ANS-C01 Network Security, Compliance and Governance Practice Test 3 — 15 Questions

Question 1

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A shared services VPC containing the security appliances.. The shared services VPC hosts the centralized security appliances (e.g., firewalls, intrusion detection systems) that must inspect all inter-VPC traffic. This VPC acts as a hub for traffic inspection, ensuring that both ingress and egress traffic flows through the appliances before reaching its destination.

Answer

VPC peering connections between each spoke VPC and the shared services VPC.

Answer

NAT gateways in each spoke VPC for outbound traffic.

Question 2

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM role can be created without an approved custom trust policy. Which SCP should be attached to the root OU to enforce this requirement?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/Approved":"true"}}}]}. It uses a Deny effect with a condition that only blocks IAM role creation when the request does not include a tag with key 'Approved' set to 'true'. This enforces that every new IAM role must have an approved custom trust policy by requiring the tag as a proxy for approval, while still allowing role creation when the tag is present. The SCP is attached to the root OU to apply globally across all accounts in the organization.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:CreateRole","Resource":"arn:aws:iam::*:role/*","Condition":{"StringNotLike":{"iam:RoleName":"approved-*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"iam:PassRole","Resource":"*"}]}

Question 3

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The security team wants to ensure that traffic between the on-premises network and the VPC is encrypted using IPSec. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN connection over the Direct Connect public virtual interface using a customer gateway and a virtual private gateway.. It establishes an IPSec VPN tunnel over a Direct Connect public virtual interface (VIF), which encrypts traffic between the on-premises network and the VPC. The customer gateway and virtual private gateway create a site-to-site VPN connection that uses IPSec to secure all data traversing the Direct Connect link, meeting the encryption requirement without relying on physical-layer security.

Answer

Use a private virtual interface (VIF) on the Direct Connect connection and enable encryption at the physical layer.

Answer

Use VPC endpoints (Gateway Endpoints) for all traffic between on-premises and the VPC.

Answer

Attach the Direct Connect virtual interface to a Transit Gateway and enable multicast.

Question 4

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

Accepted Answer

Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.. A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Answer

Establish a VPN connection to AWS and route S3 traffic through the VPN.

Answer

Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.

Answer

Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.

Question 5

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer discovers that an EC2 instance was compromised via SSH. The engineer needs to identify which IAM user created the overly permissive security group rule. Which AWS service or feature should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made within the AWS environment, including the AuthorizeSecurityGroupIngress API call that created the overly permissive security group rule. By searching CloudTrail logs for this specific API event, the engineer can identify the IAM user, source IP, and timestamp of the rule creation. VPC Flow Logs, AWS Config, and GuardDuty do not capture IAM user identity for API-level changes.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Transit Gateway with separate route tables for each VPC and a shared route table for the inspection VPC. Use Gateway Load Balancer to distribute traffic to a fleet of firewall instances.. It combines AWS Transit Gateway with separate route tables per VPC and a shared inspection route table, enabling centralized traffic steering to a fleet of firewall instances behind a Gateway Load Balancer (GWLB). GWLB transparently distributes traffic across multiple firewall instances at the network layer (GENEVE protocol), providing both horizontal scalability and high availability without introducing a single point of failure or requiring complex VPC peering meshes.

Answer

Use VPC peering to connect all VPCs to the shared services VPC and route traffic through the firewall.

Answer

Attach all VPCs to a Transit Gateway and configure a Network Load Balancer in the shared services VPC to distribute traffic to firewall instances.

Answer

Attach all VPCs to a Transit Gateway and use a single firewall instance with elastic network interfaces in each VPC.

Question 7

A company has a VPC with public and private subnets. The security team wants to implement a web application firewall to protect against common web exploits. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Application Load Balancer (ALB). An Application Load Balancer (ALB) operates at Layer 7 and can be associated with AWS WAF to inspect HTTP/HTTPS traffic for common web exploits. AWS WAF provides a managed rule set that blocks SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Together, they form a web application firewall (WAF) solution that protects resources in the VPC's private subnets.

Answer

Network Load Balancer (NLB)

Answer

NAT Gateway

Answer

Amazon CloudFront

Question 8

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use security group rules that reference other security groups as sources.. Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.

Answer

Enable VPC Flow Logs on all subnets and send logs to Amazon S3.

Answer

Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.

Question 9

An IAM policy is attached to a user. What is the effect when the user attempts to launch an EC2 instance of type m5.large?

Accepted Answer

The action is denied because the instance type does not equal t2.micro.. The IAM policy attached to the user includes an Allow statement for ec2:RunInstances only when the condition ec2:InstanceType equals t2.micro. Since the user is attempting to launch an m5.large instance, the condition is not satisfied, and the Allow statement does not apply. Consequently, the default implicit deny takes effect, and the action is denied. It is not an explicit denial but rather the absence of an applicable Allow.

Answer

The action is allowed because the policy allows t2.micro instances.

Answer

The action is allowed because there is no explicit allow for RunInstances.

Answer

The action is denied because the condition is not met.

