ANS-C01 Network Security, Compliance and Governance Practice Test 31 — 15 Questions

Question 1

A company wants to inspect traffic between VPCs in the same region using a third-party security appliance. Which THREE components are needed? (Choose 3)

Accepted Answer

AWS Transit Gateway. Option C (AWS Transit Gateway) is correct because it acts as a regional hub that connects multiple VPCs and can route inter-VPC traffic through a central inspection point, which is exactly what is needed to steer traffic to a third-party security appliance. Option E (a dedicated inspection VPC for the security appliance) is correct because the appliance must live in its own VPC so that Transit Gateway attachments and route tables can force traffic through it before reaching the destination VPC. Option D (route tables in the inspection VPC directing traffic through the appliance) is correct because without route table entries pointing to the appliance's ENI as the next hop, traffic would bypass inspection; the inspection VPC's route tables are what enforce the traffic flow through the security appliance. Option A (VPC Peering connections between all VPCs) is not needed and would actually bypass the central inspection design, since peering creates direct VPC-to-VPC paths. Option B (NAT Gateways in each VPC) is unrelated to traffic inspection; NAT Gateways only provide outbound internet access for private subnets and do not route or inspect inter-VPC traffic.

Answer

VPC Peering connections between all VPCs

Answer

NAT Gateways in each VPC

Question 2

A company needs to log all network traffic to and from EC2 instances for security analysis. Which TWO services can capture this data? (Choose 2)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, packets, bytes, accept/reject) for traffic to and from network interfaces in a VPC, including EC2 instances, and publishes it to CloudWatch Logs or S3 for security analysis. Traffic Mirroring (D) is correct because it copies the actual packet payloads from an EC2 instance's elastic network interface to a target (another ENI or Network Load Balancer) for deep inspection and analysis, providing full content capture that Flow Logs cannot. AWS Config (A) only records resource configuration changes and compliance state, not network traffic. AWS CloudTrail (C) logs AWS API activity and management events, not packet-level network traffic. Amazon CloudWatch Logs (E) is merely a log storage/analysis destination, not a service that itself captures VPC or EC2 network traffic.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 3

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT Gateway. The security team wants to ensure that traffic from the private subnets to the internet is logged and inspected for malicious activity. Which solution meets these requirements?

Accepted Answer

Configure VPC Traffic Mirroring from the private subnet instances to a network security appliance (e.g., partner firewall) for deep packet inspection.. VPC Traffic Mirroring allows you to capture and mirror all traffic from the elastic network interfaces (ENIs) of instances in private subnets to a network security appliance (e.g., partner firewall) for deep packet inspection and logging. This meets the requirement for inspecting traffic for malicious activity. Option A is incorrect because AWS Shield Advanced provides DDoS protection but does not provide deep packet inspection or logging of all traffic. Option B is incorrect because AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at the application layer, not network-level traffic from private subnets. Option C is incorrect because VPC Flow Logs only capture metadata (IP addresses, ports, protocols) and do not inspect packet payloads for malicious activity.

Answer

Use AWS Shield Advanced to inspect traffic and detect malicious activity.

Answer

Deploy AWS WAF on the NAT Gateway to inspect and filter outgoing traffic.

Answer

Enable VPC Flow Logs on the NAT Gateway and analyze the logs with Amazon Detective.

Question 4

A company wants to allow its employees to securely access internal web applications hosted in a VPC without using a VPN. The solution must authenticate users against the company's Active Directory and apply fine-grained access controls. Which AWS service should be used?

Accepted Answer

AWS Verified Access. AWS Verified Access is the correct service because it provides secure access to corporate applications hosted in a VPC without requiring a VPN, and it integrates with identity providers such as Active Directory for authentication and fine-grained access control. Option A (AWS SSO) is designed for federating access to AWS accounts and applications, not for securing access to internal VPC-based applications without a VPN. Option C (AWS Client VPN) requires VPN client software and a VPN connection, which does not meet the requirement of not using a VPN. Option D (Application Load Balancer with OIDC authentication) can authenticate users but typically requires the ALB to be publicly accessible or connected via VPN, and it does not provide the same purpose-built zero-trust access capabilities as Verified Access.

