ANS-C01 Network Security, Compliance and Governance Practice Test 4 — 15 Questions

Question 1

A company uses AWS WAF to protect a web application. They notice that some malicious requests are being allowed. After investigating, they find that the requests have valid AWS WAF tokens but the payloads are obfuscated. Which WAF configuration should be reviewed to improve detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bot Control managed rule group. The Bot Control managed rule group in AWS WAF is specifically designed to detect and block automated traffic, including bots that may use valid tokens but exhibit malicious behavior. It includes rules that analyze request patterns, such as obfuscated payloads, to identify sophisticated bots. Since the malicious requests have valid WAF tokens, they are likely from bots that have solved the token challenge, and Bot Control can provide additional detection mechanisms beyond token validation.

Answer

Rate-based rule

Answer

SQL injection match condition

Answer

IP set match rule

Question 2

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its backend targets. Which AWS service should be used to terminate TLS at the ALB and re-encrypt traffic to the targets?

Accepted Answer

Application Load Balancer with HTTPS listeners. An ALB with HTTPS listeners terminates TLS using an ACM certificate on the front end, and when the target group is configured for HTTPS, the ALB establishes a new TLS session to each backend target — this is end-to-end encryption with re-encryption at the load balancer. This is the standard AWS pattern for encrypting traffic between an ALB and its targets.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Answer

AWS WAF

Question 3

A company needs to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile apps. Which AWS service should they use?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service because it provides temporary, limited-privilege credentials for accessing AWS resources. STS allows you to grant trusted users access to AWS resources without creating long-term IAM credentials, which is ideal for mobile apps where credentials need to be temporary and scoped.

Answer

AWS Key Management Service (KMS)

Answer

Amazon Cognito user pools

Answer

IAM user with access keys

Question 4

A company wants to secure network traffic between on-premises data centers and AWS using AWS Site-to-Site VPN. Which TWO components are required to establish a VPN connection?

Accepted Answer

Customer Gateway (CGW). A Site-to-Site VPN connection requires a Customer Gateway (CGW) on the on-premises side, which is the AWS resource representing the physical or software VPN device and its public IP address, so option B is correct. It also requires a Virtual Private Gateway (VGW) attached to the target VPC on the AWS side to serve as the VPN concentrator endpoint, making option E correct. Together, the CGW and VGW are the two endpoints between which the VPN tunnels are established. Option A (Transit Gateway) is not required because it is an optional hub for connecting multiple VPCs and on-premises networks, not a mandatory component for a basic Site-to-Site VPN. Option C (VPN Connection) is the resulting resource created between the CGW and VGW rather than a prerequisite component, and option D (Direct Connect) is a separate dedicated private connectivity service, not part of a Site-to-Site VPN setup.

Answer

Transit Gateway

Answer

VPN Connection

Answer

Direct Connect connection

Question 5

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. Users in a different VPC with IP range 10.0.0.0/16 are able to access objects, but users in a different VPC with IP range 10.1.0.0/16 cannot. What is the most likely cause?

Accepted Answer

The users are accessing the bucket through a NAT Gateway, which changes the source IP. When instances in a private VPC access S3 through a NAT Gateway, the source IP seen by S3 is the NAT Gateway's Elastic IP, not the instance's private IP. If the bucket policy uses an aws:SourceIp condition matching 10.1.0.0/16, the request will fail because the observed source IP is the NAT EIP. The 10.0.0.0/16 users likely use a VPC endpoint or direct path that preserves the expected source IP.

Answer

The bucket policy uses the wrong condition key

Answer

The bucket policy specifies the wrong resource ARN

Answer

The bucket policy does not specify a principal

Question 6

Refer to the exhibit. A network engineer examines the network ACL for a subnet. Which statement best describes the effect of this network ACL?

Accepted Answer

Inbound TCP traffic is allowed, but all outbound traffic is denied. The inbound rule explicitly allows TCP traffic (protocol 6) from any source (0.0.0.0/0). However, the outbound rules consist only of a default deny rule, which blocks all outbound traffic. Therefore, inbound TCP traffic is allowed, but all outbound traffic is denied. Option A is incorrect because outbound traffic is denied, not allowed. Option C is incorrect because only inbound TCP is allowed, not all inbound traffic. Option D is incorrect because outbound traffic is denied.

Answer

Both inbound and outbound TCP traffic are allowed

Answer

All inbound traffic is allowed

Answer

All outbound traffic is allowed

Question 7

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which SCP should be applied to the root OU?

