ANS-C01 Network Security, Compliance and Governance Practice Test 33 — 15 Questions

Question 1

A company is using AWS Direct Connect to connect their on-premises network to AWS. They need to ensure that traffic from a specific on-premises subnet can only access a specific VPC subnet. Which two components must be configured? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route tables with specific routes. Option D (Private virtual interface) is correct because a private VIF is the Direct Connect component that provides access to resources within a VPC using private IP addresses, which is exactly what is needed to reach a specific VPC subnet from on-premises. Option B (Route tables with specific routes) is correct because you must configure route tables on both sides — the VPC route table and the on-premises router — with specific routes (for example, the on-premises subnet CIDR pointing to the virtual private gateway, and the VPC subnet CIDR pointing to the Direct Connect attachment) to constrain traffic to only that subnet pair. Option A (VPN connection) is not required because Direct Connect alone can carry this private traffic; a VPN would be an alternative or backup path, not a mandatory component. Option C (Public VIF) is incorrect because public VIFs are used to access AWS public services and public IP addresses, not private VPC subnets. Option E (Transit VIF) is incorrect because a transit VIF connects to a Direct Connect gateway for reaching multiple VPCs via a transit gateway, which is unnecessary and not the mechanism for a single specific VPC subnet.

Answer

VPN connection

Answer

Public virtual interface (VIF)

Answer

Transit virtual interface (VIF)

Question 2

A company needs to audit all changes to security groups in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct choice because it records API activity in the account, including security group creation, modification, and deletion events (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress), providing the audit trail of who made each change, when, and from where. This directly satisfies the requirement to audit all changes to security groups. AWS Config (A) evaluates resource configurations and compliance over time but is not the primary API-change audit log. Amazon CloudWatch Logs (C) stores and monitors log data but does not itself capture security group API calls. VPC Flow Logs (D) capture IP traffic metadata for network interfaces, not security group configuration changes.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 3

A company has a VPC with multiple subnets. They want to block all traffic from the internet to their private subnets, but allow outbound internet traffic from those subnets through a NAT Gateway. Which configuration should they use?

Accepted Answer

Route table with 0.0.0.0/0 -> NAT Gateway. A route table associated with the private subnets should have a default route (0.0.0.0/0) pointing to the NAT Gateway. This allows outbound internet traffic while blocking inbound internet traffic. Option B (Virtual Private Gateway) is for VPN connections. Option C (VPC Peering) is for connectivity between VPCs. Option D (Internet Gateway) would allow inbound internet traffic, which is not desired.

Answer

Route table with 0.0.0.0/0 -> Virtual Private Gateway

Answer

Route table with 0.0.0.0/0 -> VPC Peering Connection

Answer

Route table with 0.0.0.0/0 -> Internet Gateway

Question 4

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which type of policy should they use?

Accepted Answer

S3 bucket policy with aws:SourceVpce condition. To restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed, you use an S3 bucket policy with the aws:SourceVpce condition key. This condition checks the VPC endpoint ID through which the request arrived, allowing you to deny or allow access based on that endpoint. It is the standard mechanism for enforcing that S3 access originates exclusively from a designated VPC endpoint.

Answer

S3 bucket policy with aws:SourceIp condition

Answer

IAM policy

Answer

VPC endpoint policy

Question 5

A company has a VPC with an internet-facing Application Load Balancer (ALB) that routes traffic to EC2 instances in private subnets. The security team wants to block traffic from specific geographic regions. Which AWS service should they use?

Accepted Answer

AWS WAF. AWS WAF is the correct choice because it integrates directly with an internet-facing Application Load Balancer and supports geographic match conditions (geo-blocking) that can block requests originating from specified countries or regions. AWS Shield Advanced is designed for DDoS protection and does not provide geographic traffic filtering. Network ACLs operate at the subnet level and filter only by IP, port, and protocol, so they cannot identify geographic regions. Security Groups are stateful instance-level firewalls that also lack any geographic filtering capability.

Answer

AWS Shield Advanced

Answer

Network ACLs

Answer

Security Groups

Question 6

A company is using AWS Client VPN to provide remote access to their VPC. They want to ensure that only authenticated users from their corporate Active Directory can access the VPN. Which authentication method should they use?

