ANS-C01 Network Security, Compliance and Governance Practice Test 36 — 15 Questions

Question 1

A company has a VPC with a CIDR block of 10.0.0.0/16. The security team wants to restrict outbound traffic from a subnet to only allow HTTP and HTTPS to the internet, while denying all other outbound traffic. They also want to allow return traffic for established connections. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a network ACL on the subnet that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and allows inbound TCP ports 1024-65535 from 0.0.0.0/0.. Network ACLs are stateless and operate at the subnet level, making them suitable for restricting outbound traffic for an entire subnet. To allow only HTTP and HTTPS outbound, you must add outbound rules for TCP 80 and 443 to 0.0.0.0/0, and inbound rules for ephemeral ports (1024-65535) to allow return traffic. The default deny rule will block all other outbound traffic. This meets the requirement.

Answer

Create a security group that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and configure the subnet's route table to send all other traffic to a blackhole.

Answer

Create a network ACL on the subnet that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and allows inbound TCP ports 80 and 443 from 0.0.0.0/0.

Answer

Create a security group that allows outbound TCP ports 80 and 443 to 0.0.0.0/0, and attach it to the instances in the subnet.

Question 2

A company is deploying a multi-tier web application in a VPC. The security team wants to implement microsegmentation to control traffic between the web tier, application tier, and database tier. They need to ensure that only the application tier can access the database tier on port 3306, and only the web tier can access the application tier on port 8080. They also want to log all accepted and rejected traffic for auditing. Which TWO AWS services or features should they use to meet these requirements? (Choose two.)

Accepted Answer

VPC Flow Logs to capture accepted and rejected traffic.. Security groups with references to other security groups allow you to define rules that permit traffic based on the membership of instances in other security groups, enabling precise microsegmentation. VPC Flow Logs capture accepted and rejected traffic for auditing, providing visibility into whether the rules are effective. Together, they meet the requirements for controlling and logging traffic between tiers.

Answer

AWS Network Firewall with stateful rule groups.

Answer

Network ACLs with allow rules for specific CIDR ranges.

Answer

AWS PrivateLink to create endpoints between tiers.

Question 3

A company has a VPC with an internet-facing Application Load Balancer (ALB) and a fleet of EC2 instances in private subnets. The security team wants to ensure that the EC2 instances only accept traffic from the ALB and that all other inbound traffic is blocked. They also want to log any unauthorized attempts to access the instances. Which combination of steps should they take?

Accepted Answer

Configure the EC2 instances' security group to allow inbound traffic only from the ALB's security group. Enable VPC Flow Logs on the instances' network interfaces to capture rejected traffic.. The most secure and maintainable approach is to reference the ALB's security group in the EC2 instances' security group inbound rules. This ensures that only the ALB can reach the instances, regardless of IP changes. VPC Flow Logs can be enabled on the instances' network interfaces to capture rejected traffic, providing an audit trail of unauthorized attempts. This combination satisfies both access control and logging.

Answer

Configure the EC2 instances' security group to allow inbound traffic from the ALB's IP addresses. Enable AWS CloudTrail to log all API calls to the instances.

Answer

Configure a network ACL on the private subnets to allow inbound traffic only from the ALB's subnet CIDR. Enable VPC Flow Logs on the subnet to capture rejected traffic.

Answer

Configure the EC2 instances' security group to allow inbound traffic from the ALB's security group. Enable AWS Shield Advanced to log unauthorized attempts.

Question 4

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a centralized security VPC that hosts AWS Network Firewall for inspecting traffic between VPCs. The security team wants to ensure that all inter-VPC traffic is inspected by the firewall, but they notice that some traffic between two VPCs is bypassing the firewall. What is the most likely cause and how to fix it?

Accepted Answer

The transit gateway route tables are not configured to route traffic through the security VPC. Update the route tables to send traffic to the security VPC attachment.. Transit gateway route tables control the flow of traffic between attachments. To force all inter-VPC traffic through the security VPC for inspection, the route tables associated with the source and destination VPC attachments must have routes that point to the security VPC attachment. If these routes are missing or incorrect, traffic will use a direct path between VPCs, bypassing the firewall. The fix is to update the transit gateway route tables to route traffic through the security VPC attachment.

