ANS-C01 Network Security, Compliance and Governance Practice Test 3 — 15 Questions

Question 1

A company uses AWS Organizations with SCPs to restrict access. The security team wants to ensure that no IAM user or role can disable AWS Shield Advanced protections. Which SCP effect should be used?

Accepted Answer

Deny. (Deny) is correct because the Deny effect in an SCP explicitly prohibits specified actions, overriding any Allow statements in IAM policies. Option A (Deny in IAM policy) is not an SCP effect; SCPs are separate from IAM policies. Option C (Allow) permits actions but does not restrict, so it cannot be used to enforce prohibitions. Option D (Block) is invalid; AWS SCPs use Deny, not Block.

Answer

Deny in the IAM policy

Answer

Allow

Answer

Block

Question 2

A company needs to securely connect an on-premises data center to AWS using multiple VPN tunnels. The security team requires that all traffic between the VPC and on-premises be encrypted and that the tunnels use a second authentication mechanism beyond pre-shared keys. Which solution meets these requirements?

Accepted Answer

Use AWS VPN CloudHub with multiple VPN connections and configure certificate-based authentication for each tunnel. AWS VPN CloudHub allows multiple VPN connections with BGP routing and supports certificate-based authentication (mutual TLS) for each tunnel, providing a second authentication mechanism beyond pre-shared keys. Option A is incorrect because AWS Client VPN is designed for individual remote users, not for site-to-site connectivity between an on-premises data center and a VPC. Option B is incorrect because AWS Transit Gateway with VPN attachments uses pre-shared keys by default and does not support certificate-based authentication for the VPN tunnels. Option D is incorrect because while AWS Direct Connect with a public VIF and an IPsec VPN over it can provide encrypted traffic, the VPN itself typically relies on pre-shared keys, not a second authentication factor.

Answer

Use AWS Client VPN with mutual authentication

Answer

Use AWS Transit Gateway with VPN attachments and configure pre-shared keys

Answer

Use AWS Direct Connect with a public VIF and establish an IPsec VPN over the Direct Connect connection

Question 3

A company is migrating a legacy application to AWS. The application requires that all network traffic between two VPCs be inspected by a third-party firewall appliance. The firewall must be able to inspect traffic bidirectionally and automatically fail over if the appliance becomes unhealthy. Which architecture meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a Network Load Balancer in front of multiple firewall appliances. AWS Transit Gateway with a Network Load Balancer (NLB) in front of multiple firewall appliances enables bidirectional traffic inspection and automatic failover. The NLB performs health checks and distributes traffic to healthy firewall instances, ensuring high availability. Option B is wrong because VPC Peering does not support a central inspection point; traffic flows directly between VPCs without passing through a firewall. Option C is wrong because a single firewall instance is a single point of failure, lacking automatic failover. Option D is wrong because AWS PrivateLink uses VPC Endpoints for connectivity, which does not allow traffic inspection by a third-party firewall in the consumer VPC; it only allows one-way initiated connections.

Answer

Use VPC Peering between the two VPCs and route traffic through a firewall instance in one of the VPCs

Answer

Deploy a single firewall instance in a shared VPC and route all inter-VPC traffic through it

Answer

Use AWS PrivateLink to connect the VPCs and place the firewall in the consumer VPC

Question 4

A security engineer is configuring AWS CloudTrail to log all management events across all regions. The logs must be stored in an S3 bucket that is encrypted with an AWS KMS key. Which bucket policy element is required to allow CloudTrail to write logs?

Accepted Answer

kms:GenerateDataKey. When CloudTrail writes encrypted log files to an S3 bucket using SSE-KMS, it must call kms:GenerateDataKey to obtain a data key for encrypting each object. Without this permission in the bucket policy (or the KMS key policy), CloudTrail cannot write the logs. This is the specific KMS action CloudTrail requires for SSE-KMS delivery.

Answer

kms:Encrypt

Answer

kms:CreateKey

Answer

kms:Decrypt

Question 5

A company uses AWS Shield Advanced for DDoS protection. During an attack, the security team notices that legitimate traffic is being throttled. They want to allow certain known IP addresses to bypass Shield Advanced rate-based rules. What should they do?

Accepted Answer

Create an AWS WAF rule with an IP set that allows the known IPs, and place it before the rate-based rule. AWS WAF rules can be configured with IP sets to allow traffic from specific IPs before applying rate-based rules. Option A is wrong because Shield Advanced does not support custom allow lists directly; it works with WAF. Option B is wrong because disabling rate-based rules would remove protection for all traffic. Option D is wrong because Shield Advanced does not have a bypass feature; it uses WAF for custom rules.

