ANS-C01 Network Security, Compliance and Governance Practice Test 28 — 15 Questions

Question 1

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple accounts? (Choose two.)

Accepted Answer

AWS Config. AWS Config allows you to define and enforce rules that evaluate resource configurations across accounts, and you can aggregate compliance data centrally using Config aggregators. AWS Organizations enables you to apply service control policies (SCPs) to centrally manage permissions across all accounts in the organization. Option B (VPC Flow Logs) captures IP traffic metadata but does not enforce security policies. Option C (CloudTrail) records API activity for auditing, not policy enforcement. Option D (IAM) manages permissions but is per-account and not designed for centralized policy management across multiple accounts.

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Identity and Access Management (IAM)

Question 2

A company has a VPC with public and private subnets. They have a web application running on EC2 instances in an Auto Scaling group in the public subnets. The application needs to read and write data to an S3 bucket. They want to ensure that traffic to S3 does not traverse the internet. The security team also requires that all traffic to S3 be logged. The current setup uses a NAT Gateway for outbound internet access. However, the NAT Gateway is a single point of failure and costs are high. They want to replace it with a more cost-effective and highly available solution that meets the logging requirement. What should they do?

Accepted Answer

Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and remove the NAT Gateway after verifying no other outbound internet traffic is needed.. A Gateway VPC Endpoint for S3 is free of charge, highly available by design (within a Region), and does not require a NAT Gateway for S3 access. Traffic to S3 remains within the AWS network. VPC Flow Logs can be enabled to capture traffic to the endpoint for logging purposes. After verifying that no other outbound internet traffic is required, the NAT Gateway can be removed to reduce costs and eliminate the single point of failure.

Option A is incorrect because setting up a VPN connection to on-premises does not provide a direct path to S3; traffic would still need to traverse the internet or a partner network, and it adds unnecessary complexity and cost. Option C is incorrect because an Interface VPC Endpoint for S3 incurs hourly charges and data processing fees, making it less cost-effective than a Gateway Endpoint. Option D is incorrect because it keeps the NAT Gateway, which the company wants to replace due to cost and single point of failure concerns; the goal is to remove the NAT Gateway if no other outbound traffic is needed.

Answer

Set up a VPN connection to an on-premises data center and route S3 traffic through the VPN, enabling VPC Flow Logs.

Answer

Create an Interface VPC Endpoint for S3 in each Availability Zone, enable VPC Flow Logs, and remove the NAT Gateway.

Answer

Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and keep the NAT Gateway for other outbound traffic.

Question 3

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Create an S3 bucket policy with a condition that allows access only from the VPC endpoint.. An S3 bucket policy can use the aws:SourceVpce condition key to allow access only from a specific VPC endpoint, restricting requests to those originating from that endpoint. Option C is correct because a VPC endpoint policy controls what actions principals within the VPC can perform on the S3 bucket, providing an additional layer of access control. Option A is incorrect because security groups are not supported for gateway VPC endpoints (which are used for S3); they cannot be assigned to such endpoints. Option D is incorrect because network ACLs operate at the subnet level and cannot enforce restrictions based on the source VPC or VPC endpoint; they control traffic entering/exiting subnets but do not apply to S3 bucket access directly. Option E is incorrect because IAM roles grant permissions to identities (users or services) but do not restrict traffic origin; they do not limit access to traffic from a specific VPC.

Answer

Assign a security group to the VPC endpoint that allows inbound traffic from the VPC.

Answer

Configure a network ACL on the subnet to deny all inbound traffic except from the VPC.

Answer

Use an IAM role to grant the VPC access to the S3 bucket.