Answer

The VPCs are using a peering connection instead of the transit gateway. Remove the peering connection and force traffic through the transit gateway.

Answer

The security VPC's firewall subnet route table does not have a route back to the source VPC. Add a route to the source VPC CIDR.

Answer

The AWS Network Firewall is not configured with a rule group that allows the traffic. Add a rule to allow the traffic.

Question 5

A company must ensure that all Amazon S3 bucket policies in its organization never grant public access, and that this guardrail applies to every existing and future account, including accounts created by new business units. The security team wants a single control that cannot be overridden by account administrators. Which solution meets these requirements?

Accepted Answer

Create an AWS Organizations service control policy that denies s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, and s3:DeletePublicAccessBlock unless the request comes from the security account.. Service control policies in AWS Organizations define the permission ceiling for member accounts and are enforced regardless of identity-based or resource-based policies inside those accounts. Denying the S3 APIs that can weaken public access protections, with an exception for the security account, prevents any account administrator from making a bucket public. Because SCPs inherit down the organization tree, they automatically cover accounts created in the future.

Answer

Use AWS Config managed rules to detect public S3 buckets and invoke an AWS Lambda function that remediates noncompliant buckets.

Answer

Attach an IAM permissions boundary to every IAM role in each account that denies s3:PutBucketPolicy.

Answer

Enable S3 Block Public Access at the bucket level in every account and require account owners to attest annually.

Question 6

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a transit gateway with multiple attachments. The security team wants to inspect all traffic between VPCs using AWS Network Firewall. They deploy a Network Firewall in a dedicated VPC and attach it to the transit gateway. However, they find that traffic between VPCs is not being inspected. What is the most likely reason?

Accepted Answer

The transit gateway route tables are not configured to route traffic through the Network Firewall VPC attachment.. To inspect inter-VPC traffic with AWS Network Firewall via a transit gateway, you must configure transit gateway route tables to steer traffic through the firewall VPC attachment. This involves creating a separate transit gateway route table for the firewall VPC, associating the firewall attachment with it, and configuring the other VPC attachments to propagate routes to that route table. Without these routing configurations, traffic will bypass the firewall and go directly between VPCs.

Answer

The Network Firewall policy must be associated with the transit gateway.

Answer

The Network Firewall must be deployed in the same VPC as the transit gateway.

Answer

The VPC attachments must be in the same AWS Region as the Network Firewall.

Question 7

A media company runs a VPC with a CIDR of 10.0.0.0/16. The company's security policy requires that all outbound traffic to the internet be inspected by AWS Network Firewall, and that the firewall logs be retained for 90 days. The company has deployed a firewall endpoint in a dedicated subnet and updated the route tables to send 0.0.0.0/0 traffic through the firewall endpoint. After deployment, the security team notices that traffic to Amazon S3 within the same Region is not being inspected. What is the MOST likely cause of this behavior?

Accepted Answer

The route table for the subnet containing the EC2 instances does not have a route for the S3 prefix list pointing to the firewall endpoint.. AWS Network Firewall inspects traffic only if the route table directs that traffic to the firewall endpoint. For S3 traffic within the same Region, the destination is the S3 prefix list, not the internet gateway. If the route table lacks a route for the S3 prefix list pointing to the firewall endpoint, that traffic follows the default route (or a more specific route) and bypasses inspection. Adding a route for the S3 prefix list to the firewall endpoint ensures inspection.

Answer

The firewall policy is missing a rule that allows traffic to the S3 prefix list.

Answer

The S3 bucket policy is allowing traffic from the VPC CIDR, which bypasses the firewall.

Answer

The firewall endpoint is deployed in a subnet that does not have a route to the S3 prefix list.

