ANS-C01 Network Security, Compliance and Governance Practice Test 5 — 15 Questions

Question 1

An organization has a requirement that all cross-account access to Amazon S3 buckets must be logged and monitored. The security team has enabled AWS CloudTrail and S3 server access logs. However, they notice that some cross-account access attempts are not being logged. Which additional step should be taken to ensure all cross-account access is logged?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudTrail data events for S3 buckets to capture object-level API operations.. CloudTrail logs management events by default, but not data events. S3 server access logs capture object-level operations but require proper configuration. Option A is wrong because CloudWatch Logs is for log storage, not for enabling logging. Option B is wrong because enabling default encryption does not affect logging. Option D is wrong because S3 Object Lock is for compliance, not logging.

Answer

Create a CloudWatch Logs subscription filter to capture all S3 access logs.

Answer

Enable default encryption on all S3 buckets.

Answer

Enable S3 Object Lock on all buckets to prevent deletion of logs.

Question 2

A company wants to centrally manage and enforce security policies across multiple AWS accounts and VPCs. They need to ensure that all VPCs have a specific set of rules, such as disabling public subnets. Which AWS service should be used?

Accepted Answer

AWS Organizations with Service Control Policies (SCPs). AWS Organizations with Service Control Policies (SCPs) can centrally control permissions across accounts, allowing enforcement of rules like disabling public subnets. Option B is wrong because IAM is for users and roles, not for VPC-level controls. Option C is wrong because AWS Shield is for DDoS protection. Option D is wrong because AWS Config evaluates resource configurations but does not enforce policies.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Shield

Answer

AWS Config

Question 3

A company has an Amazon RDS for MySQL database in a private subnet. The database should only be accessible from a specific fleet of EC2 instances in the same VPC. Which combination of security controls should be used to meet this requirement?

Accepted Answer

Use a security group for the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances.. A security group on the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances restricts access to only those instances that are members of that security group. Option A is incorrect because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules; they cannot reference security groups. Option B is incorrect because a VPN connection is used for connectivity to external networks, not for communication within the same VPC. Option D is incorrect because IAM database authentication controls user authentication to the database, not network-level access from EC2 instances.

Answer

Use a network ACL on the private subnet that allows MySQL traffic from the EC2 instances' IP addresses.

Answer

Set up a VPN connection between the EC2 instances and the RDS instance.

Answer

Enable IAM database authentication for the RDS instance and require EC2 instances to use IAM credentials.

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. They have an AWS Site-to-Site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN is configured with dynamic routing (BGP). The on-premises network advertises a route to 192.168.0.0/16 via BGP. The VPC route table has a static route to 192.168.0.0/16 pointing to a virtual private gateway. The company also has a Direct Connect connection to the same on-premises network advertising the same CIDR. The VPC route table has a propagated route to 192.168.0.0/16 pointing to a Direct Connect virtual interface, learned via BGP. Which route will be used for traffic destined to 192.168.0.0/16?

Accepted Answer

Traffic will use the VPN connection because the static route to the virtual private gateway takes precedence over the propagated route from Direct Connect.. In AWS, when a VPC route table has both a static route and a propagated route (learned via BGP) for the same destination, the static route takes precedence regardless of the gateway type. In this scenario, the VPN route is a static route pointing to the virtual private gateway, while the Direct Connect route is a propagated route automatically added via BGP from the Direct Connect virtual interface. Therefore, the static route to the VPN gateway is used. Note that AWS does not allow two static routes with the same destination in the same route table; thus the Direct Connect route must be propagated.

Answer

Traffic will use the VPN connection because the static route to the virtual private gateway has a lower prefix.

Answer

Traffic will use the Direct Connect connection because it is a more reliable connection.

Answer

Traffic will be load-balanced between VPN and Direct Connect.

Question 5

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must not. Which TWO design choices meet these requirements? (Choose two.)

Accepted Answer

Use a security group on the web tier to allow HTTP/HTTPS from 0.0.0.0/0, and security groups on the app and database tiers that only allow traffic from the web tier security group.. The correct answers are C and E. Option C uses security groups to control traffic between tiers: the web tier security group allows HTTP/HTTPS from 0.0.0.0/0, and the app and database tier security groups only allow traffic from the web tier security group. This ensures that the application and database tiers are not directly accessible from the internet. Option E places the web tier in a public subnet with an internet gateway in its route table, so it can receive inbound traffic from the internet. The app and database tiers are placed in private subnets without a direct route to the internet gateway, so they cannot be accessed from the internet. Option A is incorrect because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for internet access. Option B is incorrect because a NAT gateway provides outbound internet access for private subnets, not inbound internet access to the web tier. Option D is incorrect because placing all tiers in a public subnet exposes the application and database tiers to the internet, even with restrictive security groups, because they would still have a route to the internet gateway.

Answer

Use a VPC Gateway Endpoint for the web tier to access the internet.