Accepted Answer

SAML-based federated authentication. AWS Client VPN supports SAML-based federated authentication, which can integrate with your corporate Active Directory to authenticate users. Option A is wrong because IAM authorization is not an authentication method for Client VPN; it is used for controlling access to AWS APIs. Option C is wrong because certificate-based authentication uses client certificates and does not directly tie to Active Directory user identities. Option D is wrong because mutual authentication still relies on certificates and does not inherently provide integration with Active Directory.

Answer

IAM authorization

Answer

Certificate-based authentication using AWS Certificate Manager

Answer

Mutual authentication

Question 7

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

Accepted Answer

Remove any inbound rule that allows TCP port 22. Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22. This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs. Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Answer

Add an inbound rule to deny TCP port 22

Answer

Add an inbound deny rule for TCP port 22 to the network ACL

Answer

Add an outbound rule to deny TCP port 22

Question 8

A company uses AWS Transit Gateway to connect multiple VPCs. Security requirements mandate that traffic between VPCs must be inspected by a centralized firewall appliance in a dedicated inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

Accepted Answer

Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment. Configuring Transit Gateway route tables with blackhole routes for inter-VPC traffic forces that traffic to be dropped unless a more specific route exists. By adding a default route pointing to the inspection VPC attachment, all inter-VPC traffic is routed through the inspection VPC for centralized firewall inspection. This approach is efficient and scalable. Option A is incorrect because deploying AWS Network Firewall in each VPC distributes inspection and does not centralize it. Option B is incorrect because Transit Gateway multicast is designed for one-to-many data replication, not for routing traffic through a central inspection point. Option D is incorrect because VPC peering connections do not provide centralized routing control and do not scale well as the number of VPCs increases.

Answer

Deploy AWS Network Firewall in each VPC and configure central logging

Answer

Use Transit Gateway multicast to replicate traffic to the inspection VPC

Answer

Create VPC peering connections between all VPCs and the inspection VPC, then configure route tables to send traffic through the peering connection

Question 9

A company is designing a security group rule to allow outbound HTTPS traffic (TCP 443) to a specific external service IP range 203.0.113.0/24. The security group is attached to a fleet of EC2 instances. Which rule should be added?

Accepted Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/24. Option D is correct because it specifies an outbound (egress) security group rule with Type HTTPS, Protocol TCP, Port 443, and Destination 203.0.113.0/24, which exactly matches the requirement to allow TCP 443 traffic to that external IP range. In an egress rule, the destination field must be the remote IP range, and 203.0.113.0/24 correctly represents the entire /24 range. Option A is wrong because 203.0.113.0/32 allows only a single host, not the whole range. Option B is wrong because the prefix list pl-12345 is not the specified IP range and would only work if such a prefix list existed and contained that range. Option C is wrong because Source is used in inbound rules, not outbound rules, so it would not permit egress traffic to the external service.

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: 203.0.113.0/32

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Destination: pl-12345 (prefix list for the IP range)

Answer

Type: HTTPS, Protocol: TCP, Port: 443, Source: 203.0.113.0/24

Question 10

A company wants to audit all Network Load Balancer (NLB) operations performed in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for all AWS services, including Network Load Balancer (NLB) operations. Therefore, to audit NLB operations, CloudTrail should be used. Option B (Amazon CloudWatch Logs) stores logs but does not natively capture API calls. Option C (AWS Config) tracks resource configurations and changes, not API operations. Option D (VPC Flow Logs) captures network traffic information, not API calls. Hence, Option A is correct.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

VPC Flow Logs

Question 11

A company is designing a VPC with public and private subnets. The private subnets need to access Amazon S3 and Amazon DynamoDB. The company wants to minimize data transfer costs and avoid using a NAT gateway. What is the MOST cost-effective solution?

Accepted Answer

Create VPC endpoints for S3 and DynamoDB in the private subnets and update route tables. VPC endpoints for S3 and DynamoDB allow private connectivity without incurring data transfer costs or NAT gateway fees. Option A is wrong because an HTTP proxy adds complexity and cost. Option B is wrong because a NAT instance still incurs instance costs and management overhead. Option D is wrong because a NAT gateway incurs hourly and data processing charges.

