlled egress. Option C is correct because a VPC endpoint for S3 and DynamoDB allows access to these services without traversing the internet. Option D is correct because a central inspection VPC with AWS Network Firewall can inspect and allow/deny outbound traffic. Option B is wrong because an Internet Gateway does not provide controlled egress; it allows direct internet access. Option E is wrong because Security Groups do not inspect traffic; they are stateful firewalls that only allow/deny based on rules.

Answer

Configure security groups to deny all outbound traffic from private subnets.

Answer

Attach an Internet Gateway to the VPC and allow all outbound traffic.

Question 7

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.. Option A is correct because the inspection VPC must be attached to the Transit Gateway. Option B is correct because route tables must direct inter-VPC traffic to the inspection VPC. Option C is correct because the firewall appliance must be configured to inspect and forward traffic. Option D is wrong because Direct Connect is not required; VPN is already used. Option E is wrong because VPC Peering is not used with Transit Gateway; Transit Gateway replaces peering.

Answer

Set up VPC peering between the inspection VPC and each spoke VPC.

Answer

Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.

Question 8

A company hosts a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The security team wants to block a list of known malicious IP addresses from accessing the application. They have already created an AWS WAF web ACL and associated it with the ALB. What is the MOST efficient way to block the IP addresses?

Accepted Answer

Add an AWS WAF rule to the web ACL that uses the 'IP reputation lists' managed rule group to block malicious IPs.. Option B is correct because AWS WAF has a managed rule group 'IP reputation lists' that automatically blocks known malicious IPs. Option A is wrong because updating security groups is not scalable for a large list. Option C is wrong because Network ACLs are stateless and not designed for application-layer blocking. Option D is wrong because CloudFront is an additional layer not mentioned and would add complexity.

Answer

Place a CloudFront distribution in front of the ALB and use CloudFront's geo-restriction feature.

Answer

Configure a network ACL on the ALB's subnet to deny inbound traffic from each malicious IP.

Answer

Add each IP address as an inbound deny rule in the security group of the ALB.

Question 9

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing EC2 instances. The EC2 instances need to download patches from the internet. The security team wants to ensure that the EC2 instances cannot initiate outbound connections to any other internet destinations. What should the network engineer do?

Accepted Answer

Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.. Option D is correct because an egress-only Internet Gateway is for IPv6, not IPv4. For IPv4, the solution is to use a NAT gateway with a security group that denies all outbound traffic except to the patch server. However, the best approach is to configure the security group to allow only HTTPS outbound to the patch server's IP and deny all else. Option A is wrong because it would allow all outbound traffic. Option B is wrong because egress-only IGW is for IPv6. Option C is wrong because NACLs are stateless and not ideal for this granular control.

Answer

Remove the NAT gateway and attach an Internet Gateway to the private subnet route table.

Answer

Attach an egress-only Internet Gateway to the VPC and route private subnet traffic to it.

Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the patch server's IP address.

Question 10

A company has a production VPC with a public subnet and a private subnet. The private subnet hosts a database instance that should be accessible only from the application servers in the same VPC. The security team has configured the database security group to allow inbound traffic on port 3306 from the application security group. However, the application servers cannot connect to the database. The network ACLs are configured with default allow all rules. What is the MOST likely cause?

Accepted Answer

The database security group does not allow outbound traffic for the response.. Option A is correct because security group rules are stateful; if the security group allows inbound from the app security group, return traffic is automatically allowed. Option B is wrong because VPC peering is not mentioned. Option C is wrong because NACLs are default allow. Option D is wrong because IAM roles are not needed for network connectivity.

Answer

The database instance does not have an IAM role assigned.

Answer

The network ACL on the private subnet has an inbound deny rule for port 3306.

Answer

The VPC is peered with another VPC that has overlapping CIDR.

Question 11

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no EC2 instance in any account can be launched with a public IP address unless it is in a specific VPC. Which solution will meet this requirement?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.. Option B is correct because an SCP can be applied at the root OU to deny the ec2:RunInstances action if the request includes a parameter to assign a public IP address, using a condition key like ec2:AssociatePublicIpAddress. Option A is wrong because IAM policies need to be applied in each account individually. Option C is wrong because Config can detect but not prevent. Option D is wrong because CloudTrail logs but does not prevent.