Answer

Use a NAT gateway in a public subnet to provide internet access to the app and database tiers for updates.

Answer

Place all tiers in a public subnet with a security group that restricts access to the app and database tiers.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). They have an AWS Network Firewall deployed in a firewall subnet. They want to inspect all traffic between subnet A and subnet B. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure the Network Firewall rule group to allow the desired traffic between subnets.. To inspect traffic between subnet A and subnet B, the traffic must be routed through the Network Firewall endpoint. This is achieved by adding a route in subnet A's route table that points to the firewall endpoint's elastic network interface (ENI) for the destination subnet B (10.0.2.0/24), and similarly for subnet B's route table for subnet A (10.0.1.0/24). Additionally, the Network Firewall rule groups must be configured to allow the desired traffic; otherwise, the firewall will block it by default. Options A, D, and E are incorrect: A (transit gateway) is not needed because both subnets are in the same VPC; D (VPC peering) is unnecessary for intra-VPC traffic; E (security group rule) does not route traffic—security groups are applied at the instance level, not to control traffic between subnets.

Answer

Attach a transit gateway to the VPC and route traffic through it.

Answer

Create a VPC peering connection between subnet A and subnet B.

Answer

Create a security group rule that allows traffic between subnet A and subnet B.

Question 7

A company needs to log all network traffic between EC2 instances in a VPC for security analysis. They want to capture metadata about traffic, including source and destination IP, ports, protocol, and packet counts. Which THREE AWS services or features can be used to achieve this? (Choose three.)

Accepted Answer

VPC Flow Logs. Options B, C, and D are correct because VPC Flow Logs capture metadata about network traffic (source/destination IP, ports, protocol, packet counts), Traffic Mirroring captures packets for deep inspection, and AWS Network Firewall provides flow logs for traffic passing through the firewall. Option A is wrong because CloudTrail logs API calls, not network traffic. Option E is wrong because Security Group rules logging does not exist; Security Groups do not log traffic.

Answer

AWS CloudTrail

Answer

Security Group rules logging

Question 8

A security team has attached the above IAM policy to a user. The user tries to add an inbound rule to a security group that allows traffic from 0.0.0.0/0. The request is denied. However, the user is able to add a rule allowing traffic from 203.0.113.10. Which statement explains this behavior?

Accepted Answer

The Deny statement only denies the action when the CIDR is 0.0.0.0/0, which overrides the Allow for that specific case. For other CIDRs, the Allow applies because the user's source IP is within the allowed range.. The Deny statement denies the ec2:AuthorizeSecurityGroupIngress action only when the condition is satisfied—specifically, when the CIDR being added is 0.0.0.0/0. The Allow statement permits the action when the user's source IP falls within 203.0.113.0/24. Since the user's IP is 203.0.113.10, the Allow applies. However, the Deny overrides the Allow for the specific case of 0.0.0.0/0. For other CIDRs, such as 203.0.113.10, the Deny condition is not met, so the Allow takes effect. Option A is incorrect because the condition key is valid; Option B is incorrect because the Deny does not block all ingress actions; Option C is incorrect because the Allow is not unconditional—it depends on the user's source IP.

Answer

The Deny statement incorrectly uses the condition ec2:AuthorizeSecurityGroupIngress, which is not a valid condition key, so the Deny is ignored.

Answer

The Deny statement denies all ec2:AuthorizeSecurityGroupIngress actions, so the user cannot add any inbound rules.

Answer

The Allow statement allows all ec2:AuthorizeSecurityGroupIngress actions from IPs in 203.0.113.0/24, so the user can add any rule.

Question 9

A network engineer has created a gateway VPC endpoint for S3 as shown in the exhibit. The endpoint is associated with route table rtb-12345678. An EC2 instance in a subnet that uses route table rtb-12345678 tries to download an object from my-bucket. The request fails with an access denied error. Which change should the engineer make to resolve the issue?

Accepted Answer

Add a route in route table rtb-12345678 that sends traffic to the S3 service via the VPC endpoint.. The endpoint policy requires the aws:SourceVpc condition to match the VPC ID, but the condition key is misspelled or the value is incorrect? Actually, the condition is correct. However, the error is likely because the route table does not have a route to the endpoint. Gateway endpoints require a route in the associated route table that points to the endpoint. Option A is wrong because the endpoint policy already allows s3:GetObject. Option B is wrong because the endpoint is already associated with the route table. Option C is wrong because the bucket policy is not shown; but the issue is likely the route. Option D is correct: add a route to the S3 service in route table rtb-12345678.

Answer

Associate the endpoint with a different route table.

Answer

Add a bucket policy to my-bucket that allows access from the VPC endpoint.

Answer

Modify the endpoint policy to allow all S3 actions.

Question 10

A CloudFormation stack was created with the above snippet. An administrator notices that the EC2 instance can receive HTTP traffic from the internet, but cannot access the internet itself (e.g., to download updates). What is the most likely cause?

