ANS-C01 Network Security, Compliance and Governance Practice Test 5 — 15 Questions

Question 1

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3. Which control mechanism should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy (SCP) that denies PutBucketEncryption if the encryption is not SSE-S3.. A service control policy (SCP) in AWS Organizations can deny PutBucketEncryption unless SSE-S3 is specified, enforcing encryption across all accounts. Option A is wrong because IAM policies are account-level and cannot enforce across all accounts in an organization. Option B is wrong because bucket policies are per-bucket and would require manual configuration on each bucket. Option D is wrong because CloudTrail is a logging service that does not enforce compliance; it only provides monitoring after the fact.

Answer

Assign an IAM policy to all users that requires SSE-S3.

Answer

Configure a bucket policy on each bucket to deny writes without SSE-S3.

Answer

Use AWS CloudTrail to monitor and alert on non-compliant bucket creations.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize data transfer costs and avoid exposing the private instance to inbound traffic from the internet. Which solution meets these requirements?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and ensure the patches are hosted in S3. Route private subnet traffic to the endpoint.. A VPC Gateway Endpoint for Amazon S3 provides private connectivity to S3 without traversing the internet, eliminating data transfer costs and avoiding exposure to inbound traffic. Option D is incorrect because assigning a public IP and using an internet gateway would expose the instance to inbound traffic. Option B (NAT gateway) and Option C (NAT instance) incur data transfer costs and are not required when the patches are in S3 and can be accessed via a gateway endpoint.

Answer

Attach an internet gateway to the VPC and route the private subnet's default route to a NAT gateway in the public subnet.

Answer

Launch a NAT instance in the public subnet and route the private subnet's default route to it.

Answer

Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.

Question 3

A company wants to audit all network traffic to and from an EC2 instance for compliance. The security team needs to capture full packet contents, including headers and payload, and store them in Amazon S3 for analysis. Which AWS service should they use?

Accepted Answer

Traffic Mirroring. AWS Traffic Mirroring allows you to capture full packet contents (headers and payload) from an EC2 instance's elastic network interface and send them to a target (another ENI or Network Load Balancer) for analysis, and you can store the captured packets in S3 via a tool like tcpdump or a third-party appliance. It is the only AWS-native service that provides full packet capture at the instance level.

Answer

Amazon CloudWatch Logs with the EC2 agent

Answer

AWS Config

Answer

VPC Flow Logs

Question 4

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team notices that the BGP session between the on-premises router and the AWS virtual private gateway (VGW) is flapping. The on-premises router is configured to advertise a specific prefix. Which configuration change is MOST likely to stabilize the BGP session?

Accepted Answer

Adjust BGP timers (keepalive and hold time) to match between the on-premises router and the VGW.. BGP session flapping is often caused by mismatched keepalive and hold timers between peers. When the hold time expires before a keepalive is received, the session resets. AWS VGW uses a default hold time of 90 seconds and keepalive of 30 seconds. If the on-premises router is configured with a shorter hold time (e.g., 30 seconds) or different keepalive, the session may flap. Aligning these timers ensures consistent expectations and stabilizes the session. This is a common configuration best practice for Direct Connect.

Answer

Add ASN prepending to the advertised prefix.

Answer

Enable BGP MD5 authentication on both sides.

Answer

Apply a route-map on the VGW to filter the prefix.

Question 5

A security engineer needs to ensure that all traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the engineer do to meet this requirement?

Accepted Answer

No additional configuration needed; VPC peering traffic is automatically encrypted.. VPC peering traffic within the same AWS region stays on the AWS backbone network and is encrypted in transit by default at the physical layer. AWS does not expose this encryption to customers, but it satisfies the requirement for encryption in transit between the two VPCs. No additional configuration such as VPN or Transit Gateway is needed for same-region peering.

Answer

Set up a VPN connection between the two VPCs and route traffic through it.

Answer

Configure network ACLs to enforce encryption.

Answer

Use AWS Transit Gateway to connect the VPCs and enable encryption.

