ANS-C01 Network Security, Compliance and Governance Practice Test 34 — 15 Questions

Question 1

A company is using AWS Secrets Manager to store database credentials. They want to ensure that the credentials are automatically rotated every 30 days. Which configuration is required?

Accepted Answer

Enable automatic rotation in the secret configuration and provide a Lambda rotation function.. AWS Secrets Manager provides built-in automatic rotation using a Lambda function. Option B is incorrect because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it is designed for configuration management. Option C is incorrect because AWS CloudHSM is a hardware security module for storing cryptographic keys, not for automating credential rotation. Option D is incorrect because IAM Access Analyzer analyzes resource policies to identify unintended access, not to rotate credentials.

Answer

Store the secret in AWS Systems Manager Parameter Store and configure a rotation schedule.

Answer

Store the secret in AWS CloudHSM and use a scheduled Lambda to rotate.

Answer

Use IAM Access Analyzer to rotate the credentials periodically.

Question 2

A company has a VPC with multiple subnets. They have an Application Load Balancer (ALB) in a public subnet and a web server fleet in private subnets. The security team wants to ensure that only the ALB can communicate with the web servers. Which security group configuration should be used?

Accepted Answer

Set the web server security group inbound rule to allow traffic from the ALB's security group.. Referencing the ALB's security group as the source allows only traffic from instances or resources associated with that security group, strictly limiting access to the web servers. This follows the principle of least privilege. Option B is wrong because allowing traffic from the public subnet CIDR is too broad and would permit any instance in that subnet, not just the ALB. Option C is wrong because allowing traffic from the VPC CIDR permits any resource in the VPC, which is overly permissive. Option D is wrong because allowing traffic from 0.0.0.0/0 exposes the web servers to the internet.

Answer

Set the web server security group inbound rule to allow traffic from the public subnet CIDR.

Answer

Set the web server security group inbound rule to allow traffic from the VPC CIDR.

Answer

Set the web server security group inbound rule to allow traffic from 0.0.0.0/0.

Question 3

A company wants to centrally manage firewall rules across multiple VPCs in different AWS accounts. Which AWS service should they use?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager. AWS Network Firewall is a managed, stateful firewall service that can be deployed across VPCs, and AWS Firewall Manager allows you to centrally configure and manage firewall rules across multiple accounts and VPCs in an AWS Organization. Together they provide centralized rule management, making them the correct choice for multi-account, multi-VPC firewall administration.

Answer

Security Groups

Answer

AWS WAF

Answer

Network ACLs

Question 4

A company is designing a network security architecture for a multi-tier application. They want to ensure that the web tier can communicate with the application tier only on specific ports, and the application tier can communicate with the database tier only on specific ports. Which TWO configurations should be implemented?

Accepted Answer

Use network ACLs to provide a secondary layer of stateless filtering at the subnet level.. Option E is correct because security groups are stateful, instance-level virtual firewalls that support referencing another security group as the source, so the web tier's security group can allow inbound traffic only from the app tier's security group on the required ports, and the app tier's security group can similarly allow only the database tier's security group on the required ports, precisely enforcing tier-to-tier port restrictions. Option C is correct because network ACLs operate at the subnet level and provide a stateless secondary layer of filtering, which complements security groups by explicitly permitting or denying traffic on specific ports between the subnets hosting each tier. Option A is not appropriate because a transit gateway is used to interconnect VPCs, VPNs, and on-premises networks, not to filter traffic between tiers within a single VPC. Option B is incorrect because VPC peering connects separate VPCs and does not support attaching security groups to the peering connection itself. Option D is wrong because a single shared security group with CIDR-based rules cannot cleanly enforce per-tier, per-port least privilege and violates the tier isolation the scenario requires.

Answer

Use a transit gateway with network ACLs to filter traffic between tiers.

Answer

Use VPC peering to connect the tiers and apply security groups on the peering connection.

Answer

Use a single security group for all tiers and define rules based on CIDR blocks.

