ANS-C01 Network Security, Compliance and Governance Practice Test 35 — 15 Questions

Question 1

A company uses AWS Organizations with many member accounts. The security team must ensure that users in member accounts cannot disable VPC Flow Logs, delete CloudTrail trails, or modify the S3 bucket that stores the logs. The team wants a preventive control that applies to all existing and future accounts. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, ec2:DeleteFlowLogs, and s3:DeleteBucket actions, and attach it to the root or all member accounts.. Service control policies in AWS Organizations provide centralized, preventive guardrails that apply to all accounts under the attached organization root or OU, including accounts created later. Denying the specific destructive actions protects CloudTrail, VPC Flow Logs, and the log bucket from being disabled or removed by member-account principals.

Answer

Enable AWS Config rules in each member account to detect when logging is disabled and use an AWS Lambda function to re-enable it after the change.

Answer

Use AWS CloudFormation StackSets to deploy a bucket policy and IAM policy to every member account that denies the actions on the log bucket and trail.

Answer

Create an IAM permissions boundary in each member account that denies the same actions and attach it to every IAM user and role.

Question 2

A company wants to monitor and record all API calls made to their AWS account for security and compliance auditing. They need to store the logs for at least one year and be able to search for specific events. Which AWS service should they use?

Accepted Answer

AWS CloudTrail with logs stored in Amazon S3 and analyzed with Amazon Athena.. AWS CloudTrail is the service designed to record API calls made in an AWS account. It captures detailed information about each call, including the identity of the caller, the time, and the source IP. Storing logs in Amazon S3 provides durable, long-term storage, and Amazon Athena allows you to query the logs for specific events, meeting the audit and search requirements.

Answer

Amazon CloudWatch Logs with a subscription filter to Amazon Kinesis Data Firehose.

Answer

AWS Config with configuration snapshots stored in Amazon S3.

Answer

VPC Flow Logs stored in Amazon CloudWatch Logs.

Question 3

A company's security team needs to enforce that all network traffic between a set of EC2 instances in a VPC and any external endpoint is inspected by a third-party firewall appliance running on EC2. The instances are in private subnets and must not have public IP addresses. The team wants to ensure that if the firewall appliance fails, traffic is automatically routed to a standby appliance. Which solution meets these requirements?

Accepted Answer

Deploy the firewall appliance behind a Gateway Load Balancer, and update the VPC route tables to send traffic through the Gateway Load Balancer endpoint.. Gateway Load Balancer is purpose-built for transparently inserting third-party security appliances. It uses a Gateway Load Balancer endpoint in the VPC, and route tables direct traffic to that endpoint. The load balancer then distributes traffic to a fleet of appliances, performing health checks and automatic failover. This architecture keeps the instances private and ensures all traffic is inspected.

Answer

Deploy the firewall appliance in a public subnet, and create a peering connection between the private subnets and the public subnet.

Answer

Deploy the firewall appliance with an Elastic IP address, and configure security groups to redirect traffic to the appliance's public IP.

Answer

Deploy the firewall appliance behind a Network Load Balancer, and configure the instances to use the Network Load Balancer as their default gateway.

Question 4

A company has a transit gateway with multiple VPC attachments and a VPN attachment to on-premises. The security team wants to inspect all traffic between VPCs and between VPCs and on-premises using a centralized AWS Network Firewall. They also need to ensure that traffic cannot bypass the firewall. Which solution should be implemented?

Accepted Answer

Create a dedicated inspection VPC with a Network Firewall, attach it to the transit gateway, and configure transit gateway route tables to send all traffic through the inspection VPC.. Centralized inspection with AWS Network Firewall is achieved by deploying the firewall in a dedicated inspection VPC and attaching that VPC to the transit gateway. Transit gateway route tables are then configured to route all traffic from other VPCs and VPN attachments through the inspection VPC. This ensures that all traffic is inspected and cannot bypass the firewall.

Answer

Use AWS Firewall Manager to enforce Network Firewall policies across all VPCs, with each VPC having its own firewall.