Question 4

A security team needs to block outbound traffic from an EC2 instance to known malicious IP addresses while allowing all other outbound traffic. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Update the VPC route table to send traffic for the malicious IPs to a network firewall appliance.. The correct approach to block outbound traffic to known malicious IPs involves a combination of routing and stateful firewall inspection. Option B is correct because updating the VPC route table to send traffic for the malicious IPs to a network firewall appliance (e.g., AWS Network Firewall) enables centralized inspection and blocking. Option C is correct because deploying AWS Network Firewall provides stateful, application-layer inspection that can handle allow/deny rules for specific IPs. Option D is correct because a firewall rule within AWS Network Firewall can explicitly deny traffic to the malicious IPs. Option A is incorrect because network ACLs are stateless and require individual rules for each IP, making them impractical for dynamic blocklists. Option E is incorrect because security groups support only allow rules, not explicit deny; they cannot block specific IPs outbound.

Answer

Configure network ACLs to deny outbound traffic to the malicious IPs.

Answer

Modify the security group for the EC2 instance to deny outbound traffic to the malicious IPs.

Question 5

A company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all new S3 buckets created across accounts have encryption enabled and block public access. Which TWO approaches meet these requirements? (Choose two.)

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the configuration does not meet requirements.. SCPs can be applied to the root OU to deny s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption unless the bucket meets encryption and public access requirements, thus enforcing the policy organization-wide. Option C is correct because AWS Config conformance packs can include managed rules to detect buckets without encryption or with public access, and automatic remediation actions can be configured to fix non-compliant buckets. Option B is incorrect because an S3 bucket policy only applies to a single bucket and cannot enforce requirements across all buckets in all accounts; it also cannot prevent creation of buckets that don't meet the policy. Option D is incorrect because CloudTrail only provides logging and alerting; it does not enforce or remediate. Option E is incorrect because an IAM role with MFA requirement does not enforce encryption or public access settings on buckets; it only controls who can create buckets.

Answer

Use an S3 bucket policy that denies all principals unless encryption is enabled.

Answer

Enable AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM role in each account that requires MFA for creating S3 buckets.

Question 6

A network engineer is troubleshooting connectivity between two VPCs connected via a VPC peering connection. Security groups and NACLs are configured correctly. The engineer verifies that the route tables have the necessary entries. However, traffic from an EC2 instance in VPC A to an RDS instance in VPC B fails. Which TWO additional checks should be performed? (Choose two.)

Accepted Answer

Check that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A.. The correct checks to perform when troubleshooting VPC peering connectivity are to ensure the VPC peering connection is in the 'active' state (Option E) and that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A (Option A). Without an active peer connection, traffic cannot flow even if route tables are correct. Similarly, security group rules are stateful and must explicitly permit inbound traffic; NACLs are stateless but since the issue is within the same VPC peering, security groups are a likely culprit. IAM roles and Internet Gateways are not required for VPC peering traffic.

Answer

Verify that the network ACLs in both VPCs have appropriate inbound and outbound rules for the traffic.

Answer

Confirm that the VPCs have an Internet Gateway attached.

Answer

Check that the EC2 instance has an IAM role that allows it to communicate with RDS.

Question 7

A financial services company must meet PCI DSS compliance. They have a VPC with public and private subnets. The private subnets host applications that process credit card data. The security team wants to ensure that no data leaves the VPC to the internet except through a controlled egress point. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Implement a central inspection VPC with AWS Network Firewall to inspect all outbound traffic.. To meet PCI DSS compliance, the company needs to control and inspect outbound traffic from private subnets. Option A is correct because a central inspection VPC with AWS Network Firewall can inspect and control all outbound traffic, providing a controlled egress point. Option B is correct because VPC endpoints for S3 and DynamoDB keep traffic to these services within the AWS network, avoiding the internet. Option E is correct because a NAT gateway allows private subnets to access the internet for necessary updates or patches, but combined with other controls (like Network Firewall) it provides a controlled egress. Option C is incorrect because security groups deny all outbound traffic by default, but that would block all necessary outbound connections, including to AWS services; it does not provide a controlled egress point. Option D is incorrect because an Internet Gateway allows direct outbound access without inspection or control, violating PCI DSS requirements for controlled egress.

Answer

Configure security groups to deny all outbound traffic from private subnets.

Answer

Attach an Internet Gateway to the VPC and allow all outbound traffic.