Accepted Answer

Deny s3:PutBucketEncryption unless encryption settings include AES256 or aws:kms. SCPs are the correct mechanism in AWS Organizations for enforcing guardrails across accounts, and they work by denying actions that don't meet conditions. Option C uses a Deny statement with a condition that blocks s3:PutBucketEncryption unless the request specifies AES256 or aws:kms encryption, which enforces encryption at the API level. This is the standard pattern for preventive controls in Organizations.

Answer

Create an IAM policy that allows s3:PutBucketEncryption only with specific conditions

Answer

Attach an IAM policy to each S3 bucket requiring encryption

Answer

Use AWS Config rules to auto-enable encryption on existing buckets

Question 8

A network engineer is designing a VPC with private subnets for workloads that must not have direct internet access. However, the workloads need to download patches from a specific third-party vendor's IP range. Which solution minimizes the attack surface?

Accepted Answer

Create a managed prefix list for the vendor's IPs and add a route in the private subnet route table to a NAT gateway, with the prefix list as destination. Creating a managed prefix list for the vendor's IPs and routing through a NAT gateway with the prefix list as destination allows the private subnets to access only the vendor's IP range, minimizing the attack surface. The NAT gateway provides outbound internet access, but the route table entry restricts traffic to the specified prefix list.

Answer

Configure a VPC endpoint for the vendor's service

Answer

Deploy a proxy server in a public subnet and configure the workloads to use it for all internet traffic

Answer

Establish a VPN connection to the vendor's network and route all traffic to the vendor through the VPN

Question 9

A security engineer is troubleshooting connectivity issues. An EC2 instance cannot access the internet. The instance is in a private subnet with a route table that has a default route (0.0.0.0/0) pointing to a NAT gateway. The NAT gateway is in a public subnet with an Elastic IP. The security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The network ACL in the public subnet is blocking inbound traffic to the NAT gateway. For an EC2 instance in a private subnet to access the internet via a NAT gateway, the NAT gateway must be able to receive traffic from the private subnet and forward it to the internet gateway. The NAT gateway resides in a public subnet, and its associated network ACL must allow inbound traffic from the private subnet's CIDR on the ephemeral ports used for return traffic. If the network ACL in the public subnet is blocking inbound traffic to the NAT gateway, the return traffic from the internet cannot reach the NAT gateway, and thus the instance cannot access the internet.

Answer

The NAT gateway does not have a security group allowing outbound traffic

Answer

The internet gateway is not attached to the VPC

Answer

The route table in the private subnet has no route to the NAT gateway

Question 10

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose 3)

Accepted Answer

A VPN tunnel between the customer gateway and the virtual private gateway. Options A, D, E are correct. A site-to-site VPN requires a VPN tunnel between the on-premises customer gateway and the AWS virtual private gateway (or transit gateway). The customer gateway device (hardware or software) is deployed on-premises to terminate the VPN tunnel. Option B is incorrect because VPC endpoints are used for private access to AWS services, not for VPN connections. Option C is incorrect because AWS Direct Connect is a dedicated physical connection, not a requirement for a VPN connection.

Answer

A VPC endpoint for the VPN service

Answer

An AWS Direct Connect dedicated line

Question 11

Which TWO statements about AWS WAF are accurate? (Choose 2)

Accepted Answer

AWS WAF can block or allow web requests based on conditions such as IP addresses, HTTP headers, and URI strings. Option D is correct because AWS WAF operates at the application layer (Layer 7) and evaluates web requests against customizable rules and conditions, including IP address match, HTTP header inspection, URI string matching, and other criteria, to allow, block, or count traffic. Option E is correct because AWS WAF is deployed by associating a web ACL with supported resources: Application Load Balancers, Amazon CloudFront distributions, Amazon API Gateway REST APIs, AWS AppSync GraphQL APIs, and (for WAF v2) ALBs and AppSync. Option A is incorrect because network-layer (Layer 3/4) DDoS protection is provided by AWS Shield (Standard/Advanced) and services like CloudFront and Route 53, not by AWS WAF, which filters HTTP(S) requests. Option B is incorrect because AWS WAF does not inspect traffic at the VPC level via VPC Flow Logs; VPC Flow Logs capture IP traffic metadata for network monitoring, and WAF is not a VPC-level inspection tool. Option C is incorrect because AWS WAF does not automatically mitigate DDoS attacks without manual intervention; it requires user-defined rules and web ACLs, while automatic DDoS mitigation is a feature of AWS Shield.

