ANS-C01 Network Security, Compliance and Governance Practice Test 30 — 15 Questions

Question 1

A company's security team notices that a VPC flow log record shows an outbound connection from a private EC2 instance to an IP address in a restricted country. The security group allows outbound 0.0.0.0/0 for TCP 443. The network ACL allows outbound traffic to 0.0.0.0/0 on ephemeral ports. The company uses AWS Network Firewall with a firewall policy that has a stateful rule group that denies traffic to the restricted country. The flow log shows the traffic was accepted. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The subnet's route table does not have a route that sends traffic to the AWS Network Firewall endpoint.. AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation. Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

Answer

VPC Flow Logs are not capturing all traffic.

Answer

The network ACL inbound rule blocks the return traffic.

Answer

The security group outbound rule is not configured correctly.

Question 2

A company wants to securely connect an on-premises data center to a VPC in AWS. The connection must be encrypted and use the public internet. The company has a moderate volume of traffic and needs a quick setup. Which solution meets these requirements?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN uses IPsec over the public internet to connect an on-premises network to a VPC, providing encryption in transit and quick provisioning (typically minutes). It supports moderate throughput per tunnel (up to ~1.25 Gbps per tunnel) and is the standard answer when encryption plus public internet plus fast setup are required. It is the only option that satisfies all three constraints simultaneously.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no VPC in any account can have an internet gateway attached. Which option meets this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.. A service control policy (SCP) applied at the root organizational unit (OU) level can deny the ec2:AttachInternetGateway action across all accounts in the organization. This centrally enforces the restriction. Option A is incorrect because IAM policies are applied per account and do not prevent the action if the user has permissions through other means. Option B is incorrect because security groups control traffic at the instance level, not internet gateway attachments. Option D is incorrect because network ACLs control traffic at the subnet level, not internet gateway attachments.

Answer

Create an IAM policy that denies ec2:AttachInternetGateway and attach it to each account's admin role.

Answer

Use security groups to block traffic from internet gateways.

Answer

Use network ACLs to block traffic from internet gateways.

Question 4

A company has a VPC with multiple subnets. The network ACL for a subnet is configured to deny all inbound traffic. A security group attached to an EC2 instance in that subnet allows SSH from a specific IP range. Will SSH traffic from that IP range reach the instance?

Accepted Answer

No, because the network ACL denies all inbound traffic.. The network ACL is stateless and evaluated before the security group. Since it denies all inbound traffic, packets are dropped at the subnet boundary and never reach the instance, regardless of the security group's permissive rules. Security groups cannot override network ACLs; they operate at different layers and the NACL takes precedence for inbound traffic.

Answer

Yes, because the security group allows SSH.

Answer

Yes, because the security group overrides the network ACL.

Answer

It depends on the rule number order in the network ACL.

Question 5

A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The application is fronted by Amazon CloudFront and an Application Load Balancer. The security team wants to receive notifications when a DDoS attack is detected. Which AWS service should be used to receive these notifications?

Accepted Answer

Amazon CloudWatch. AWS Shield Advanced integrates with Amazon CloudWatch to emit DDoS detection metrics. You can create a CloudWatch alarm based on these metrics (e.g., DDoSDetected) to send notifications via SNS. Option A (AWS Config) is for resource configuration auditing, not DDoS notifications. Option C (VPC Flow Logs) captures network traffic metadata but does not provide Shield-specific alerts. Option D (Amazon GuardDuty) is a threat detection service, but it does not directly provide Shield Advanced event notifications.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 6

A company wants to allow a specific IP address range to access an EC2 instance in a private subnet using a bastion host. The bastion host is in a public subnet. Which security group configuration is correct?

Accepted Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the bastion security group.. The bastion host in the public subnet must accept SSH from the specific external IP range, and the private instance must only accept SSH from the bastion's security group. This creates a two-hop chain where the private instance trusts the bastion as its source, not the original client IP. Referencing the bastion's security group as the source is the AWS-recommended pattern because it survives IP changes and enforces least privilege.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the bastion security group.

Answer

Bastion security group: inbound SSH from the private instance security group. Private instance security group: inbound SSH from the IP range.

Answer

Bastion security group: inbound SSH from the IP range. Private instance security group: inbound SSH from the IP range.

Question 7

A company has a VPC with a CIDR of 10.0.0.0/16. The VPC contains a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to use a VPC endpoint for S3. Which TWO configurations are required?

Accepted Answer

Create an endpoint policy that allows access to the S3 bucket.. Option B is correct because a gateway VPC endpoint for S3 uses an endpoint policy (a resource-based IAM policy) that must allow the desired S3 bucket actions and resources; without an appropriate policy, access is denied even if routing exists. Option D is correct because a gateway endpoint is targeted via a route in the subnet's route table — you add a route with destination prefix list pl-xxxxxxxx (the S3 prefix list) pointing to the gateway endpoint (vpce-xxxx), which is what enables the private subnet's traffic to reach S3 without NAT or internet. Option A is not required because a private instance can reach S3 through the gateway endpoint without any public IP or internet gateway. Option C is not required because a NAT gateway is only needed for internet-bound traffic, and the gateway endpoint bypasses NAT entirely. Option E is not applicable because gateway endpoints do not use security groups (only interface endpoints do); access control for gateway endpoints is handled by endpoint policies and route tables.

Answer

Assign a public IP address to the EC2 instance.

Answer

Deploy a NAT gateway in the public subnet.

Answer

Attach a security group to the gateway endpoint.

