ANS-C01 Network Security, Compliance and Governance Practice Test 32 — 15 Questions

Question 1

A security engineer attaches the above IAM policy to an IAM user. The user then attempts to launch an EC2 instance from an IP address outside the 10.0.0.0/8 range. What will happen?

Accepted Answer

The request will be denied because the condition is not satisfied.. The policy allows ec2:* only when the source IP is within 10.0.0.0/8. If the user is coming from outside that range, the condition is not met, so the action is not allowed. The default is implicit deny, so the request will be denied. Option B is correct. Option A is wrong because the condition is not met. Option C is wrong because the policy does not deny explicitly; it just doesn't allow. Option D is wrong because the condition evaluates to false.

Answer

The request will be allowed because the policy allows ec2:* on all resources.

Answer

The request will be denied because the policy does not include a Deny statement.

Answer

The request will be allowed because the condition evaluates to true.

Question 2

A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to initiate outbound internet traffic while preventing inbound internet traffic from reaching them. It is deployed in a public subnet and uses an Elastic IP.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 3

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should they use?

Accepted Answer

S3 server-side encryption and CloudTrail log file validation. S3 server-side encryption (SSE) ensures CloudTrail log files delivered to the S3 bucket are encrypted at rest, while CloudTrail log file validation generates digest files with digital signatures that let you verify logs have not been tampered with or modified after delivery. Together these directly satisfy both requirements: encryption at rest and tamper detection. Option B does not fit because KMS alone does not provide tamper detection for CloudTrail logs, and CloudWatch Logs is a separate log destination rather than the mechanism for validating S3-delivered trail files. Option C does not fit because bucket policies and versioning control access and preserve object history but do not provide cryptographic integrity validation of log contents. Option D does not fit because IAM roles and bucket policies only manage authorization and access, not encryption at rest or tamper detection.

Answer

AWS KMS and CloudWatch Logs

Answer

S3 bucket policies and versioning

Answer

IAM roles and S3 bucket policies

Question 4

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests that contain SQL injection attacks. Which WAF rule type should they use?

Accepted Answer

Managed rule group for SQL injection. AWS WAF provides managed rule groups specifically designed to detect common web threats, including SQL injection attacks. The 'Managed rule group for SQL injection' contains pre-configured rules that inspect request components (such as query strings, URI, and body) for SQL injection patterns, making it the correct choice for blocking such attacks without requiring custom rule authoring.

Answer

IP set rule

Answer

Rate-based rule

Answer

Geographic match rule

Question 5

A company needs to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which policy element should be used in an IAM policy to deny access if MFA is not present?

Accepted Answer

Condition. The Condition element in an IAM policy allows you to specify conditions for when a policy is in effect. To deny access if MFA is not present, you use the `aws:MultiFactorAuthPresent` condition key with a Boolean value of `false`. This ensures that only requests authenticated with MFA are allowed, enforcing the security requirement.

Answer

Resource

Answer

Action

Answer

Effect

Question 6

A company is using Amazon Route 53 for DNS resolution. They want to restrict access to a private hosted zone so that only authorized VPCs can query it. Which configuration should they use?

Accepted Answer

Associate the private hosted zone with the authorized VPCs. Amazon Route 53 private hosted zones are only accessible to VPCs that are explicitly associated with them. By associating the private hosted zone with the authorized VPCs, you restrict DNS queries to only those VPCs. This is the intended mechanism for controlling access to private hosted zones.

Answer

Configure a network ACL to block UDP port 53 from other VPCs

Answer

Create an IAM policy to deny DNS queries from other VPCs

Answer

Configure a security group to block DNS traffic from other VPCs

Question 7

A company is using AWS Shield Advanced to protect against DDoS attacks. They want to receive notifications when an attack is detected. Which AWS service should they integrate with to receive notifications?

Accepted Answer

Amazon CloudWatch and Amazon Simple Notification Service (SNS). AWS Shield Advanced sends metrics to CloudWatch, and you can create CloudWatch alarms to trigger SNS notifications. Option A (SQS) is for queuing. Option B (Lambda) can be triggered but SNS is simpler. Option D (Kinesis) is for streaming.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon Kinesis Data Streams

Question 8

A company is designing a network security architecture for a multi-tier web application. Which THREE best practices should they implement? (Choose three.)

Accepted Answer

Use network ACLs as a stateless firewall for subnet-level traffic. Option C is correct because network ACLs (NACLs) are stateless, subnet-level firewalls in AWS that evaluate inbound and outbound rules independently, making them appropriate for controlling traffic at the subnet boundary. Option D is correct because databases should be placed in private subnets without a route to an internet gateway, ensuring no direct inbound or outbound internet access and reducing the attack surface for sensitive data. Option E is correct because security groups operate at the instance (ENI) level and are stateful, allowing precise control of allowed inbound and outbound traffic for each resource. Option A is incorrect because an internet gateway is attached to a VPC and used by public subnets for internet access; private subnets typically use a NAT gateway or NAT instance for outbound traffic instead. Option B is incorrect because security groups are stateful, not stateless, so describing them as a stateless firewall is technically wrong.

Answer

Attach an internet gateway to the private subnet for outbound traffic

Answer

Use security groups as a stateless firewall

Question 9

Which THREE components are necessary to enable encryption in transit for traffic between an on-premises data center and an Amazon VPC over AWS Site-to-Site VPN? (Choose three.)