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.. The firewall appliance must be configured for stateful inspection and to route traffic back to the Transit Gateway. Option C is correct because separate Transit Gateway route tables must be created to propagate routes from the inspection VPC and associate them with the spoke VPC attachments, ensuring traffic is directed to the inspection VPC. Option E is correct because the inspection VPC must be attached to the Transit Gateway to receive and forward traffic. Option B is incorrect because Transit Gateway replaces VPC peering; peering is not used. Option D is incorrect because Direct Connect is not required; the existing VPN connection handles on-premises connectivity.

Answer

Set up VPC peering between the inspection VPC and each spoke VPC.

Answer

Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.

Question 9

A company hosts a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The security team wants to block a list of known malicious IP addresses from accessing the application. They have already created an AWS WAF web ACL and associated it with the ALB. What is the MOST efficient way to block the IP addresses?

Accepted Answer

Add an AWS WAF rule to the web ACL that uses the 'IP reputation lists' managed rule group to block malicious IPs.. AWS WAF's managed rule group 'IP reputation lists' automatically blocks known malicious IPs from threat intelligence feeds, providing efficient protection without manual updates. Option A is wrong: CloudFront geo-restriction blocks traffic by geographic location, not specific IP addresses, and adds unnecessary complexity. Option C is wrong: Network ACLs are stateless and operate at the subnet level, not the application layer; managing a large IP list in NACL rules is not scalable. Option D is wrong: Security groups are stateful but are not designed for large IP blocklists, and ALB does not use security group rules for incoming traffic at the application layer.

Answer

Place a CloudFront distribution in front of the ALB and use CloudFront's geo-restriction feature.

Answer

Configure a network ACL on the ALB's subnet to deny inbound traffic from each malicious IP.

Answer

Add each IP address as an inbound deny rule in the security group of the ALB.

Question 10

A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing EC2 instances. The EC2 instances need to download patches from the internet. The security team wants to ensure that the EC2 instances cannot initiate outbound connections to any other internet destinations. What should the network engineer do?

Accepted Answer

Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.. Security groups act as a virtual firewall for EC2 instances, allowing you to specify outbound rules that restrict traffic to only the necessary destinations, such as the patch server's IP address on HTTPS. This provides granular control over outbound traffic. Option A is incorrect because removing the NAT gateway and attaching an internet gateway to the private subnet would give instances direct internet access, violating the restriction. Option B is incorrect because an egress-only internet gateway is used for IPv6 traffic only, not IPv4. Option C is incorrect because network ACLs are stateless and apply to the subnet as a whole, making them less suitable for per-instance granular control; they also require rules for return traffic, complicating the configuration.

Answer

Remove the NAT gateway and attach an Internet Gateway to the private subnet route table.

Answer

Attach an egress-only Internet Gateway to the VPC and route private subnet traffic to it.

Answer

Configure a network ACL on the private subnet to allow outbound traffic only to the patch server's IP address.

Question 11

A company has a production VPC with a public subnet and a private subnet. The private subnet hosts a database instance that should be accessible only from the application servers in the same VPC. The security team has configured the database security group to allow inbound traffic on port 3306 from the application security group. However, the application servers cannot connect to the database. The network ACLs are configured with default allow all rules. What is the MOST likely cause?

Accepted Answer

The network ACL on the private subnet has an inbound deny rule for port 3306.. The most likely cause is that the network ACL (NACL) on the private subnet has an inbound deny rule for port 3306. NACLs are stateless and evaluate rules in order; even though the default NACL allows all traffic, a custom NACL applied to the subnet could have a deny rule that overrides the default allow. This would block the inbound traffic from the application servers to the database on port 3306, preventing connectivity. Option B is incorrect because security groups are stateful; outbound rules do not affect return traffic for allowed inbound connections. Options A and D are irrelevant to the connectivity issue.

Answer

The database instance does not have an IAM role assigned.

Answer

The database security group does not allow outbound traffic for the response.

Answer

The VPC is peered with another VPC that has overlapping CIDR.

