ANS-C01 Network Security, Compliance and Governance Practice Test 4 — 15 Questions

Question 1

A company has deployed a multi-tier application in a VPC with public and private subnets. The web tier runs on EC2 instances in public subnets, and the application tier runs on EC2 instances in private subnets. The application tier must only accept traffic from the web tier security group. The security group for the application tier has an inbound rule allowing HTTP traffic from the web tier security group. However, the application team reports that the web tier instances cannot connect to the application tier instances. The network administrator has verified that the web tier instances can resolve the private DNS names of the application tier instances, and the route tables are correctly configured. What is the MOST likely cause of the connectivity issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The web tier security group's outbound rules do not allow traffic to the application tier security group.. Security groups are stateful, meaning that if you allow inbound traffic, the return traffic is automatically allowed regardless of outbound rules. However, the outbound rules of the initiating security group (the web tier) must permit the traffic to reach the destination. Since the web tier instances initiate the connection to the application tier, the web tier security group's outbound rules must allow HTTP traffic to the application tier security group. If those outbound rules are missing or too restrictive, the connection will fail even though the application tier's inbound rule is correct.

Answer

The application tier instances do not have a route to the web tier instances.

Answer

The application tier security group's inbound rule is stateful, but the outbound rule is not configured to allow return traffic.

Answer

The network ACL for the private subnet is blocking inbound traffic from the public subnet.

Question 2

A company has a VPC with public and private subnets. The security team wants to inspect all traffic between the private subnets and the internet using a centralized inspection VPC. The company uses AWS Network Firewall and wants to ensure that traffic cannot bypass the firewall. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Deploy the Network Firewall in a dedicated inspection VPC and use a VPC peering or transit gateway to route traffic from the workload VPC to the inspection VPC.. Deploying AWS Network Firewall in a dedicated inspection VPC and using a transit gateway (or VPC peering) allows centralized traffic inspection. This architecture ensures that all traffic between the workload VPC and the internet is routed through the inspection VPC, preventing bypass. The transit gateway enables transitive routing, while VPC peering can also be used with proper route table entries to force traffic through the firewall.

Answer

Configure an AWS WAF web ACL and associate it with the internet gateway.

Answer

Enable VPC Flow Logs on the private subnets to monitor traffic.

Answer

Create an internet gateway in the workload VPC and attach it to the private subnets.

Question 3

A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?

Accepted Answer

The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.. The bucket policy includes a condition that requires the object to have the tag 'classification: public' (using s3:ExistingObjectTag). If the objects in the 'confidential/' prefix do not have this tag, the condition fails and access is denied, even though the prefix matches. The policy explicitly grants public read access only to objects that satisfy both the prefix and the tag condition.

Answer

The bucket policy does not grant access to objects owned by other AWS accounts.

Answer

The 's3:GetObjectVersion' action is not allowed because the bucket is not versioned.

Answer

The condition should use 'StringLike' instead of 'StringEquals' for tag matching.

Question 4

A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) across multiple Availability Zones. The application uses a MySQL database on an RDS instance in a private subnet. Security compliance requires that all traffic between the ALB and EC2 instances must be encrypted. The security team finds that the ALB currently sends traffic to the EC2 instances using HTTP on port 80. The EC2 security group allows inbound HTTP traffic from the ALB security group. The team needs to implement encryption with minimal changes and without disrupting the application. Which solution meets these requirements?

Accepted Answer

Modify the ALB listener to use HTTPS on port 443. Create a new target group with protocol HTTPS on port 443. Install a valid SSL/TLS certificate on each EC2 instance. Update the EC2 security group to allow inbound HTTPS from the ALB security group.. It directly modifies the existing ALB to use an HTTPS listener on port 443, creates a new target group with HTTPS on port 443, and requires installing a valid SSL/TLS certificate on each EC2 instance. This ensures all traffic between the ALB and EC2 instances is encrypted with TLS, meeting the security requirement with minimal changes and no disruption to the application. The EC2 security group update to allow inbound HTTPS from the ALB security group completes the configuration.

Answer

Set up an AWS Client VPN endpoint and have the ALB send traffic through the VPN to the EC2 instances.

Answer

Deploy an internal ALB in front of the EC2 instances and configure it with an HTTPS listener. Route traffic from the public ALB to the internal ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB) and use TLS listeners to the EC2 instances.

Question 5

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Accepted Answer

Check connection status, then verify virtual interface configuration, then check on-premises BGP, then test connectivity, then escalate if unresolved.. Start with the connection status, then verify virtual interface configuration, check on-premises BGP, test connectivity, and escalate if unresolved.

Answer

Check connection status, then check on-premises BGP, then verify virtual interface configuration, then test connectivity, then escalate if unresolved.

Answer

Check connection status, then test connectivity, then verify virtual interface configuration, then check on-premises BGP, then escalate if unresolved.