Answer

AWS Single Sign-On (SSO)

Answer

AWS Client VPN

Answer

Application Load Balancer with OIDC authentication

Question 5

A company is designing a multi-account architecture. They need to centralize VPC flow logs from all accounts into a single Amazon S3 bucket in the security account. The logs must be encrypted at rest using a customer-managed KMS key in the security account. Which combination of steps is required?

Accepted Answer

Configure the KMS key policy to allow the log-producing accounts to use the key, and the S3 bucket policy to allow those accounts to write.. To centralize VPC flow logs with customer-managed KMS encryption, you need both a KMS key policy that grants the log-producing accounts permission to use the key (kms:Encrypt, kms:GenerateDataKey) and an S3 bucket policy that allows those accounts to write objects. Option A is wrong because SSE-S3 cannot be used with cross-account access in this context. Option B is wrong because using separate keys per account defeats centralization. Option D is wrong because without modifying the KMS key policy, cross-account encryption will fail.

Answer

Configure the S3 bucket policy to allow the log accounts to write; encryption is automatic with SSE-S3.

Answer

Create a KMS key in each account and configure the S3 bucket to use each key.

Answer

Create a KMS key in the security account with no key policy changes; use bucket policies to allow cross-account writes.

Question 6

A company uses AWS Certificate Manager (ACM) to issue certificates for a fleet of Application Load Balancers. The security team requires that only specific IAM roles can request, renew, or delete ACM certificates. Which policy type should be used to enforce this?

Accepted Answer

IAM identity-based policies attached to the IAM roles. ACM access is controlled via IAM identity-based policies attached to IAM roles, which allow specifying which roles can request, renew, or delete certificates. Option A is incorrect because AWS managed policies are a type of IAM policy, but the question asks for the policy type used to enforce access for specific IAM roles, and AWS managed policies can be used but are not the only type; however, the key point is that identity-based policies are the mechanism. Option B is incorrect because service control policies (SCPs) apply to all accounts in an AWS Organization and cannot target specific IAM roles within an account. Option D is incorrect because ACM does not support resource-based policies; only IAM policies can be used to control access to certificates.

Answer

AWS managed policies such as AWSCertificateManagerFullAccess

Answer

Service control policies (SCPs) in AWS Organizations

Answer

Resource-based policies attached to the ACM certificates

Question 7

A company has a VPC with multiple security groups. An EC2 instance in security group A needs to communicate with an RDS instance in security group B on port 3306. The security team wants to minimize exposure. What should the inbound rule in security group B be?

Accepted Answer

Allow inbound TCP 3306 from security group A. Referencing security group A as the source allows inbound traffic on port 3306 from any instance associated with security group A, which is the most specific and secure method. This approach automatically adapts if instances in security group A change IP addresses. Option A is wrong because it allows traffic from any instance in the specified subnet, not just those that need to communicate. Option B is wrong because it allows traffic from all IP addresses, violating the principle of least privilege. Option C is wrong because it ties the rule to a single instance's IP address, which can change and requires updates if the instance is replaced.

Answer

Allow inbound TCP 3306 from the CIDR block of the subnet where the EC2 instance resides

Answer

Allow inbound TCP 3306 from 0.0.0.0/0

Answer

Allow inbound TCP 3306 from the private IP address of the EC2 instance

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to inspect all traffic between VPCs and on-premises using a centralized firewall appliance. Which architecture meets this requirement?

Accepted Answer

Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks. To inspect all traffic between VPCs and on-premises, you can create a central inspection VPC that hosts the firewall appliance (e.g., AWS Network Firewall or a third-party firewall) and associate it with the Transit Gateway. Traffic between spokes is then routed through the inspection VPC via Transit Gateway route tables, ensuring all inter-VPC and VPN/Direct Connect traffic is inspected. This is the recommended centralized inspection architecture.

Answer

Deploy AWS Network Firewall in each VPC and route all traffic through it.

Answer

Connect all VPCs to on-premises via AWS Direct Connect and inspect traffic on-premises.

Answer

Create VPC peering connections between each VPC and the firewall VPC.