Question 8

A company has a VPC with public and private subnets. An application in the private subnet needs to access an S3 bucket. Which design meets security best practices without exposing the application to the internet?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route table. A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 without internet exposure. Option B (NAT Gateway) would provide internet access but is unnecessary and could expose the application indirectly. Option C (VPN) is overkill and not needed for S3 access within AWS. Option D (Internet Gateway) would expose the application to the internet, violating security best practices.

Answer

Use a NAT Gateway in the public subnet and route traffic through it

Answer

Set up a VPN connection to AWS and route through it

Answer

Attach an Internet Gateway to the VPC and update route tables

Question 9

A security engineer needs to audit all changes to security group rules in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security group rules. Option A (VPC Flow Logs) is wrong because it captures network traffic, not API calls. Option C (AWS Config) is wrong because it records configuration changes, but not the API call history. Option D (Amazon CloudWatch Logs) is wrong because it is used for log storage and monitoring, not for recording API calls.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to connect to the internet for patching. The security team wants to minimize the attack surface. Which solution should be used?

Accepted Answer

Create a NAT Gateway in the public subnet and update route tables. A NAT Gateway in the public subnet allows the EC2 instance in the private subnet to initiate outbound connections to the internet for patching while preventing unsolicited inbound traffic, thus minimizing the attack surface. Option A is incorrect because a proxy server adds unnecessary complexity and overhead compared to a managed NAT Gateway, and it still requires careful configuration to minimize attack surface. Option B is incorrect because an Internet Gateway cannot be attached directly to a private subnet; it is attached to the VPC and requires a public subnet for route propagation. Option D is incorrect because a VPN connection is designed for hybrid connectivity to on-premises networks, not for general internet access from a VPC.

Answer

Set up a proxy server in the public subnet

Answer

Attach an Internet Gateway to the private subnet

Answer

Use a VPN connection to the on-premises network

Question 11

A network engineer needs to block traffic from a specific IP address to an EC2 instance. Which component should be modified?

Accepted Answer

Network ACL. Network ACL, because NACLs are stateless subnet-level firewalls that support explicit deny rules, allowing you to block traffic from a specific source IP address (e.g., a DENY rule for that CIDR) before it reaches the EC2 instance. Security groups only support allow rules and cannot explicitly deny a specific IP, so D is not suitable. A route table (A) controls routing, not traffic filtering, and VPC Flow Logs (B) only capture traffic metadata for monitoring, not block it.

Answer

Route table

Answer

VPC Flow Logs

Answer

Security group

Question 12

A company is deploying a web application behind an Application Load Balancer (ALB). The application must only accept traffic from the ALB. Which security group configuration should be used for the EC2 instances?

Accepted Answer

Allow inbound from the ALB security group on port 80. To ensure the EC2 instances only accept traffic from the ALB, the security group should reference the ALB's security group as the source. This is a best practice because the ALB acts as a proxy, and using its security group dynamically allows traffic from any ALB instance, even if the ALB's IP addresses change. Option A is insecure as it allows traffic from any source (0.0.0.0/0). Option C is not recommended because the ALB's private IP addresses can change (e.g., during scaling or replacement), making static IP rules difficult to maintain. Option D is too broad, as it would allow traffic from any resource within the VPC CIDR, not just the ALB.

Answer

Allow inbound from 0.0.0.0/0 on port 80

Answer

Allow inbound from the ALB's private IP addresses on port 80

Answer

Allow inbound from the VPC CIDR on port 80

Question 13

A company wants to centrally manage and enforce VPC security group rules across multiple accounts in AWS Organizations. Which AWS service should be used?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the correct service for centrally managing and enforcing VPC security group rules across multiple accounts in AWS Organizations. It provides centralized security policy management, allowing you to define common security group rules and automatically apply them to new and existing accounts. AWS Config (Option A) is primarily for compliance auditing and resource configuration history, not enforcement. AWS CloudFormation StackSets (Option B) can deploy resources across accounts but does not provide ongoing enforcement of security policies. IAM Policies (Option D) control permissions, not security group configurations.

Answer

AWS Config

Answer

AWS CloudFormation StackSets

Answer

IAM Policies

Question 14

A company wants to encrypt data in transit between an on-premises data center and AWS. Which service provides a dedicated encrypted connection?

Accepted Answer

AWS Direct Connect with MACsec. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, and enabling MACsec (IEEE 802.1AE) on the dedicated connection encrypts data in transit at Layer 2. This satisfies the requirement for a dedicated encrypted connection without relying on IPsec over the public internet.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 15

A security engineer is designing a VPC with public and private subnets. The company requires that instances in the private subnet can initiate outbound connections to the internet but cannot receive inbound connections from the internet. Which TWO components are necessary? (Choose 2)

Accepted Answer

NAT Gateway in the public subnet. Option C is correct because a NAT Gateway must be deployed in a public subnet (with an Elastic IP) to perform source NAT, allowing private-subnet instances to initiate outbound internet traffic while remaining unreachable from inbound internet connections. Option E is correct because the private subnet's route table must contain a route (typically 0.0.0.0/0) targeting that NAT Gateway so the instances' outbound packets are actually forwarded to it. Option A is incorrect because a VPC Gateway Endpoint for S3 only provides private access to S3, not general internet connectivity. Option B is incorrect because allowing inbound 0.0.0.0/0 would permit inbound internet connections, violating the requirement. Option D is incorrect because an Internet Gateway is attached to a VPC (not a subnet) and is used by public subnets; attaching it to a private subnet would make resources publicly reachable.

Answer

VPC Gateway Endpoint for S3

Answer

Security group allowing inbound traffic from 0.0.0.0/0

Answer

Internet Gateway attached to the private subnet