Question 6

A network engineer is troubleshooting connectivity issues between an EC2 instance and an RDS database in the same VPC. The EC2 instance can connect to the database, but the connection is slow. Which TWO actions should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.. Option C is correct because security groups are stateful and control which traffic is permitted; verifying that the EC2 instance's security group allows outbound traffic on the database port (e.g., 3306 for MySQL or 5432 for PostgreSQL) and that the RDS security group allows inbound traffic from the EC2 instance's security group or private IP ensures the connection is not being throttled or partially blocked, which can manifest as slow or intermittent connectivity. Option D is correct because VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, packets, and ACCEPT/REJECT actions) for network interfaces, allowing the engineer to analyze traffic patterns, identify dropped packets, retransmissions, or unusual latency between the EC2 instance and the RDS database. Option A is incorrect because a default route to the internet is not required for intra-VPC communication between an EC2 instance and RDS in the same VPC; the local route handles that traffic, and adding an internet route would not diagnose slowness. Option B is incorrect because network ACLs are stateless by design, not stateful, so checking whether the database subnet's NACL is stateful is based on a false premise. Option E is incorrect because route propagation settings apply to route tables associated with virtual private gateways, transit gateways, or VPN connections, not to diagnosing intra-VPC latency between an EC2 instance and RDS.

Answer

Verify the route table for the database subnet to ensure there is a default route to the internet.

Answer

Check the network ACL for the database subnet to ensure it is stateful.

Answer

Check the route propagation settings on the VPC.

Question 7

A security engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. The engineer wants to capture full packets and store them for later analysis. Which TWO AWS services can be used together to accomplish this? (Choose TWO.)

Accepted Answer

Amazon S3. Traffic Mirroring (option D) is correct because it is the AWS feature that copies full packet data from an EC2 instance's elastic network interface and delivers it to a target, such as another ENI or a Network Load Balancer, enabling deep packet capture for troubleshooting. Amazon S3 (option A) is correct because the mirrored traffic can be captured by a monitoring appliance and the resulting full packet capture (PCAP) files can be stored durably in an S3 bucket for later analysis. Together they satisfy the requirement to capture full packets and retain them for later inspection. VPC Flow Logs (option C) is not correct because it records only metadata about IP traffic (source/destination, ports, protocol, bytes, action) and does not capture full packet payloads. AWS Config (option B) is not correct because it tracks resource configuration changes and compliance, not network traffic. Amazon CloudWatch Logs (option E) is not correct because it stores log events, not full packet captures, and is not a packet capture mechanism.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 8

A company wants to restrict access to an S3 bucket so that only objects with server-side encryption using AWS KMS (SSE-KMS) can be uploaded. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The condition key s3:x-amz-server-side-encryption-aws-kms-key-id is used in a bucket policy to require that uploads specify a particular KMS key ID via the x-amz-server-side-encryption-aws-kms-key-id header. To enforce SSE-KMS specifically, the policy combines s3:x-amz-server-side-encryption with value aws:kms and can further restrict the key ID using this condition key. This ensures only objects encrypted with the approved KMS key are accepted.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

aws:SourceVpce

Question 9

A security engineer is designing a network firewall solution for a VPC with multiple subnets. The solution must inspect traffic between instances in the same VPC, including traffic within the same subnet. Which AWS service should be used?

Accepted Answer

AWS Network Firewall. (AWS Network Firewall) is correct because it is a managed service that can inspect traffic between subnets and within a subnet in a VPC, providing stateful and stateless rules for deep packet inspection. Option A (Security Groups) is wrong because they are stateful but cannot inspect traffic within the same subnet; they only allow or deny traffic based on rules. Option B (VPC Flow Logs) is wrong because they capture metadata about traffic but do not inspect packets. Option D (AWS WAF) is wrong because it is designed for web application layer 7 inspection, not for general network traffic inspection.

Answer

Security Groups

Answer

VPC Flow Logs

Answer

AWS WAF

Question 10

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have block public access enabled. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) that denies bucket creation without block public access.. Service control policies (SCPs) in AWS Organizations set the maximum permissions for accounts and can be used to deny actions org-wide. An SCP that denies s3:PutBucketPublicAccessBlock or s3:CreateBucket unless block public access is enabled enforces the requirement preventively at the API level across every account. This is the only option that blocks noncompliant actions before they occur.