Answer

Configure the transit gateway to use a Network Firewall as a middlebox by associating the firewall with the transit gateway attachment.

Answer

Attach the Network Firewall to each VPC and configure route tables to send traffic through the firewall endpoints.

Question 5

A company runs a three-tier web application in a VPC. The security team wants to inspect all traffic entering and leaving the VPC for malicious activity. They decide to use AWS Network Firewall deployed in a dedicated subnet. After deployment, they notice that traffic between the public subnet and the private subnet is not being inspected. What is the most likely cause?

Accepted Answer

The route tables for the public and private subnets do not have routes that direct traffic to the Network Firewall endpoint.. AWS Network Firewall inspects traffic only when that traffic is routed through the firewall endpoint. The route tables of the subnets generating the traffic must contain routes that target the firewall endpoint. Without such routes, traffic flows directly between subnets, bypassing inspection. Therefore, the missing routes are the root cause.

Answer

The Network Firewall policy is not attached to the VPC.

Answer

The Network Firewall subnet is not associated with the VPC route tables for the public and private subnets.

Answer

The security groups on the Network Firewall endpoint are blocking traffic from the public subnet.

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs. They want to enforce that all traffic between VPCs is inspected by a centralized AWS Network Firewall. They have deployed the firewall in a dedicated inspection VPC and associated it with the transit gateway. However, they notice that traffic between two VPCs is not being inspected. What is the most likely reason?

Accepted Answer

The transit gateway route tables for the VPCs do not have routes that point to the inspection VPC.. Centralized inspection with AWS Transit Gateway requires that the transit gateway route tables direct traffic from source VPCs to the inspection VPC, and then from the inspection VPC to the destination VPCs. Without these routes, inter-VPC traffic bypasses the firewall. The missing routes are the most likely reason for uninspected traffic.

Answer

The VPC attachments are not associated with the correct transit gateway route table.

Answer

The Network Firewall policy is not associated with the transit gateway.

Answer

The Network Firewall subnet is not in the same Availability Zone as the transit gateway attachment.

Question 7

A security team wants to prove that no traffic can traverse an AWS Site-to-Site VPN connection to an on-premises data center without being inspected. They have a transit gateway with a VPN attachment and a VPC attachment, and they plan to route all inter-network traffic through an AWS Network Firewall endpoint in a dedicated inspection VPC. Which configuration ensures that the transit gateway enforces inspection before traffic reaches the destination VPC?

Accepted Answer

Create separate transit gateway route tables, associate the VPN and workload VPC attachments with a route table whose default route points to the inspection VPC attachment, and enable appliance mode on the inspection VPC attachment.. Centralized inspection with a transit gateway requires explicit route table segmentation so that traffic from the VPN attachment is directed to the inspection VPC attachment rather than straight to workloads. Pairing that routing with appliance mode on the inspection attachment keeps bidirectional flows on the same firewall endpoint, which is essential for stateful inspection to see both directions of each connection.

Answer

Associate a transit gateway route table with the inspection VPC attachment and enable appliance mode on that attachment.

Answer

Enable transit gateway route propagation from the VPN attachment to the workload VPC route table and rely on the VPN tunnel's built-in inspection.

Answer

Attach an AWS Network Firewall policy directly to the transit gateway and set the policy's default action to drop.

Question 8

A security team needs to capture all DNS queries made by workloads in a VPC and forward the query logs to a central S3 bucket in a logging account for compliance retention. The VPC uses the default Amazon-provided DNS resolver at the .2 address of the VPC CIDR. Which configuration will capture the query logs without changing the resolver address used by the instances?

Accepted Answer

Create a Route 53 Resolver query logging configuration, associate it with the VPC, and specify the destination S3 bucket in the logging account.. Route 53 Resolver query logging is purpose-built for capturing DNS queries that reach the VPC Resolver, and it can deliver those logs directly to an S3 bucket in a centralized logging account. It requires no change to the resolver address that instances use, and it captures queries for both public and private names, making it the correct compliance-oriented choice.