Question 5

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. They have a central inspection VPC that uses AWS Network Firewall to inspect traffic. The security team wants to ensure that all traffic between VPCs and between VPCs and on-premises is routed through the inspection VPC. They have created a transit gateway route table for each VPC and the Direct Connect/VPN attachments. They have configured the route tables to propagate routes from the inspection VPC's attachment. However, traffic is still bypassing the inspection VPC. What should the security team do to ensure traffic is inspected?

Accepted Answer

Create static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and remove any routes that point directly to other attachments.. Creating static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and removing any routes that point directly to other attachments, ensures that all traffic is sent to the inspection VPC. Without static routes, propagated routes from the inspection VPC attachment create routes to the inspection VPC, but other attachments may also propagate routes that allow direct communication, bypassing inspection. Option A is incorrect because enabling route propagation alone does not force traffic through the inspection VPC; it only adds routes automatically, but other routes (e.g., from Direct Connect or VPN attachments) can still allow direct paths. Option C is incorrect because network ACLs in the inspection VPC control traffic to and from its subnets but do not influence routing decisions in the transit gateway; they cannot prevent traffic from bypassing the inspection VPC. Option D is incorrect because VPC peering connections bypass the transit gateway entirely, so traffic would not be inspected by the Network Firewall in the inspection VPC.

Answer

Enable route propagation for all attachments in the transit gateway route tables.

Answer

Configure network ACLs in the inspection VPC to block traffic that does not come from the transit gateway.

Answer

Create VPC peering connections between all VPCs and the inspection VPC.

Question 6

A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via a VPN. They want to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the network?

Accepted Answer

Configure Transit Gateway with appliance mode and route traffic through a dedicated inspection VPC.. The correct option is B: configuring Transit Gateway with appliance mode and routing traffic through a dedicated inspection VPC. Appliance mode preserves flow symmetry by ensuring that return traffic for a given flow is routed to the same appliance ENI, which is essential when a stateful security appliance inspects traffic between VPCs attached to a Transit Gateway. This design centralizes inspection in a dedicated VPC while the Transit Gateway acts as the hub for all VPC and VPN attachments. Option A is wrong because VPC Peering bypasses the Transit Gateway and cannot enforce centralized inspection across all VPC-to-VPC paths. Option C is wrong because security groups and Flow Logs provide filtering and auditing but do not redirect traffic through a centralized appliance. Option D is wrong because deploying appliances in every VPC is not centralized and does not use the Transit Gateway to steer inter-VPC traffic through one inspection point.

Answer

Create VPC Peering connections between each VPC and the inspection VPC.

Answer

Use security groups in each VPC to restrict traffic and enable VPC Flow Logs for auditing.

Answer

Place the security appliance in each VPC and use Network Firewall to inspect traffic.

Question 7

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from an S3 bucket in the same AWS region. The company wants to ensure that traffic does not traverse the internet. Which solution is MOST cost-effective?

Accepted Answer

Create a Gateway VPC Endpoint for S3 and add a route in the private subnet's route table to the endpoint.. A Gateway VPC Endpoint for S3 creates a route-table target that lets instances in private subnets reach S3 using private IP addresses within the AWS network, never traversing the internet or a NAT gateway. It is the most cost-effective option because Gateway endpoints for S3 and DynamoDB are free (no hourly or data-processing charges), unlike Interface endpoints or NAT gateways. Adding the endpoint route to the private subnet's route table ensures traffic to S3 is directed through the endpoint.

Answer

Attach an Internet Gateway to the VPC and route the private subnet traffic directly to S3.

Answer

Create an Interface VPC Endpoint for S3 in the private subnet.

Answer

Deploy a NAT Gateway in a public subnet and route the private subnet traffic through it to access S3.

Question 8

A security engineer reviews the above security group configuration for a web server. What is a security concern with this configuration?