Answer

AWS WAF provides protection against network-layer DDoS attacks

Answer

AWS WAF can inspect traffic at the VPC level using VPC Flow Logs

Answer

AWS WAF automatically mitigates DDoS attacks without manual intervention

Question 12

An IAM policy is created and attached to a user. The user reports they cannot stop a production EC2 instance. What is the most likely reason?

Accepted Answer

The EC2 instance does not have the tag Environment=production. The IAM policy likely includes a condition key such as ec2:ResourceTag/Environment requiring the instance to have the tag 'Environment=production'. If the instance lacks that tag, the action is denied, even if the user has the permission to stop instances. Options B, C, and D are incorrect because the issue is specifically due to the missing tag, not a region condition, group attachment, or missing action.

Answer

The policy is missing a region condition

Answer

The policy is not attached to the user's group

Answer

The policy does not include ec2:StopInstances

Question 13

A network security engineer is reviewing the NACL configuration. An EC2 instance in the subnet associated with this NACL is not receiving SSH connections from the internet. What is the issue?

Accepted Answer

The rule order is incorrect; the deny rule should have a lower rule number than the allow rule to effectively block traffic. The correct answer is C: the rule order is incorrect, because NACL rules are evaluated in ascending numerical order and the first matching rule wins, so a deny rule with a lower rule number than the allow rule blocks SSH traffic before the allow rule is ever evaluated. In this scenario, the EC2 instance cannot receive SSH connections because the deny rule takes precedence over the allow rule. Option A is wrong because if the NACL were not associated with the subnet, it would not affect the instance's traffic at all. Option B is wrong because protocol 6 is TCP, not ICMP, and SSH does use TCP. Option D is wrong because SSH does use port 22, so the stated port range is not the problem.

Answer

The NACL is not associated with the subnet

Answer

The protocol is incorrect; SSH uses TCP, but protocol 6 is for ICMP

Answer

The port range is incorrect; SSH uses port 22, but the rule allows port 22

Question 14

A company wants to securely connect an on-premises data center to a VPC using AWS Site-to-Site VPN. The security team requires that all traffic between the on-premises network and the VPC be encrypted and that the VPN tunnel be highly available. Which design BEST meets these requirements?

Accepted Answer

Create two VPN tunnels to the same virtual private gateway for redundancy.. AWS Direct Connect with a private VIF does not inherently encrypt traffic; a VPN overlay would be required, and a single Direct Connect connection is not highly available. Option B is incorrect because a single VPN tunnel provides encryption but not high availability; if the tunnel fails, connectivity is lost. Option C is correct because a VPN connection with two tunnels to the same virtual private gateway provides redundancy for the tunnels, and the virtual private gateway is a highly available service within a region. Option D is incorrect because an AWS VPC can only have one virtual private gateway; you cannot attach two virtual private gateways to the same VPC. The recommended design for high availability is to use a single VPN connection with two tunnels (Option C) or multiple VPN connections to different VPCs.

Answer

Use AWS Direct Connect with a private VIF and enable encryption on the connection.

Answer

Create a single VPN tunnel with a virtual private gateway and enable encryption.

Answer

Create a VPN connection with two tunnels, each terminating on a different virtual private gateway in the same VPC.

Question 15

A security engineer is designing a network ACL for a public-facing web application in a VPC. The application uses an Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an RDS database in a private subnet. The engineer needs to allow HTTPS traffic from the internet to the ALB, and allow the ALB to forward traffic to the web servers on port 8080. The web servers need to query the database on port 3306. Which network ACL configuration should the engineer implement for the private subnet containing the web servers?

Accepted Answer

Inbound: allow 0.0.0.0/0 on port 8080; Outbound: allow 0.0.0.0/0 on all ports. The most correct because it allows inbound traffic on port 8080 from the internet (which is the port the ALB forwards to the web servers) and outbound traffic on all ports, enabling web servers to respond to the ALB (via ephemeral ports) and query the database on port 3306. Although allowing inbound from 0.0.0.0/0 is not as restrictive as using the ALB subnet CIDR, it is still functional since the web servers are in a private subnet with no direct internet route. Option C is incorrect because its outbound rule only allows traffic to the database subnet on port 3306, missing the required outbound rules for HTTP responses to the ALB (ALB subnet CIDR on ephemeral ports).

Answer

Inbound: allow 0.0.0.0/0 on port 3306; Outbound: allow 0.0.0.0/0 on port 8080

Answer

Inbound: allow ALB subnet CIDR on port 8080 and ephemeral ports; Outbound: allow database subnet CIDR on port 3306

Answer

Inbound: allow 0.0.0.0/0 on port 443; Outbound: allow 0.0.0.0/0 on port 3306