Accepted Answer

The instance is in a private subnet without a NAT gateway or route to an internet gateway.. The instance can receive inbound HTTP traffic because the security group ingress rule allows HTTP. However, it cannot initiate outbound traffic to the internet. The security group egress rule allows all traffic, so outbound is not restricted. The most likely cause is that the instance is in a private subnet without a NAT gateway or route to an internet gateway. Private subnets cannot directly access the internet without a NAT device. Therefore, Option B is correct. Option A is incorrect because the egress rule is permissive. Option C is incorrect because the security group is properly attached (inbound works). Option D is incorrect because the ingress rule is not the issue.

Answer

The security group egress rule restricts outbound traffic to only HTTP.

Answer

The security group is not attached to the instance properly.

Answer

The security group ingress rule only allows HTTP from the internet, but not other protocols needed for updates.

Question 11

A company uses AWS Organizations with SCPs to restrict access. The security team needs to prevent users in the 'Developers' OU from disabling AWS Config or modifying its rules. Which SCP effect should be used?

Accepted Answer

Deny. A Deny effect explicitly blocks the action, overriding any Allow. Option A is wrong because Allow would not prevent the action. Option C is wrong because SCPs don't have a Block effect. Option D is wrong because NotAction is a condition element, not an effect.

Answer

Block

Answer

Allow

Answer

NotAction

Question 12

A company is designing a hub-and-spoke network in AWS. The security team requires that all traffic between VPCs in different spokes must be inspected by a third-party firewall deployed in the hub VPC. Which architecture meets this requirement with minimal complexity?

Accepted Answer

Use a Transit Gateway with separate route tables for each spoke VPC, and configure the spoke route tables to route all inter-spoke traffic through the hub VPC firewall.. Transit Gateway with separate route tables allows you to configure routes so that traffic between spoke VPCs is directed through the hub VPC firewall for inspection. Option A is incorrect because VPC peering does not centralize traffic inspection; it creates direct connectivity without forcing traffic through the hub. Option B is incorrect because AWS PrivateLink is designed for accessing services privately, not for routing inter-VPC traffic. Option D is incorrect because AWS Direct Connect is used for on-premises connectivity, not for inter-VPC routing within AWS.

Answer

Create VPC peering connections between each spoke VPC and configure security groups to enforce inspection.

Answer

Use AWS PrivateLink to connect all spoke VPCs to a central service in the hub.

Answer

Set up AWS Direct Connect between all VPCs and route through a central firewall.

Question 13

A company uses AWS WAF to protect its web application. The security team wants to block requests that contain SQL injection attempts. Which WAF rule type should be used?

Accepted Answer

SQL injection match condition. AWS WAF allows you to create a SQL injection match condition to inspect requests for malicious SQL code and block them. Option A is wrong because geographic match rules filter based on the geographic origin of requests, not SQL injection. Option C is wrong because IP set rules block requests from specific IP addresses, not SQL injection patterns. Option D is wrong because rate-based rules limit the rate of requests from a source, not inspect for SQL injection.

Answer

Geographic match rule

Answer

IP set rule

Answer

Rate-based rule

Question 14

A company uses AWS Shield Advanced for DDoS protection. During an attack, they notice that legitimate traffic is being throttled. Which configuration change should be made to reduce false positives while maintaining protection?

Accepted Answer

Increase the rate limit threshold in the associated AWS WAF rate-based rule.. Increasing the rate limit threshold in the associated AWS WAF rate-based rule can reduce false positives by allowing more legitimate traffic while still providing protection. Option A is incorrect because reducing the rate limit would increase false positives. Option C is incorrect because disabling the rule removes protection. Option D is incorrect because increasing sensitivity of the web ACL is not a direct setting; rate limits are set per rule.

Answer

Reduce the rate limit in the Shield Advanced configuration.

Answer

Disable the AWS WAF rate-based rule for the duration of the attack.

Answer

Increase the sensitivity of the AWS WAF web ACL.

Question 15

A company is deploying a multi-tier application in a VPC. The web servers must be accessible from the internet, but the database servers must not be. Which architecture meets these requirements?

Accepted Answer

Place web servers in public subnets with an internet gateway, and databases in private subnets with no direct internet access.. Placing web servers in public subnets with an internet gateway and database servers in private subnets with no direct internet access ensures only the web tier is accessible from the internet. Option A is incorrect because a NAT gateway is used for outbound internet access from private subnets, not for allowing inbound traffic to the database servers. Option C is incorrect because an AWS Site-to-Site VPN is used to connect on-premises networks to a VPC, not to provide internet access to private subnets. Option D is incorrect because placing database servers in public subnets directly exposes them to the internet; security groups alone do not prevent internet routability, and best practice is to place databases in private subnets.

Answer

Use a NAT gateway for the database servers to allow inbound traffic.

Answer

Place all servers in private subnets and use an AWS Site-to-Site VPN for internet access.

Answer

Place both web and database servers in public subnets and use security groups to restrict database access.