Accepted Answer

The outbound rule allows all traffic, which could be used for data exfiltration if the server is compromised.. The security concern is that the outbound rule allows all traffic (0.0.0.0/0 on all ports and protocols), which means if the web server is compromised, an attacker could exfiltrate data to any external destination without restriction. Security groups are stateful, so outbound rules control traffic initiated by the instance; an unrestricted outbound rule removes a critical layer of defense-in-depth. Best practice is to restrict outbound traffic to only the destinations and ports the server legitimately needs.

Answer

The inbound rule for SSH allows traffic from a large CIDR block (10.0.0.0/8), which could include unauthorized internal hosts.

Answer

The outbound rule allows all traffic, which is necessary for the server to function.

Answer

The inbound rule for HTTP is too permissive because it allows traffic from all IP addresses.

Question 9

Which TWO actions improve the security of an AWS account's root user? (Choose two.)

Accepted Answer

Create an IAM user with administrative privileges and use it for daily tasks.. Option A is correct because AWS best practice is to stop using the root user for everyday administrative work; instead, create an IAM user (or role) with the required administrative permissions and use that identity for daily tasks, keeping the root user only for the few account-level operations that require it. Option B is correct because enabling MFA on the root user adds a second authentication factor, so a compromised root password alone is not enough to sign in to the account. Option C is wrong because sharing the root password expands the attack surface and violates the principle of least privilege and credential confidentiality. Option D is wrong because, while a strong password is good hygiene, it is not one of the two key root-user security actions and does not by itself provide the protection of MFA or of not using root. Option E is wrong because creating a root access key for programmatic access is discouraged; root access keys grant unrestricted account access and should not be generated, and programmatic access should use IAM identities instead.

Answer

Share the root user password with the security team.

Answer

Set a strong password for the root user.

Answer

Generate an Access Key for the root user and use it for programmatic access.

Question 10

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Create an S3 bucket policy with a condition that allows access only from the VPC endpoint.. Option B is correct because an S3 bucket policy can include a condition such as aws:sourceVpce (or aws:sourceVpc) that allows access to the bucket only when requests originate through the specified VPC endpoint, which is the standard way to restrict S3 access to a VPC. Option C is correct because a VPC endpoint policy is an IAM resource policy attached to the gateway endpoint that controls which S3 actions and resources can be accessed through that endpoint, so it must allow the desired read actions on the bucket for traffic to succeed. Together, the bucket policy enforces the VPC-endpoint restriction at the bucket level while the endpoint policy governs what the endpoint permits. Option A is not correct because security groups apply to interface endpoints (and other ENI-based resources), not to S3 gateway endpoints, and security groups do not control S3 bucket access. Option D is not correct because network ACLs operate at the subnet level on IP traffic and cannot identify or allow access based on a VPC endpoint or S3 bucket policy. Option E is not correct because an IAM role grants permissions to an identity, not to a VPC, and does not by itself restrict bucket access to traffic from a specific VPC.

Answer

Assign a security group to the VPC endpoint that allows inbound traffic from the VPC.

Answer

Configure a network ACL on the subnet to deny all inbound traffic except from the VPC.

Answer

Use an IAM role to grant the VPC access to the S3 bucket.

Question 11

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.. Option E is required because the inspection VPC must be attached to the AWS Transit Gateway so that traffic from the spoke VPCs and VPN attachments can be routed into it for inspection. Option C is required because you need dedicated Transit Gateway route tables that propagate the inspection VPC attachment's routes and associate those route tables with the other VPC and VPN attachments, so traffic is directed through the inspection VPC instead of directly between spokes. Option A is required because the third-party firewall appliance must perform stateful inspection and then route the inspected traffic back to the Transit Gateway, typically using a separate subnet/attachment or return route, so it can reach its final destination. Option B is not needed because VPC peering bypasses the Transit Gateway and would not provide the centralized inspection path; the spoke VPCs should communicate through the Transit Gateway. Option D is not required because Direct Connect is a separate hybrid connectivity option and is not necessary to inspect VPC-to-VPC traffic that already flows through the Transit Gateway and VPN.

