ANS-C01 Network Security, Compliance and Governance Practice Test 4 — 15 Questions

Question 1

A CloudFormation stack was created with the above snippet. An administrator notices that the EC2 instance can receive HTTP traffic from the internet, but cannot access the internet itself (e.g., to download updates). What is the most likely cause?

Accepted Answer

The instance is in a private subnet without a NAT gateway or route to an internet gateway.. Option A is correct because the security group egress rule allows all traffic (protocol -1) to 0.0.0.0/0, so outbound is allowed. The issue is likely that the instance is in a private subnet without a NAT gateway or internet gateway route. Option B is wrong because the egress rule is permissive. Option C is wrong because the ingress rule allows HTTP. Option D is wrong because the security group is correctly associated.

Answer

The security group egress rule restricts outbound traffic to only HTTP.

Answer

The security group is not attached to the instance properly.

Answer

The security group ingress rule only allows HTTP from the internet, but not other protocols needed for updates.

Question 2

A company uses AWS Organizations with SCPs to restrict access. The security team needs to prevent users in the 'Developers' OU from disabling AWS Config or modifying its rules. Which SCP effect should be used?

Accepted Answer

Deny. Option B is correct because a Deny effect explicitly blocks the action, overriding any Allow. Option A is wrong because Allow would not prevent the action. Option C is wrong because SCPs don't have a Block effect. Option D is wrong because NotAction is a condition element, not an effect.

Answer

Block

Answer

Allow

Answer

NotAction

Question 3

A company is designing a hub-and-spoke network in AWS. The security team requires that all traffic between VPCs in different spokes must be inspected by a third-party firewall deployed in the hub VPC. Which architecture meets this requirement with minimal complexity?

Accepted Answer

Use a Transit Gateway with separate route tables for each spoke VPC, and configure the spoke route tables to route all inter-spoke traffic through the hub VPC firewall.. Option A is correct because Transit Gateway with route tables in each spoke pointing default route to the hub VPC forces traffic through the firewall. Option B is wrong because VPC peering does not centralize inspection. Option C is wrong because AWS PrivateLink is for service access, not inter-VPC routing. Option D is wrong because Direct Connect is for on-premises connectivity.

Answer

Create VPC peering connections between each spoke VPC and configure security groups to enforce inspection.

Answer

Use AWS PrivateLink to connect all spoke VPCs to a central service in the hub.

Answer

Set up AWS Direct Connect between all VPCs and route through a central firewall.

Question 4

A company uses AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection attempts. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. Option C is correct because AWS WAF has managed rule groups specifically for SQL injection. Option A is wrong because rate-based rules limit request rate. Option B is wrong because IP set rules block IP addresses. Option D is wrong because geo-match rules filter by geography.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 5

A company uses AWS Shield Advanced for DDoS protection. During an attack, they notice that legitimate traffic is being throttled. Which configuration change should be made to reduce false positives while maintaining protection?

Accepted Answer

Increase the rate limit threshold in the associated AWS WAF rate-based rule.. Option A is correct because adjusting the rate limit threshold in the AWS WAF rate-based rule associated with Shield Advanced can reduce false positives. Option B is wrong because disabling the rule removes protection. Option C is wrong because increasing the threshold on the web ACL is not a direct setting; rate limits are set per rule. Option D is wrong because Shield Advanced does not use a separate rate limit setting.

Answer

Reduce the rate limit in the Shield Advanced configuration.

Answer

Disable the AWS WAF rate-based rule for the duration of the attack.

Answer

Increase the sensitivity of the AWS WAF web ACL.

Question 6

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, but the database servers must not be. Which architecture meets these requirements?

Accepted Answer

Place web servers in public subnets with an internet gateway, and databases in private subnets with no direct internet access.. Option B is correct: public subnets for web servers with internet gateway, private subnets for databases with no direct internet access. Option A is wrong because placing databases in public subnets exposes them. Option C is wrong because NAT gateway allows outbound only, not inbound. Option D is wrong because private subnets with NAT still allow outbound, but the question is about inbound.

Answer

Use a NAT gateway for the database servers to allow inbound traffic.

Answer

Place all servers in private subnets and use an AWS Site-to-Site VPN for internet access.

Answer

Place both web and database servers in public subnets and use security groups to restrict database access.

Question 7

A company needs to encrypt data at rest in Amazon S3. Which AWS service manages the encryption keys?