Question 10

A security engineer runs tcpdump on an EC2 instance (10.0.1.5) and sees the output above. The instance is in a private subnet with a security group that allows inbound HTTPS from 0.0.0.0/0. The instance is behind a Network Load Balancer (NLB) that has a public IP. The engineer is unable to establish an HTTPS connection from the internet. What is the most likely cause?

Accepted Answer

The NLB's target group health checks are failing, causing the NLB to consider the instance unhealthy.. The tcpdump output shows the NLB's health check traffic (SYN packets from the NLB's private IPs) reaching the instance, but the engineer cannot establish an HTTPS connection from the internet. If the target group health checks are failing, the NLB marks the instance as unhealthy and stops forwarding traffic to it, which would prevent any internet HTTPS connections from reaching the instance. This is the most likely cause because the security group allows inbound HTTPS from 0.0.0.0/0, and the NLB does not preserve source IP by default, so the security group is not blocking traffic from the internet.

Answer

The NLB is not preserving the source IP, so the security group is blocking the traffic.

Answer

The instance's operating system firewall is blocking the connection.

Answer

The security group is blocking inbound traffic from the NLB.

Question 11

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from a specific AWS Client VPN endpoint. The security team has configured the ALB security group to allow inbound traffic from the Client VPN CIDR range, but users report that they can still access the application from outside the VPN. What is the MOST likely cause of this issue?

Accepted Answer

The ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet.. The ALB security group is configured to allow inbound traffic from the Client VPN CIDR range, but if the ALB itself is internet-facing (i.e., it has public IP addresses and is deployed in public subnets), traffic can bypass the security group rules if the security group is not actually applied to the ALB's network interfaces. The most likely cause is that the ALB security group is not set as the source for inbound traffic; instead, traffic reaches the ALB directly from the internet, meaning the security group rules are not being enforced on the ALB's listener. This allows users outside the VPN to access the application because the ALB accepts traffic from any source unless the security group explicitly restricts it.

Answer

The network ACL is stateless and requires separate inbound and outbound rules for return traffic.

Answer

The subnet's network ACL allows inbound HTTP/HTTPS traffic from 0.0.0.0/0.

Answer

The EC2 instances' security group allows inbound traffic from 0.0.0.0/0.

Question 12

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?

Accepted Answer

Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.. It uses separate Transit Gateway route tables to isolate the inspection VPC and other VPCs. By configuring the route table for VPC A to point to VPC B's CIDR via the inspection VPC attachment, all inter-VPC traffic is forced through the centralized firewall appliances. This leverages Transit Gateway's ability to route traffic between attachments based on route table associations and propagations, ensuring traffic flows through the inspection VPC without requiring VPC peering or additional per-VPC firewalls.

Answer

Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.

Answer

Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.

Answer

Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.

Question 13

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. The bucket policy should deny requests that do not originate from the VPC. Which condition key should be used in the bucket policy?

Accepted Answer

aws:SourceVpc. The correct condition key is `aws:SourceVpc`, which allows you to restrict access to an S3 bucket based on the VPC from which the request originates. When used in a bucket policy with a Deny effect, it ensures that only requests coming from the specified VPC ID are allowed, and all other requests are denied. This key is specifically designed for VPC-based access control in S3 bucket policies.

Answer

aws:VpcSourceIp

Answer

aws:Referer

Answer

aws:SourceIp

Question 14

A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Network Firewall. AWS Network Firewall is a managed, stateful firewall service that provides application-layer filtering and intrusion prevention for VPCs. AWS Firewall Manager offers a centralized dashboard to deploy and manage firewall rules across all accounts in an AWS Organization. Together, they enable consistent, centrally enforced network security policies. In contrast, Network ACLs (option B) are stateless and must be configured per subnet per account—no central management. VPC Flow Logs (option D) capture traffic metadata but do not enforce any rules. Security groups with cross-account references (option E) allow referencing security groups from other accounts but require per-resource attachment and lack central policy enforcement. Therefore, the two correct services are AWS Network Firewall (A) and AWS Firewall Manager (C).

Answer

Network ACLs

Answer

VPC Flow Logs

Answer

VPC security groups with cross-account references

Question 15

A company attaches the above bucket policy to an S3 bucket. A user from the IP range 203.0.113.0/24 makes a request over HTTPS (TLS) to download an object from the bucket. Will the request succeed?

Accepted Answer

Yes, because the request uses HTTPS and comes from the allowed IP range.. The bucket policy includes an Allow statement that grants s3:GetObject access to requests coming from the IP range 203.0.113.0/24 over HTTPS (using the aws:SecureTransport condition). The Deny statement only denies requests that do not use HTTPS (i.e., aws:SecureTransport equals false), so a request from the allowed IP range using TLS is not affected by the Deny and is permitted by the Allow statement.

Answer

Yes, but only if the request also includes a valid AWS signature.

Answer

No, because the Allow statement is overridden by the Deny statement.

Answer

No, because the Deny statement denies all requests regardless of the condition.