Answer

Set up VPC peering between the inspection VPC and each spoke VPC.

Answer

Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to allow outbound traffic to a specific external API endpoint at 203.0.113.10 on TCP port 443, but they want to restrict all other outbound internet traffic. They also want to log all denied traffic. Which combination of AWS resources should they use?

Accepted Answer

An AWS Network Firewall policy with a stateful rule that allows TCP 443 to 203.0.113.10/32 and a default deny rule, with logging enabled for denied traffic.. AWS Network Firewall provides stateful inspection and allows you to create rules that permit specific traffic and deny all else. You can configure logging for denied traffic to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose. This meets the requirement to allow only the specified outbound traffic and log all denials.

Answer

A NAT gateway with an Elastic IP, and a route table that routes all traffic to the NAT gateway, with VPC Flow Logs enabled.

Answer

An internet gateway with a route table that routes all traffic to the internet gateway, and a security group that allows outbound TCP 443 to 203.0.113.10/32.

Answer

A security group that allows outbound TCP 443 to 203.0.113.10/32 and a network ACL that denies all other outbound traffic, with VPC Flow Logs enabled.

Question 13

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to inspect all traffic between VPCs for compliance. They deploy AWS Network Firewall in a dedicated inspection VPC and configure Transit Gateway route tables to send traffic through the firewall. However, they notice that traffic between two VPCs is bypassing the firewall. What is the most likely cause?

Accepted Answer

The Transit Gateway route table for the source VPC has a direct route to the destination VPC attachment, and the inspection VPC attachment is not in the path.. To ensure all inter-VPC traffic is inspected, the Transit Gateway route table associated with the source VPC must route traffic to the inspection VPC attachment, not directly to the destination VPC. If a direct route exists, traffic bypasses the firewall. The inspection VPC must then route traffic to the destination VPC attachment, often using a separate route table.

Answer

The inspection VPC's route table does not have a route to the destination VPC, so traffic is dropped instead of inspected.

Answer

The Transit Gateway has equal-cost multi-path (ECMP) routing enabled, causing traffic to be load-balanced between the direct path and the inspection path.

Answer

The AWS Network Firewall policy is configured in strict order mode, which allows traffic to bypass inspection when a rule matches.

Question 14

A security engineer needs to provide a forensic team with a complete record of all IP traffic entering and leaving a VPC, including traffic that is denied by security groups or network ACLs. The VPC has several subnets and an internet gateway. Which solution meets this requirement?

Accepted Answer

Enable VPC Flow Logs at the VPC level with a filter of ALL and deliver logs to Amazon S3.. VPC Flow Logs at the VPC level with filter ALL capture both accepted and rejected traffic for all network interfaces in the VPC. This includes traffic denied by security groups and network ACLs, which is essential for forensic analysis. Delivering logs to Amazon S3 provides a durable, cost-effective storage solution for later analysis.

Answer

Use AWS CloudTrail data events to log all network traffic to and from the VPC.

Answer

Enable VPC Flow Logs on each subnet with a filter of ACCEPT and deliver logs to Amazon CloudWatch Logs.

Answer

Configure AWS Network Firewall logging to capture all traffic and send logs to Amazon S3.

Question 15

A company needs to ensure that all Amazon S3 bucket policies in their AWS Organization do not allow public read access. They want to enforce this across all accounts, including new accounts, and prevent any user from modifying the policy to allow public access. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Enable S3 Block Public Access at the organization level using AWS Organizations and S3 Block Public Access settings.. S3 Block Public Access at the organization level is a centralized control that prevents any S3 bucket in any account from being made public, regardless of bucket policies or ACLs. It applies to all existing and new accounts, requiring minimal effort to set up and maintain.

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl and s3:PutBucketPolicy actions.

Answer

Use AWS Config rules to detect public S3 buckets and automatically remediate with a Lambda function that removes public access.

Answer

Use AWS Organizations service control policies (SCPs) to deny s3:PutBucketPolicy actions that include a public read ACL.