Question 8

A company needs to ensure that all VPC flow logs are encrypted at rest and that access to the logs is restricted to a specific set of IAM principals. The flow logs are delivered to an Amazon S3 bucket. Which two actions should a network engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach a bucket policy to the S3 bucket that denies access to all principals except the specified IAM principals.. To encrypt flow logs at rest and restrict access, the engineer should enable SSE-KMS with a customer managed key and attach a bucket policy that denies access to all principals except the specified set. SSE-KMS allows the use of key policies to control who can decrypt the logs, while the bucket policy enforces access restrictions at the S3 layer. Together, they provide the required confidentiality and access control.

Answer

Enable default encryption on the S3 bucket using Amazon S3 managed keys (SSE-S3).

Answer

Use AWS CloudTrail to log all access to the S3 bucket and configure an Amazon CloudWatch alarm for unauthorized access attempts.

Answer

Enable versioning on the S3 bucket to protect against accidental deletion of flow logs.

Question 9

A financial services company must prove to auditors that all traffic entering and leaving a production VPC is inspected by a centralized security appliance. The company uses AWS Transit Gateway with a dedicated inspection VPC, and all spoke VPC attachments route through the inspection VPC. The auditors require evidence that no spoke VPC can bypass inspection by attaching directly to the internet. Which control MOST directly prevents bypass while providing auditable evidence?

Accepted Answer

Use an AWS Organizations service control policy that denies creation of internet gateways and route table entries to them in the production accounts.. An AWS Organizations service control policy that denies the creation of internet gateways and routes to them removes the technical ability for any production account to reach the internet directly, forcing all egress through the centralized inspection VPC. Because the policy is enforced at the organization level and its API activity is captured in CloudTrail, it supplies both prevention and auditable evidence of the enforced architecture.

Answer

Configure a transit gateway route table that propagates all spoke VPC attachments and associates them with the inspection VPC attachment.

Answer

Attach an AWS Network Firewall firewall policy to each spoke VPC and log all flows to CloudWatch Logs.

Answer

Enable VPC Flow Logs on all spoke VPCs and review them monthly for unexpected internet-bound traffic.

Question 10

A company uses AWS Organizations with a hub-and-spoke VPC architecture. All inter-VPC traffic is routed through a central inspection VPC that contains an AWS Network Firewall. The security team wants to enforce that all traffic between spokes, and between spokes and on-premises, is inspected by the firewall. A network engineer deploys the firewall and updates the transit gateway route tables so that spoke VPCs send traffic to the inspection VPC. However, after testing, the engineer finds that some traffic between two spoke VPCs bypasses the firewall and flows directly through the transit gateway. What is the MOST likely cause?

Accepted Answer

The transit gateway route table for the spokes has a propagated route for the other spoke VPC CIDR that points directly to the other spoke attachment.. The most likely cause is that the transit gateway route table associated with the spoke attachments has propagated routes for other spoke CIDRs, creating direct paths between spokes. To enforce inspection, you must prevent those propagations or use a separate route table for spokes that only has a default route to the inspection VPC. This ensures all inter-spoke traffic is sent to the firewall for inspection.

Answer

The AWS Network Firewall policy is not configured to inspect traffic between VPCs, only traffic to the internet.

Answer

The transit gateway attachment for the inspection VPC is not associated with the correct route table.

Answer

The spoke VPCs have a local route for the other spoke CIDR that is more specific than the route to the inspection VPC.

Question 11

A company uses AWS Transit Gateway to connect 20 VPCs across multiple AWS accounts. The security team wants to ensure that all traffic between VPCs is inspected by a centralized security appliance, and that any new VPC attachments are automatically inspected without manual route table changes. Which solution meets these requirements?

Accepted Answer

Use a single transit gateway route table with a default route to the security appliance VPC, and associate all VPC attachments with that route table.. A single transit gateway route table with a default route to the security appliance VPC, and all VPC attachments associated with that route table, ensures that any traffic destined outside the local VPC is sent to the appliance for inspection. New VPC attachments automatically use the same route table and default route, so inspection is applied without manual route updates. This provides centralized, scalable inspection for all current and future VPCs.

Answer

Configure AWS PrivateLink endpoints in each VPC to send traffic to the security appliance VPC for inspection.

Answer

Enable Transit Gateway Connect on each VPC attachment to force traffic through the security appliance using Generic Routing Encapsulation (GRE).