Answer

Configure a private hosted zone for each domain and enable query logging on the hosted zone, then export the logs to S3.

Answer

Deploy a Route 53 Resolver outbound endpoint and configure a forwarding rule that sends all queries to an on-premises DNS server that writes logs to S3.

Answer

Enable VPC Flow Logs with a filter of UDP port 53 and deliver the logs to the central S3 bucket.

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16 and a subnet with CIDR 10.0.1.0/24. The company wants to use AWS Network Firewall to inspect all traffic entering and leaving the VPC. They deploy the firewall endpoint in a dedicated firewall subnet with CIDR 10.0.2.0/24. After deployment, they notice that traffic to and from the internet is not being inspected. What is the most likely cause?

Accepted Answer

The route tables of the workload subnets must be updated to route traffic through the firewall endpoint.. For AWS Network Firewall to inspect traffic, the route tables of the subnets where the resources reside must point to the firewall endpoint. This ensures that all traffic from those subnets is sent to the firewall for inspection before continuing to its destination. The firewall subnet itself does not need special routing; it simply hosts the endpoint. Without updating the workload subnet route tables, traffic bypasses the firewall entirely.

Answer

The firewall subnet must have a route table that directs all traffic to the firewall endpoint.

Answer

The Network Firewall policy must have a rule group that allows all traffic.

Answer

The firewall endpoint must be deployed in the same subnet as the workload resources.

Question 10

A healthcare company stores protected health information in an Amazon S3 bucket accessible only through a VPC endpoint. Compliance requires that all access to the bucket be logged with the identity of the requester and that the logs be immutable for 365 days. The security team enables AWS CloudTrail data events for the bucket and configures S3 server access logging. Which additional configuration is required to meet the immutability requirement?

Accepted Answer

Enable S3 Object Lock in compliance mode on the destination bucket for the CloudTrail and access log objects, with a retention period of 365 days.. Immutability for audit logs is achieved with S3 Object Lock, which enforces retention at the object level. Compliance mode prevents deletion by any principal, including the root user, for the specified period. Combining CloudTrail data events and S3 access logs with a locked destination bucket provides both requester identity and tamper-proof retention.

Answer

Enable versioning on the log bucket and configure a lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Use AWS CloudTrail Lake to store the events and set the event data store retention to 365 days.

Answer

Configure an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except the logging service.

Question 11

A company runs a VPC with an internet-facing Application Load Balancer in front of web servers. The security team must block requests that contain a specific malicious SQL injection pattern in the query string while allowing all other legitimate traffic. They want the least operational overhead and the ability to log matched requests. Which solution meets these requirements?

Accepted Answer

Create an AWS WAF web ACL with a rule that matches the SQL injection match condition, associate it with the Application Load Balancer, and enable logging to a destination such as CloudWatch Logs.. AWS WAF is purpose-built for layer 7 request filtering and integrates directly with Application Load Balancers. A rule using the SQL injection match condition inspects the query string and blocks matching requests, while WAF logging captures details of each match. This delivers the required protection and auditability without introducing additional network appliances or routing changes.

Answer

Configure the Application Load Balancer listener rules to redirect any request containing the SQL injection pattern to a fixed error page.

Answer

Create a network ACL rule on the load balancer subnet that denies traffic containing the SQL injection string.

Answer

Deploy an AWS Network Firewall with a stateful rule group that uses a Suricata rule to detect the SQL injection pattern and route the load balancer subnet through the firewall endpoints.

Question 12

A network engineer must enforce that all traffic entering and leaving a production VPC is inspected by AWS Network Firewall, and that the firewall cannot be bypassed by changes to route tables made by application teams. The VPC has an internet gateway, a NAT gateway, and a transit gateway attachment. Which two controls should be implemented to meet these requirements? (Choose two.)

Accepted Answer

Create a firewall subnet with a Network Firewall endpoint and route the internet gateway and transit gateway traffic through that endpoint using route tables that application teams cannot modify.. Enforcement requires both a routing design that forces all ingress and egress through the Network Firewall endpoint and a governance guardrail that prevents unauthorized route changes. The dedicated firewall subnet with controlled route tables ensures traffic is inspected, while the service control policy denies route modification actions to application teams, closing the bypass path.