Question 9

A company wants to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used?

Accepted Answer

aws:SourceVpce. (aws:SourceVpce) is correct because the aws:SourceVpce condition key allows restricting requests to a specific VPC endpoint. Option A (ec2:Vpc) is wrong because ec2:Vpc is an EC2-specific condition key and not applicable to S3. Option B (aws:SourceVpc) is wrong because it restricts to a VPC, not a specific VPC endpoint. Option C (aws:SourceIp) is wrong because it restricts based on IP address, not a VPC endpoint.

Answer

ec2:Vpc

Answer

aws:SourceVpc

Answer

aws:SourceIp

Question 10

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team needs to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is purpose-built to filter HTTP/HTTPS traffic at the application layer (Layer 7) and includes managed rule groups that block SQL injection, cross-site scripting, and other OWASP Top 10 exploits. It integrates natively with Application Load Balancers, CloudFront, and API Gateway. This makes it the correct choice for protecting a web app behind an ALB from common web exploits.

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 11

A company uses AWS Organizations with SCPs to enforce security controls. The security team wants to prevent users from disabling Amazon GuardDuty or modifying its configuration in any member account. Which SCP effect should be used?

Accepted Answer

Deny. 'Deny' because SCPs use Deny to explicitly block actions. Allow is used to whitelist, but SCPs default to Allow, so Deny is needed to override. 'Block' and 'Prevent' are not valid SCP effects.

Answer

Prevent

Answer

Allow

Answer

Block

Question 12

A company is using AWS WAF to protect a web application. They want to block requests that originate from known malicious IP addresses. Which WAF rule type should be used?

Accepted Answer

IP set match condition. IP set match conditions are used to match the source IP address of a request against a list of IP addresses. Regex, string match, and SQL injection are for other attack types.

Answer

String match condition

Answer

Regex match condition

Answer

SQL injection match condition

Question 13

A company wants to enforce that all Amazon S3 buckets in an AWS account are encrypted at rest. Which AWS service can be used to automatically detect and report unencrypted buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously evaluates resource configurations against desired policies. You can enable the managed rule 's3-bucket-server-side-encryption-enabled' to automatically detect S3 buckets that lack default encryption and report them as noncompliant. It provides a detailed compliance dashboard and can trigger remediation actions via SSM Automation. This directly addresses the requirement to detect and report unencrypted buckets.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 14

A company has a VPC with public and private subnets. The security team wants to block all outbound traffic to the internet from the private subnets except for traffic to an AWS service like Amazon S3. Which configuration should be used?

Accepted Answer

Create a VPC endpoint for Amazon S3 and add a route to the endpoint in the private subnet route table.. Creating a VPC endpoint for Amazon S3 and adding a route to the endpoint in the private subnet route table allows private subnets to access S3 without traversing the internet. This configuration blocks all other outbound internet traffic because the private subnet route table does not have a route to an internet gateway or NAT gateway. VPC endpoints use AWS PrivateLink to provide private connectivity to S3.

Answer

Attach an internet gateway to the VPC and add a route to the internet gateway in the private subnet route table.

Answer

Place a proxy server in the private subnet and configure all instances to use it.

Answer

Configure a NAT gateway in the public subnet and update the route table to send 0.0.0.0/0 traffic to the NAT gateway.

Question 15

A company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates for an Application Load Balancer (ALB). The security team notices that an ACM-issued certificate is about to expire. How can they automate renewal?

Accepted Answer

Use AWS Certificate Manager's automatic renewal feature; no additional configuration is required if the certificate was issued by ACM.. ACM-issued certificates are automatically renewed by AWS Certificate Manager as long as the certificate is in use and the domain validation remains valid. No CloudWatch alarm, Lambda function, or manual re-issuance is required — ACM handles renewal transparently before expiration. This is a core benefit of using ACM-issued certificates over imported ones.

Answer

Set a CloudWatch alarm to send a notification when the certificate is about to expire, then manually renew.

Answer

Manually remove the certificate from ACM and re-issue a new one.

Answer

Configure an AWS Lambda function to monitor certificate expiration and re-issue the certificate.