Answer

Verify virtual interface configuration, then check connection status, then check on-premises BGP, then test connectivity, then escalate if unresolved.

Question 6

Order the steps to migrate a VPC from using an Internet Gateway to a NAT gateway for outbound-only internet access:

Accepted Answer

1. Create NAT gateway in a public subnet. 2. Update route tables to point default route to NAT gateway. 3. Remove the Internet Gateway route from route tables. 4. Adjust security group rules for outbound traffic. 5. Test outbound connectivity.. First create the NAT gateway, then update routes to use it, remove the IGW route, adjust security, and test.

Answer

1. Update route tables to point default route to NAT gateway. 2. Remove the Internet Gateway route. 3. Create NAT gateway in a public subnet. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Remove the Internet Gateway route. 2. Create NAT gateway in a public subnet. 3. Update route tables to point default route to NAT gateway. 4. Adjust security group rules. 5. Test outbound connectivity.

Answer

1. Adjust security group rules. 2. Create NAT gateway. 3. Update routes. 4. Remove IGW route. 5. Test outbound connectivity.

Question 7

Order the steps to troubleshoot an inter-Region VPC peering connection that is not working:

Accepted Answer

Verify peering status, then check route tables, then check security groups and NACLs, then test connectivity, then use VPC Flow Logs. First verify peering status, then check routes, then security groups/ACLs, then test, then use flow logs.

Answer

Test connectivity, then check security groups and NACLs, then check route tables, then use VPC Flow Logs, then verify peering status

Answer

Check security groups and NACLs, then check route tables, then verify peering status, then test connectivity, then use VPC Flow Logs

Answer

Use VPC Flow Logs, then verify peering status, then check route tables, then check security groups and NACLs, then test connectivity

Question 8

Match each AWS networking feature to its purpose for high availability or fault tolerance.

Accepted Answer

Elastic Load Balancer: Distributes incoming traffic across multiple targets to increase fault tolerance.. Correct matches: Elastic Load Balancer distributes traffic, Route 53 provides DNS health checks, and Global Accelerator uses anycast routing. Common confusions: ELB does not handle DNS; Route 53 does not direct traffic over the global network; Global Accelerator does not log traffic.

Answer

Elastic Load Balancer: Routes traffic based on DNS health checks.

Answer

Amazon Route 53: Improves application availability by directing traffic over the AWS global network.

Answer

AWS Global Accelerator: Captures network traffic logs for analysis.

Question 9

Match each AWS networking service to the OSI layer it primarily operates at.

Accepted Answer

AWS Direct Connect: Layer 2 (Data Link). AWS Direct Connect provides physical or virtual connections at Layer 2, AWS Site-to-Site VPN encrypts and routes IP packets at Layer 3, CloudFront and ALB handle HTTP/HTTPS at Layer 7. Common confusions include misattributing Direct Connect to Layer 3 or CloudFront to lower layers.

Answer

AWS Direct Connect: Layer 3 (Network)

Answer

Amazon CloudFront: Layer 4 (Transport)

Question 10

Match each AWS Direct Connect virtual interface type to its use case.

Accepted Answer

Private VIF: Used to access VPCs using private IP addresses. Correct matches: Private VIF accesses VPCs via private IPs, Public VIF accesses AWS public services, Transit VIF connects multiple VPCs via Transit Gateway. Common confusions involve swapping public/private access or confusing Transit VIF with Private VIF.

Answer

Private VIF: Used to access AWS public services using public IPs

Answer

Public VIF: Used to access VPCs using private IP addresses

Answer

Transit VIF: Used to connect directly to a single VPC

Question 11

A company wants to restrict access to an Amazon S3 bucket so that only traffic from a specific AWS Direct Connect virtual interface (VIF) can access it. Which combination of steps should the company take?

Accepted Answer

Create a VPC endpoint for S3 with a VPC endpoint policy that allows access only from the VPC, and configure the VPC route table to route S3 traffic through the Direct Connect VIF.. Option B. To restrict access to an S3 bucket to only traffic from a specific Direct Connect VIF, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that allows access only from the VPC. Then, configure the VPC route table to route traffic destined for S3 through the Direct Connect VIF, ensuring that only traffic coming through that VIF can reach the endpoint. Option A is incorrect because the Direct Connect VIF does not have a public IP address; it uses private IPs. Option C is incorrect because network ACLs are stateless and cannot enforce path-specific restrictions; also they operate at the subnet level, not for specific services like S3. Option D is incorrect because Direct Connect VIFs do not have public IP addresses; they use private IPs and traffic goes through private virtual interfaces.

Answer

Attach an S3 bucket policy that denies access unless the source IP is the public IP address of the Direct Connect VIF.

Answer

Create a network ACL that allows S3 traffic only from the Direct Connect CIDR block and associate it with the VPC subnet connected to the VIF.