Answer

Set up an HTTP proxy in the private subnets and configure the applications to use it

Answer

Use a NAT instance instead of a NAT gateway

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it

Question 12

A company's security team is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Place application and database servers in private subnets. Option C is correct because placing the application and database servers in private subnets removes them from direct internet reachability, since private subnets have no route to an Internet Gateway, thereby isolating the back-end tiers as required. Option D is correct because the web tier must be internet-accessible, and placing web servers in a public subnet with a route to an Internet Gateway provides the inbound/outbound internet connectivity needed for public access. Option A is wrong because putting application and database servers in a public subnet exposes them to the internet, directly violating the isolation requirement, and a VPC endpoint does not make a public subnet private. Option B is wrong because web servers in a private subnet behind a NAT Gateway can initiate outbound traffic but cannot receive inbound connections from the internet, so the web tier would not be publicly accessible. Option E is wrong because security group rules alone, while useful for tier-to-tier filtering, do not provide the subnet-level public/private separation and internet routing architecture the scenario requires.

Answer

Place application and database servers in a public subnet with a VPC endpoint

Answer

Place web servers in a private subnet with a NAT Gateway

Answer

Use security group rules to allow traffic only between tiers

Question 13

A company runs a critical application on EC2 instances in a VPC. The application needs to send data to an S3 bucket and an SQS queue, both in the same AWS account. The security team requires that all traffic to these AWS services must stay within the AWS network and not traverse the internet. The VPC has private subnets with no NAT gateway or Internet Gateway. The EC2 instances have an IAM role that grants necessary permissions. The S3 bucket and SQS queue are configured with bucket policies and queue policies that deny all access except from the VPC. However, the application is failing to send data to both S3 and SQS. What should the network engineer do to resolve this issue?

Accepted Answer

Create a gateway endpoint for S3 and an interface endpoint for SQS in the VPC, and update the route tables for S3 and the security groups for SQS. VPC endpoints for S3 (Gateway endpoint) and SQS (Interface endpoint) provide private connectivity within the AWS network, meeting the security requirement. Option D is correct because it creates the necessary endpoints and updates route tables and security groups. For the Gateway endpoint, route tables must be updated to direct S3 traffic through the endpoint. For the Interface endpoint, security groups must allow inbound traffic from the EC2 instances. Option A is wrong because CloudFront is a content delivery service, not a private connectivity solution for S3 or SQS. Option B is wrong because a NAT gateway would route traffic over the internet, violating the requirement. Option C is wrong because Direct Connect is an overkill and does not directly provide VPC endpoint connectivity for S3 and SQS.

Answer

Deploy an Amazon CloudFront distribution in front of S3 and use its public endpoint

Answer

Create a NAT gateway in a public subnet and update the route tables to send traffic to it

Answer

Set up an AWS Direct Connect connection and route traffic through it

Question 14

A financial services company is required to encrypt all data at rest and in transit. They have an Amazon S3 bucket with server-side encryption enabled (SSE-S3) and are using HTTPS for all API calls. During an audit, the auditor points out that the bucket policy does not explicitly deny requests that do not use HTTPS. Which of the following should the company add to the bucket policy to enforce HTTPS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. To enforce HTTPS, the bucket policy must deny requests where aws:SecureTransport is false, which is exactly what option D specifies. This condition evaluates to true for HTTP requests, causing the Deny to apply and blocking unencrypted access. The other options either allow rather than deny or use the wrong boolean value.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 15

A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?

Accepted Answer

Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.. AWS Shield Advanced does not provide a whitelist feature for IP addresses; the correct way to exempt specific partners from rate-based throttling is to create an AWS WAF rate-based rule with an IP set containing the partners' IPs and set a high rate limit for that rule. This allows legitimate partner traffic to exceed the normal threshold while still protecting against volumetric attacks from other sources.

Answer

Disable the rate-based rule in AWS WAF during the DDoS event.

Answer

Increase the global rate limit in AWS Shield Advanced.

Answer

Add the partners' IP addresses to the AWS Shield Advanced whitelist.