Answer

Use AWS PrivateLink to expose the Network Firewall endpoint to application subnets and require applications to connect through the endpoint.

Answer

Configure a Network Firewall stateless rule group with a default action of drop and associate it with the firewall policy for all subnets.

Answer

Enable VPC Flow Logs on all subnets and create an Amazon EventBridge rule that stops any instance that sends traffic outside the inspected path.

Question 13

A company uses AWS Organizations to manage multiple AWS accounts. They want to enforce that all VPCs in all accounts have flow logs enabled and that any attempt to disable flow logs is automatically remediated. Which combination of AWS services should they use to achieve this with the least operational overhead?

Accepted Answer

AWS Config with an organization-wide aggregator and automatic remediation using AWS Systems Manager Automation.. AWS Config with an organization-wide aggregator can monitor VPC flow log status across all accounts. It evaluates resources against desired configurations and can trigger automatic remediation using AWS Systems Manager Automation. This combination provides centralized, automated enforcement with low operational overhead.

Answer

AWS CloudTrail with Amazon CloudWatch Events and AWS Lambda functions in each account.

Answer

AWS Security Hub with custom insights and manual remediation.

Answer

AWS Trusted Advisor with organizational view and AWS Lambda remediation.

Question 14

A security team needs to verify that no Amazon EC2 instances in a production VPC can reach the public internet over IPv4, even if an instance is accidentally launched into a public subnet with a public IP. The VPC has an internet gateway attached and route tables that point 0.0.0.0/0 to that gateway. Which action will definitively block outbound IPv4 internet access for every instance in the VPC while leaving intra-VPC traffic intact?

Accepted Answer

Remove the internet gateway from the VPC and delete the 0.0.0.0/0 route from every route table.. Detaching the internet gateway and removing the default routes eliminates the only network path from the VPC to the public internet. Because instances in the VPC still use the implicit local route for internal communication, intra-VPC traffic is unaffected. Filtering approaches such as security groups or network ACLs can be undermined by a single misconfigured resource, whereas removing the gateway enforces the guarantee structurally.

Answer

Enable VPC Flow Logs with a filter that rejects traffic to 0.0.0.0/0 and configure Amazon CloudWatch alarms on the rejected flows.

Answer

Attach a security group that has no outbound rules and remove the default allow-all egress rule from each instance's security group.

Answer

Apply an inbound network ACL rule on each subnet that denies all traffic from 0.0.0.0/0.

Question 15

A media company stores sensitive content in an Amazon S3 bucket that is accessed by applications running on EC2 instances in a VPC. The security team wants every S3 request to stay on the AWS network and never traverse the public internet, and they want to restrict bucket access so that only requests originating from a specific VPC endpoint are allowed. The VPC has an internet gateway and a NAT gateway, and the applications currently reach S3 over the public endpoint. Which combination of changes enforces this requirement?

Accepted Answer

Create a gateway VPC endpoint for S3, attach it to the route tables of the application subnets, and modify the bucket policy to allow access only when aws:SourceVpce equals the endpoint ID.. A gateway VPC endpoint for S3 adds a prefix list route in the subnet route table so S3-bound traffic never leaves the AWS network through the NAT or internet gateway. Restricting the bucket policy with the aws:SourceVpce condition ensures only requests that arrive through that endpoint are accepted, which satisfies both the private-path and the origin-restriction requirements. This is the standard private-access pattern for S3 from a VPC.

Answer

Create a gateway VPC endpoint for S3, add a route in the route table, and attach a security group to the endpoint that allows only the application instances.

Answer

Create an interface VPC endpoint for S3 in each application subnet, then add a bucket policy that allows only the elastic network interface IDs of the endpoint.

Answer

Create a gateway VPC endpoint for S3 and modify the bucket policy to deny requests whose aws:SourceIp is the NAT gateway elastic IP address.