Answer

Create an IAM policy that denies ec2:RunInstances if the subnet is not in the allowed VPC, and attach it to all IAM users.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to stop any instance with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 12

A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?

Accepted Answer

The database security group inbound rule is not correctly referencing the web server security group ID.. Option C is correct because the web server's security group outbound rule explicitly allows traffic to the database SG, which is correct. The issue is likely that the database SG inbound rule is not referencing the correct web server SG, or the web server SG is not attached to the web server. Option A is wrong because NACLs are default allow. Option B is wrong because the web server SG outbound is correctly configured. Option D is wrong because stateful nature means inbound allows outbound responses, but the issue is the inbound rule on the database SG.

Answer

The network ACL on the private subnet denies inbound traffic on port 3306.

Answer

Security groups are stateful, so no outbound rule is needed; the issue is something else.

Answer

The web server security group does not allow outbound traffic to the database.

Question 13

A company has a Direct Connect connection to AWS with a private VIF to a VPC. They also have a VPN connection as a backup. The BGP sessions are established. They want to ensure that traffic from on-premises to the VPC prefers the Direct Connect path over the VPN. The on-premises router is advertising the same prefix to both connections. What should the network engineer configure on the AWS side?

Accepted Answer

Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.. Option A is correct because BGP AS_PATH prepending can be used to make the VPN path less preferred. However, AWS does not allow manipulation of BGP attributes on the customer side. The correct action is to configure the on-premises router to prepend AS path for the VPN route. Option B is wrong because Local Preference is a Cisco-specific feature not applicable. Option C is wrong because MED can be used but is not as reliable as AS_PATH prepend. Option D is wrong because VPC route tables do not influence BGP path selection.

Answer

Set a higher local preference value on the on-premises router for the Direct Connect route.

Answer

Update the VPC route table to give higher priority to the Direct Connect route.

Answer

Set a lower MED value on the Direct Connect virtual interface.

Question 14

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a security requirement that all traffic between VPCs must be inspected by a third-party firewall deployed in a central inspection VPC. The Transit Gateway has route tables configured with blackhole routes for inter-VPC traffic, and the inspection VPC has the firewall. However, traffic is not being inspected; it is being dropped. What is the MOST likely cause?

Accepted Answer

The Transit Gateway route table for inter-VPC traffic has blackhole routes instead of pointing to the inspection VPC attachment.. Option D is correct because if the Transit Gateway route table has blackhole routes for inter-VPC traffic, that traffic is dropped before reaching the inspection VPC. The route table should direct traffic to the inspection VPC attachment, not blackhole. Option A is wrong because firewall configuration is not the issue if traffic is not reaching it. Option B is wrong because static routes are fine. Option C is wrong because propagation is not the issue.

Answer

The inspection VPC is not propagating its routes to the Transit Gateway.

Answer

The firewall appliance is not configured to forward traffic back to the Transit Gateway.

Answer

The Transit Gateway route tables do not have static routes for the inspection VPC.

Question 15

A company has a VPC with a public subnet hosting a web server and a private subnet hosting a database. The web server must connect to the database on port 3306. Security groups are configured: Web SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to DB SG on port 3306. DB SG allows inbound from Web SG on port 3306. Network ACLs are default. The web server can connect to the database, but the security team notices that the database is also receiving connections from an unexpected IP address. What is the MOST likely cause?

Accepted Answer

An unauthorized EC2 instance has been launched with the same Web security group attached.. Option D is correct because the DB SG inbound rule allows traffic from the Web SG, which includes all instances with that SG, but if the Web SG is also attached to other instances (like an unauthorized instance), those instances can connect. Option A is wrong because NACLs are default allow. Option B is wrong because the DB SG does not have an inbound rule from 0.0.0.0/0. Option C is wrong because stateful nature does not cause unexpected connections.

Answer

The network ACL on the private subnet allows inbound traffic from all IPs.

Answer

The DB security group has an inbound rule allowing traffic from 0.0.0.0/0 on port 3306.

Answer

Security groups are stateful, so the DB SG automatically allows inbound responses.