Answer

Disable rate-based rules during the attack

Answer

Use Shield Advanced automatic application layer DDoS mitigation

Answer

Create an allow list in AWS Shield Advanced to exempt the IPs from all protections

Question 6

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive data that should only be accessible from the corporate network (192.0.2.0/24). What is a potential security issue with this policy?

Accepted Answer

The policy does not require authentication; anonymous access is allowed from the specified IP range. The bucket policy likely grants access to the 192.0.2.0/24 IP range without specifying an authenticated principal (e.g., using Principal: "*"), which means anyone from that IP range — including unauthenticated/anonymous requests — can access the bucket. The correct fix is to require authentication (e.g., aws:PrincipalArn or aws:SourceArn conditions) or restrict to specific IAM principals.

Answer

The condition should be applied to the Principal element

Answer

The Resource ARN is missing the bucket name

Answer

The IP address range is not specific enough

Question 7

Refer to the exhibit. A network engineer is troubleshooting connectivity issues from an EC2 instance in subnet-11111111. The instance can send traffic outbound, but cannot receive inbound HTTPS traffic from the internet. What is the likely cause?

Accepted Answer

The inbound rule only allows HTTPS, but the outbound rule allows all traffic; this is correct. The correct option is A: the inbound rule only allows HTTPS while the outbound rule allows all traffic, which is the correct configuration for this scenario. Security groups are stateful, so return traffic for outbound-initiated connections is automatically allowed regardless of inbound rules; an inbound-only HTTPS rule does not block responses to outbound requests. Since the instance can send traffic outbound but cannot receive inbound HTTPS from the internet, the issue is not the security group rule set described in A. Option B is wrong because a NACL not associated with the subnet would affect all traffic, not selectively block inbound HTTPS while allowing outbound. Option C is wrong because ICMP is not required for HTTPS connectivity. Option D is wrong because restricting outbound traffic to ephemeral ports would not fix inbound HTTPS and is unnecessary given stateful security groups.

Answer

The NACL is not associated with the correct subnet

Answer

The inbound rule should also allow ICMP traffic

Answer

The outbound rule should restrict traffic to only ephemeral ports

Question 8

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all Amazon S3 buckets in the organization are encrypted at rest. Which policy should be attached to the root organizational unit to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. A service control policy (SCP) attached to the root OU applies to all accounts in the organization and can enforce encryption by denying s3:CreateBucket unless default encryption is enabled. SCPs are the correct mechanism for organization-wide preventive controls.

Answer

Configure AWS Config rules to mark non-compliant buckets and trigger a Lambda function to add encryption.

Answer

Create an IAM role in each account that requires encryption for any S3 operation.

Answer

Use an S3 bucket policy on every existing and future bucket to deny unencrypted uploads.

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team needs to block a specific IP address range that has been launching DDoS attacks. The solution must be implemented at the network edge, before traffic reaches the ALB. What should the security team do?

Accepted Answer

Create an AWS WAF web ACL with an IP set rule that blocks the IP range and attach it to the ALB.. AWS WAF is a web application firewall that can inspect and block traffic based on IP sets, and it can be attached directly to an Application Load Balancer (ALB). This allows blocking the IP range at the ALB, which is the network edge for the web application, before traffic reaches the backend instances. AWS WAF operates at layer 7 and is designed for this purpose, providing granular control over HTTP/HTTPS traffic.

Answer

Update the security group for the ALB to deny traffic from the IP range.

Answer

Add a network ACL rule on the ALB's subnet to deny inbound traffic from the IP range.

Answer

Deploy Amazon CloudFront in front of the ALB and use AWS WAF to block the IP range at CloudFront.

Question 10

A company is migrating a legacy application to AWS. The application requires that all traffic between the web and application tiers be encrypted, but the application does not support TLS. What should a network engineer do to meet this requirement without modifying the application?

Accepted Answer

Establish a VPN connection between the web and application instances.. Establishing a VPN connection between the web and application instances encrypts all traffic at the network layer, making encryption transparent to the application. This meets the requirement without modifying the application. Option B is incorrect because a Network Load Balancer with TLS termination only encrypts traffic between clients and the NLB; traffic from the NLB to targets is sent in cleartext, so targets must support TLS for end-to-end encryption. Since the application does not support TLS, this does not satisfy the requirement. Option C is incorrect because an Application Load Balancer terminates TLS but forwards HTTP traffic to targets in cleartext. Option D is incorrect because a Classic Load Balancer with TCP listeners does not provide any encryption.

Answer

Use a Network Load Balancer (NLB) with TLS termination and target groups with TCP, then enable encryption on the NLB.