Answer

Create a separate transit gateway route table for each VPC attachment and manually add routes to the security appliance VPC.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. The security team wants to restrict outbound traffic from a subnet to only allow HTTP and HTTPS to the internet, while denying all other outbound traffic. They also want to allow return traffic for established connections. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Network Load Balancer ARN.. Creating a VPC endpoint service requires specifying the Network Load Balancer that will handle traffic for the service. The NLB must be in the service provider's VPC and have a listener for the service port. AWS PrivateLink uses the NLB to route traffic from consumer VPCs to the service instances. Other components like consumer CIDRs, transit gateways, or Direct Connect are not involved in this configuration.

Answer

A Transit Gateway attachment ID.

Answer

The CIDR block of the consumer VPCs.

Answer

An AWS Direct Connect virtual interface ID.

Question 13

A compliance officer requires that all API calls that modify VPC networking components, including CreateRoute, DeleteRoute, and ModifyVpcAttribute, be recorded with the identity of the caller and retained for seven years in a dedicated account. Which combination of services should the engineer use?

Accepted Answer

AWS CloudTrail with a multi-Region trail delivering events to a central Amazon S3 bucket, plus S3 Object Lock for retention.. CloudTrail is the service that records AWS API activity with caller identity, and a multi-Region trail ensures coverage regardless of where the networking changes occur. Delivering the trail to an S3 bucket in the dedicated account centralizes the records, and S3 Object Lock in compliance mode prevents deletion or alteration for the required seven years, satisfying both the identity and retention requirements.

Answer

VPC Flow Logs published to Amazon CloudWatch Logs with a seven-year retention policy configured on the log group.

Answer

Amazon CloudWatch Logs with a subscription filter that forwards events to an Amazon S3 bucket in the dedicated account.

Answer

AWS Config with a configuration recorder and delivery channel to an Amazon S3 bucket, plus an AWS Config aggregator.

Question 14

A security team wants to detect and alert on API calls that modify VPC security groups across all accounts in an AWS Organization. They enable AWS CloudTrail in all accounts and deliver logs to a central S3 bucket. They need a solution that evaluates the log events and sends a notification when a security group rule is changed. The team wants minimal operational overhead and no custom code. Which combination of services should they use?

Accepted Answer

Amazon EventBridge rule with an event pattern matching CloudTrail API calls, targeting an Amazon SNS topic.. EventBridge natively ingests CloudTrail management events and can match specific API calls like security group modifications. Routing those matched events to an SNS topic provides immediate notification with no custom code. This is the lowest-overhead approach for alerting on API-level changes across accounts when CloudTrail is already enabled.

Answer

AWS Config custom rule with a Lambda function that parses CloudTrail logs from S3 and publishes to SNS.

Answer

AWS CloudTrail Lake query scheduled with Amazon EventBridge Scheduler to run a query and publish results to SNS.

Answer

Amazon GuardDuty findings exported to S3, with an S3 event notification triggering a Lambda function to publish to SNS.

Question 15

A retail company uses AWS Organizations with many member accounts. The security team must ensure that no VPC in any member account can be peered with a VPC outside the organization and that no member account can disable VPC Flow Logs on any subnet. They want a single control that applies automatically to all current and future accounts. Which approach meets these requirements?

Accepted Answer

Create a service control policy in AWS Organizations that denies ec2:CreateVpcPeeringConnection unless the peer owner is in the organization and denies ec2:DeleteFlowLogs, then attach it to the root.. Service control policies attached at the organization root define the permission boundary for every member account and apply to accounts created later. A policy that denies VPC peering creation unless the peer owner belongs to the organization, combined with a denial of flow log deletion, prevents both prohibited actions before they occur, satisfying the single preventive control requirement.

Answer

Enable AWS CloudTrail organization trail with log file validation and configure Amazon EventBridge rules in each account to alert on peering and flow log deletion events.

Answer

Use AWS Resource Access Manager to share a peering connection template with member accounts and enable VPC Flow Logs through a centralized CloudFormation StackSet.

Answer

Create an AWS Config custom rule in each member account that checks for peering connections and flow log status, then remediate with a Lambda function.