Accepted Answer

A customer gateway (CGW) in the on-premises network. Option A is correct because the customer gateway (CGW) is the AWS resource representing the on-premises VPN device that terminates the Site-to-Site VPN connection and participates in the IPsec negotiation. Option D is correct because the virtual private gateway (VGW) is the AWS-side VPN concentrator attached to the VPC that terminates the other end of the tunnel. Option E is correct because encryption in transit over a Site-to-Site VPN is provided by the IPsec VPN tunnel established between the VGW and the CGW, which encrypts and authenticates the traffic. Option B is not required because an internet gateway (IGW) is used for direct internet access to a VPC, not for terminating Site-to-Site VPN tunnels. Option C is not required because Site-to-Site VPN uses IPsec (IKE) with pre-shared keys and does not rely on an SSL/TLS certificate for the tunnel.

Answer

An internet gateway (IGW) attached to the VPC

Answer

An SSL/TLS certificate for the VPN tunnel

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The company wants to avoid using a NAT gateway and ensure that traffic does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and update the route table. A VPC endpoint for S3 (Gateway type) allows instances in a private subnet to access S3 without traversing the internet or using a NAT gateway. The endpoint is attached to the VPC, and the route table for the private subnet is updated to route S3 traffic through the endpoint. This keeps traffic within the AWS network.

Answer

Attach an internet gateway to the VPC and assign a public IP to the instance

Answer

Set up a VPN connection to the S3 bucket

Answer

Deploy a NAT gateway in the public subnet and route traffic through it

Question 11

A security team is designing a network architecture that must meet PCI DSS compliance. They have a VPC with multiple subnets and need to ensure that all traffic between subnets is inspected by a stateful firewall. The solution must also support scalability and high availability. Which AWS service should they use?

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides stateful inspection, scales automatically, and supports high availability, making it suitable for PCI DSS compliance. Option B (security groups) is wrong because security groups are stateful but operate at the instance level and do not provide centralized traffic inspection between subnets. Option C (AWS WAF) is wrong because it focuses on web application layer (HTTP/S) traffic, not network-layer inspection. Option D (Network ACLs) is wrong because they are stateless and only provide basic allow/deny rules without stateful inspection.

Answer

Security groups on each subnet

Answer

AWS WAF

Answer

Network ACLs on each subnet

Question 12

A company uses AWS Organizations and has multiple VPCs in different accounts. They want to centrally manage network firewall rules for all VPCs using a single firewall policy. Which AWS service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager centrally manages and enforces firewall policies, including AWS Network Firewall, WAF, and security group policies, across all accounts and VPCs in an AWS Organization. It is designed exactly for this multi-account, single-policy governance use case. Network Firewall provides the firewall capability, but Firewall Manager is what applies it centrally.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 13

Which TWO measures can be taken to protect an AWS account's root user credentials? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use that instead of the root user. Option A is correct because creating an IAM user with administrative privileges and using that identity for everyday work removes the need to sign in as the root user, whose credentials grant unrestricted access to the entire account and cannot be scoped down. Option D is correct because enabling MFA on the root user adds a second authentication factor, so a leaked root password alone is insufficient to compromise the account, and AWS strongly recommends MFA on the root user. Option B is wrong because using the root user for daily administrative tasks maximizes exposure of the most powerful credentials in the account. Option C is wrong because the root user account cannot be deleted; it is permanently tied to the account. Option E is wrong because storing root credentials in a shared password manager increases the attack surface and does not provide the strong, account-level protection that MFA and IAM-based access do.

Answer

Use the root user for daily administrative tasks

Answer

Delete the root user account after creating IAM users

Answer

Store the root user credentials in a shared password manager

Question 14

A company has a VPC with a public subnet containing a NAT gateway and a private subnet with EC2 instances. The EC2 instances need to access an S3 bucket. The security team wants to log all S3 API calls made by the instances. Which approach should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and enable AWS CloudTrail to log S3 API calls. Option D is correct because a Gateway VPC endpoint for S3 lets the private-subnet EC2 instances reach S3 without traversing the NAT gateway or the internet, and AWS CloudTrail records S3 API calls (data events for object-level activity, management events for bucket-level actions) to provide the required audit logging. This combination satisfies both the connectivity and logging requirements in the scenario. Option A is wrong because CloudWatch Logs captures application logs from the instances, not S3 API calls. Option B is wrong because a proxy server does not provide native S3 API audit logging and adds unnecessary infrastructure. Option C is wrong because VPC Flow Logs capture IP-level traffic metadata, not S3 API operations.

Answer

Enable Amazon CloudWatch Logs on the instances to capture application logs

Answer

Configure a proxy server in the public subnet and use it for S3 access

Answer

Enable VPC Flow Logs on the private subnet

Question 15

A company has a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets are encrypted with SSE-KMS using a specific KMS key. Which policy should they use?

Accepted Answer

SCP in AWS Organizations. Service Control Policies (SCPs) in AWS Organizations can enforce permissions across all accounts, including denying the creation of S3 buckets without SSE-KMS encryption using a specific key. SCPs are the only option that provides centralized, preventive control across multiple accounts.

Answer

S3 bucket policy on each bucket

Answer

IAM policy in each account

Answer

AWS Config rule with auto-remediation