Question 12

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no EC2 instance in any account can be launched with a public IP address unless it is in a specific VPC. Which solution will meet this requirement?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.. An SCP applied at the root OU can deny ec2:RunInstances when the request includes a public IP address, using the ec2:AssociatePublicIpAddress condition key, and can further limit based on VPC using conditions like ec2:Vpc. This centrally prevents non-compliant EC2 launches across all accounts. Option B is incorrect because IAM policies must be attached to each user/role individually and do not scale across accounts; SCPs are designed for this purpose. Option C is incorrect because AWS Config can detect non-compliant instances but cannot prevent the initial launch. Option D is incorrect because CloudWatch Events can trigger actions after launch but does not prevent the launch itself.

Answer

Create an IAM policy that denies ec2:RunInstances if the subnet is not in the allowed VPC, and attach it to all IAM users.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to stop any instance with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 13

A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?

Accepted Answer

The database security group inbound rule is not correctly referencing the web server security group ID.. The web server can initiate outbound traffic because the web server's security group has an outbound rule allowing traffic to the database security group on port 3306. Security groups are stateful, so the response traffic is automatically allowed. The issue is that the database security group's inbound rule must reference the web server security group ID correctly. If the rule references a misconfigured or incorrect security group ID, the database will not accept the connection. Network ACLs are default allow, so they are not blocking traffic. Therefore, the correct answer is D.

Answer

The network ACL on the private subnet denies inbound traffic on port 3306.

Answer

Security groups are stateful, so no outbound rule is needed; the issue is something else.

Answer

The web server security group does not allow outbound traffic to the database.

Question 14

A company has a Direct Connect connection to AWS with a private VIF to a VPC. They also have a VPN connection as a backup. The BGP sessions are established. They want to ensure that traffic from on-premises to the VPC prefers the Direct Connect path over the VPN. The on-premises router is advertising the same prefix to both connections. What should the network engineer configure on the AWS side?

Accepted Answer

Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.. To prefer the Direct Connect path over the VPN for traffic from on-premises to the VPC, the on-premises router should prepend its AS number multiple times for the routes advertised over the VPN connection. This increases the AS path length, making the Direct Connect path more preferred. AWS does not allow manipulation of BGP attributes on the customer side of the Direct Connect or VPN connections, so the change must be made on the on-premises router. Option A is incorrect because local preference is a Cisco-specific feature and affects outbound traffic, not inbound. Option B is incorrect because VPC route tables only apply to traffic inside the VPC, not to BGP path selection. Option C is incorrect because MED is typically used to influence outbound traffic from AWS to on-premises and is not as effective as AS path prepending for this scenario.

Answer

Set a higher local preference value on the on-premises router for the Direct Connect route.

Answer

Update the VPC route table to give higher priority to the Direct Connect route.

Answer

Set a lower MED value on the Direct Connect virtual interface.

Question 15

A company has a VPC with a public subnet hosting a web server and a private subnet hosting a database. The web server must connect to the database on port 3306. Security groups are configured: Web SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to DB SG on port 3306. DB SG allows inbound from Web SG on port 3306. Network ACLs are default. The web server can connect to the database, but the security team notices that the database is also receiving connections from an unexpected IP address. What is the MOST likely cause?

Accepted Answer

An unauthorized EC2 instance has been launched with the same Web security group attached.. Security groups are stateful and allow outbound responses automatically, but the unexpected connections are likely due to another instance with the Web SG attached. The DB SG inbound rule allows traffic from the Web SG, which applies to all instances with that SG, including unauthorized ones. Option A is incorrect because default NACLs allow all traffic, but inbound NACL rules could be the issue if they were modified, but they are default. Option B is incorrect because the DB SG inbound rule is from the Web SG, not 0.0.0.0/0. Option D is incorrect because while security groups are stateful, that does not cause unexpected connections; it only ensures return traffic is allowed.

Answer

The network ACL on the private subnet allows inbound traffic from all IPs.

Answer

The DB security group has an inbound rule allowing traffic from 0.0.0.0/0 on port 3306.

Answer

Security groups are stateful, so the DB SG automatically allows inbound responses.