Answer

Configure the Direct Connect VIF with a public IP address and use an S3 bucket policy that allows access only from that IP address.

Question 12

A security engineer needs to ensure that all internet-bound traffic from a VPC is inspected by a third-party firewall appliance before reaching the internet. The firewall is deployed in a separate VPC. Which AWS service should the engineer use to route traffic from the source VPC to the firewall VPC?

Accepted Answer

AWS Transit Gateway with a route table that points the default route (0.0.0.0/0) to the firewall VPC attachment.. AWS Transit Gateway enables transitive routing between VPCs. By creating a route table in the Transit Gateway with a default route (0.0.0.0/0) pointing to the firewall VPC attachment, all internet-bound traffic from the source VPC is forwarded to the firewall for inspection before reaching the internet. Option B (VPC Gateway Endpoint) is incorrect because Gateway Endpoints are used for privately accessing AWS services (like S3 or DynamoDB) from a VPC, not for routing traffic to a third-party firewall. Option C (AWS PrivateLink) is incorrect because PrivateLink allows you to access services hosted in other VPCs via Network Load Balancers and ENIs, but it does not provide transitive routing for internet-bound traffic. Option D (VPC Peering) is incorrect because VPC peering connections do not support transitive routing; you cannot route traffic from one VPC through a peered VPC to another destination.

Answer

VPC Gateway Endpoint for the firewall service.

Answer

AWS PrivateLink to connect to the firewall service in the other VPC.

Answer

VPC Peering connection between the two VPCs with a route table entry that sends internet traffic to the peering connection.

Question 13

A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The network team wants to ensure that only encrypted traffic is sent over the internet between the two sites. The VPC has a virtual private gateway attached. When testing, they discover that some traffic is going over the internet without encryption. Which configuration change should be made to enforce encryption?

Accepted Answer

Add a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway.. Adding a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway ensures that all traffic destined for the on-premises network is routed through the VPN tunnel, enforcing encryption. Without this static route, traffic might be sent via an internet gateway if a more specific route exists or if route propagation is not properly configured. Option B is incorrect because disabling route propagation would remove dynamic routes from the VPN, but traffic could still go over the internet if there is a route to an internet gateway. Option C is incorrect because IPsec acceleration is about improving performance, not ensuring all traffic uses encryption; the tunnel already uses IPsec. Option D is incorrect because replacing the virtual private gateway with a transit gateway is not necessary; the issue is routing, not the gateway type.

Answer

Disable route propagation on the VPC route table to remove any dynamic routes from the VPN.

Answer

Enable IPsec acceleration on the VPN tunnel to ensure all traffic is encrypted.

Answer

Replace the virtual private gateway with a transit gateway and attach the VPN connection.

Question 14

A company wants to block incoming traffic from specific IP addresses at the edge of the AWS network before it reaches the application load balancer. Which AWS service should be used?

Accepted Answer

AWS WAF web ACL associated with the ALB. AWS WAF can be associated with an Application Load Balancer to filter incoming traffic based on IP addresses at the edge (before reaching the ALB). Option B is wrong because Network ACLs operate at the subnet level and do not inspect HTTP traffic or block at the edge. Option C is wrong because Security Groups are stateful firewalls that operate at the instance or ENI level, not at the edge, and they cannot block traffic before the ALB. Option D is wrong because CloudFront is a CDN that can be used with WAF, but the question specifically asks for blocking at the edge before the ALB, and CloudFront alone does not provide IP filtering for an ALB without WAF.

Answer

Network ACLs on the VPC subnet containing the ALB

Answer

Security Groups attached to the ALB

Answer

Amazon CloudFront with origin access identity

Question 15

A company has a VPC with multiple subnets. They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all outbound traffic from the VPC to the internet. Currently, the VPC route table has a default route (0.0.0.0/0) pointing to an internet gateway. What routing change is required to route outbound traffic through the firewall?

Accepted Answer

Add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the Network Firewall endpoint's elastic network interface.. To route traffic through AWS Network Firewall, you must add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the firewall endpoint's elastic network interface (ENI). This forces outbound traffic to be inspected by the firewall before reaching the internet gateway. Option A is incorrect because a VPC Gateway Endpoint is used for private access to AWS services, not for routing traffic through a firewall. Option B is incorrect because a NAT gateway provides outbound connectivity but does not inspect traffic; adding another hop to the firewall would be redundant and not supported. Option D is incorrect because a transit gateway is used to connect multiple VPCs or on-premises networks, not to route traffic through a single firewall.

Answer

Create a VPC Gateway Endpoint for the firewall service.

Answer

Add a NAT gateway in a public subnet and route 0.0.0.0/0 to the NAT gateway, then point the NAT gateway to the firewall.

Answer

Add a transit gateway and attach the VPC and the internet gateway to it, then route traffic through the firewall.