Accepted Answer

AWS KMS. Option A is correct: AWS KMS manages encryption keys for S3. Option B is wrong because AWS Certificate Manager manages SSL/TLS certificates. Option C is wrong because AWS CloudHSM is a hardware security module but is not the default key manager for S3. Option D is wrong because AWS Secrets Manager manages secrets.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 8

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. Option B is correct: AWS CloudTrail records API calls, including changes to security group rules. Option A is wrong because AWS Config records resource configurations and changes, but CloudTrail is more direct for API auditing. However, for auditing changes, CloudTrail is the primary service. Option C is wrong because VPC Flow Logs capture network traffic, not configuration changes. Option D is wrong because Amazon Inspector assesses vulnerabilities.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 9

A company uses AWS Direct Connect to connect their on-premises network to AWS. They want to encrypt all traffic between their on-premises router and the AWS Direct Connect location. Which solution should they implement?

Accepted Answer

Enable MACsec on the Direct Connect connection.. Option C is correct: MACsec provides encryption at Layer 2 for Direct Connect. Option A is wrong because IPsec VPN over the internet is not over Direct Connect. Option B is wrong because TLS is for application layer. Option D is wrong because AWS PrivateLink is for VPC endpoints.

Answer

Use an IPsec VPN over the internet for additional encryption.

Answer

Use AWS PrivateLink to create a secure connection.

Answer

Use TLS to encrypt the traffic at the application layer.

Question 10

A company needs to block traffic from a specific IP address range in their VPC. Which component should be used?

Accepted Answer

Network ACL. Option D is correct: Network ACLs are stateless and can block IP ranges at the subnet level. Option A is wrong because security groups are stateful and can't deny specific IPs (only allow). Option B is wrong because route tables control routing, not filtering. Option C is wrong because internet gateway is a gateway, not a filter.

Answer

Route table

Answer

Internet gateway

Answer

Security group

Question 11

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which TWO services should they use to protect against common web exploits and DDoS attacks?

Accepted Answer

AWS WAF. Option A and C are correct: AWS WAF protects against web exploits like SQL injection, and AWS Shield Advanced provides enhanced DDoS protection. Option B is wrong because Network Firewall is for network-level filtering, not specifically web exploits. Option D is wrong because GuardDuty is for threat detection, not inline prevention. Option E is wrong because Inspector is for vulnerability scanning.

Answer

Amazon Inspector

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Question 12

A company is designing a network security architecture for a multi-account environment using AWS Organizations. They need to centrally manage and enforce security policies across all accounts. Which THREE services should they consider?

Accepted Answer

AWS Firewall Manager. Option A, B, and C are correct: AWS Firewall Manager centrally manages firewall rules across accounts; AWS Security Hub provides a unified view of security alerts; AWS CloudTrail logs API calls across accounts. Option D is wrong because Amazon Route 53 Resolver DNS Firewall is not a central policy enforcement service. Option E is wrong because AWS Direct Connect is for connectivity, not policy enforcement.

Answer

AWS Direct Connect

Answer

Amazon Route 53 Resolver DNS Firewall

Question 13

A company is using Amazon S3 to store sensitive data. They want to ensure that data is encrypted at rest and that access is logged. Which TWO services should they enable?

Accepted Answer

S3 Server Access Logs. Option B and D are correct: S3 Server-Side Encryption (SSE) encrypts data at rest; S3 Server Access Logs log requests. Option A is wrong because CloudTrail logs API calls but S3 access logs are more granular. Option C is wrong because VPC Flow Logs capture network traffic. Option E is wrong because AWS Config records configuration changes.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 14

A company wants to restrict access to its S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. Option C is correct because the s3:x-amz-server-side-encryption-aws-kms-key-id condition key ensures objects are encrypted with a specific KMS key, enforcing SSE-KMS. Option A is wrong because s3:x-amz-server-side-encryption only checks for encryption, not the specific key. Option B is wrong because kms:EncryptionContext is not an S3 condition key. Option D is wrong because kms:ViaService is used for KMS policy, not S3 bucket policy.

Answer

s3:x-amz-server-side-encryption

Answer

kms:ViaService

Answer

kms:EncryptionContext

Question 15

A security team requires that all traffic between Amazon EC2 instances in different subnets of a VPC be logged. Which AWS service should be used to capture and log the traffic?

Accepted Answer

VPC Flow Logs. Option B is correct because VPC Flow Logs capture IP traffic information and can be published to CloudWatch Logs or S3. Option A is wrong because AWS CloudTrail logs API calls, not network traffic. Option C is wrong because VPC Traffic Mirroring captures traffic for analysis but is not primarily for logging. Option D is wrong because AWS Config tracks resource configuration changes.

Answer

AWS CloudTrail

Answer

VPC Traffic Mirroring

Answer

AWS Config

ANS-C01 Network Security, Compliance and Governance Practice Test 4 — 15 Questions

Exhibit

ANS-C01 Network Security, Compliance and Governance Practice Test 4 — 15 Questions

Exhibit