Answer

Use AWS CloudTrail to monitor bucket creation and alert.

Answer

Use AWS Config rules to detect and remediate noncompliant buckets.

Answer

Create an IAM role in each account that restricts bucket permissions.

Question 11

A company uses AWS CloudFormation to deploy resources. The security team wants to ensure that no IAM user can modify the stack set if they are not authorized via a specific IAM policy. Which feature should be used?

Accepted Answer

Service control policy (SCP) in AWS Organizations. A Service Control Policy (SCP) in AWS Organizations sets the maximum permissions for all principals in member accounts, so it can centrally block any IAM user from modifying CloudFormation stack sets unless they hold the authorized policy. Because SCPs are evaluated before identity policies and any matching Deny wins, they enforce the restriction across every account in the OU regardless of local IAM configuration. This is the correct centralized guardrail.

Answer

AWS Config rule with remediation

Answer

CloudFormation stack policy

Answer

IAM permissions boundary

Question 12

An application running on EC2 instances needs to access a DynamoDB table. The security team requires that traffic does not traverse the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for DynamoDB.. A VPC Gateway Endpoint is the correct solution because it provides private connectivity to DynamoDB without requiring an Internet Gateway, NAT device, or public IP addresses. Traffic between the VPC and DynamoDB stays within the AWS network, satisfying the security requirement that traffic does not traverse the internet. Gateway endpoints are specifically designed for S3 and DynamoDB, using a route table entry to direct traffic to the service.

Answer

Create a VPC Interface Endpoint for DynamoDB.

Answer

Attach an Internet Gateway to the VPC.

Answer

Deploy a NAT gateway and update the route table.

Question 13

Which TWO encryption methods for data at rest in Amazon S3 use AWS-managed or customer-managed keys? (Choose TWO.)

Accepted Answer

SSE-S3. SSE-S3 (D) is correct because Amazon S3 server-side encryption with S3-managed keys uses AES-256 keys that AWS fully manages on your behalf, satisfying the requirement for AWS-managed keys for data at rest. SSE-KMS (E) is correct because it uses AWS KMS customer master keys (CMKs) that can be either AWS-managed or customer-managed, and S3 uses these KMS keys to encrypt objects at rest. SSE-C (A) is not correct here because it relies on encryption keys supplied and managed by the customer, not AWS-managed or customer-managed KMS keys. Client-Side Encryption (B) is not correct because the customer encrypts data before uploading, so keys are managed outside AWS S3/KMS. SSL/TLS (C) is not correct because it is a transport encryption protocol for data in transit, not an at-rest encryption method for S3 objects.

Answer

SSE-C

Answer

Client-Side Encryption

Answer

SSL/TLS

Question 14

Refer to the exhibit. An EC2 instance is associated with the IAM role shown. Which action can the EC2 instance perform?

Accepted Answer

Read objects from any S3 bucket.. The IAM role shown in the exhibit grants s3:GetObject (and typically s3:ListBucket) permissions, which map directly to reading objects from S3. Since the policy allows GetObject on the resource, the EC2 instance can retrieve (read) objects from any S3 bucket the policy scopes to. Write, delete, and upload actions require s3:PutObject and s3:DeleteObject, which are not granted by a read-only policy.

Answer

Write objects to any S3 bucket.

Answer

Delete objects from any S3 bucket.

Answer

Upload objects to any S3 bucket.

Question 15

A company uses AWS Organizations with SCPs to restrict access. The security team notices that users in the 'Developers' account can launch EC2 instances with public IP addresses, even though the SCP denies ec2:AssociateAddress. What is the most likely reason?

Accepted Answer

The users logged in as the root user of the account.. Service Control Policies (SCPs) in AWS Organizations do not apply to the root user of a member account — the root user is exempt from SCP restrictions. Therefore, if users in the Developers account can launch EC2 instances with public IPs despite an SCP denying ec2:AssociateAddress, the most likely explanation is that they are operating as the account's root user, which bypasses the SCP.

Answer

The SCP was applied to the wrong organizational unit.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The users assumed an IAM role that bypasses the SCP.