Answer

Use an Application Load Balancer (ALB) with TLS termination between the tiers.

Answer

Use a Classic Load Balancer with TCP listeners.

Question 11

A company has a VPC with public and private subnets. The security team wants to inspect all traffic leaving the VPC to the internet for malicious activity. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

VPC Flow Logs. A NAT gateway (E) enables outbound traffic from private subnets to the internet. VPC Flow Logs (A) capture metadata of traffic flows. Amazon GuardDuty (C) can analyze flow logs to detect malicious activity. Together, these three services allow inspection of all outbound traffic. Option B (Internet gateway) is for inbound traffic from the internet. Option D (AWS Network Firewall) can also inspect traffic but is not part of this common three-service combination.

Answer

Internet gateway

Answer

AWS Network Firewall

Question 12

A company wants to secure data at rest in an Amazon S3 bucket. Which TWO of the following can be used to achieve this? (Choose two.)

Accepted Answer

Enable server-side encryption (SSE-S3) on the bucket.. Option A is correct because enabling server-side encryption with S3-managed keys (SSE-S3, i.e., AES-256) causes S3 to encrypt each object at rest automatically, directly protecting data stored in the bucket. Option C is correct because a bucket policy that denies s3:PutObject requests lacking the x-amz-server-side-encryption header (or using aws:SecureTransport/encryption conditions) enforces that only encrypted objects can be uploaded, ensuring data at rest remains encrypted. Option B is wrong because an S3 VPC endpoint (gateway endpoint) only provides private network routing to S3, not encryption of stored objects. Option D is wrong because client-side encryption with AWS KMS encrypts data before it reaches S3 and is performed by the client, not a bucket-level S3 feature for securing data at rest in the bucket. Option E is wrong because S3 Transfer Acceleration only speeds up uploads via AWS edge locations and has no encryption function.

Answer

Use an S3 VPC endpoint.

Answer

Use client-side encryption with AWS KMS.

Answer

Enable S3 Transfer Acceleration.

Question 13

A security engineer created the S3 bucket policy shown. After applying it, users from the 10.0.0.0/16 network (VPC CIDR) are able to access objects, but external users from 203.0.113.0/24 receive 'Access Denied' even though they are using HTTPS. What is the likely cause?

Accepted Answer

The VPC endpoint policy for the S3 endpoint restricts access to the bucket.. The correct answer is A: the VPC endpoint policy for the S3 endpoint restricts access to the bucket. When S3 access from a VPC uses a gateway VPC endpoint, the endpoint's own policy is evaluated in addition to the bucket policy, and if that endpoint policy only permits requests from the VPC CIDR (10.0.0.0/16), external users from 203.0.113.0/24 are denied even though the bucket policy might otherwise allow them. This explains why VPC users succeed while external HTTPS users get Access Denied. Option B is wrong because the scenario describes object access, not listing, and the error is not caused by the action mismatch. Option C is wrong because an explicit Deny is not required to block external users; the absence of an Allow is sufficient. Option D is wrong because S3 Block Public Access would also affect the VPC users unless the access is not treated as public, and it does not specifically explain the VPC-versus-external split.

Answer

The policy only allows 's3:GetObject' but the users are trying to list objects.

Answer

The policy does not include a 'Deny' statement for non-IP ranges.

Answer

The S3 bucket has 'Block public access' enabled, which overrides the policy.

Question 14

A network administrator attached the IAM policy shown to a user. The user tries to create an internet gateway in us-east-1 without any tags. What will happen?

Accepted Answer

The internet gateway creation is denied because the Deny statement applies.. The IAM policy contains an explicit Deny statement that applies to the action ec2:CreateInternetGateway under the condition that the request has no tags (aws:RequestTag absent). Since the user attempts to create an internet gateway without any tags, the condition matches, and the Deny statement overrides any Allow. Therefore, the creation is denied. This is correct because in IAM, an explicit Deny always takes precedence over any Allow.

Answer

The internet gateway creation fails because the first statement does not allow it in us-east-1.

Answer

The internet gateway is created but the user receives a warning.

Answer

The internet gateway is created successfully because the first statement allows it.

Question 15

A company wants to restrict access to an S3 bucket so that only traffic from a specific AWS account is allowed. Which S3 bucket policy condition key should be used to achieve this?

Accepted Answer

aws:SourceAccount. The condition key aws:SourceAccount is used in S3 bucket policies to restrict access to requests originating from a specific AWS account. When used in a bucket policy, it checks the account ID of the source of the request, ensuring that only traffic from that account is allowed. This is the correct key to restrict access based on the AWS account.

Answer

aws:PrincipalAccount

Answer

aws:Referer

Answer

aws:SourceArn