ANS-C01 Network Security, Compliance and Governance Practice Test 5 — 15 Questions

Question 1

A company has a hybrid network with an AWS Direct Connect connection to a VPC. They also have a site-to-site VPN connection as a backup. The VPC routing tables are configured with a route to the on-premises CIDR via the virtual private gateway. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect connection even when it is healthy. What is the most likely cause?

Accepted Answer

The VPC route table has a more specific route pointing to the VPN connection. Option A is correct because when both Direct Connect and VPN are configured, the VPC route table typically has a single route to the on-premises CIDR via the virtual private gateway. Without more specific routing, the VPN BGP route may be preferred depending on route propagation and prefix matching. Option B is wrong because the VPN connection being down would not cause traffic to avoid Direct Connect. Option C is wrong because the Direct Connect virtual interface must be in the 'Available' state to pass traffic. Option D is wrong because the AWS Site-to-Site VPN connection uses a virtual private gateway or transit gateway, not a Customer Gateway as the target.

Answer

The VPN connection is down

Answer

The VPN connection is attached to a Customer Gateway

Answer

The Direct Connect virtual interface is in the 'Down' state

Question 2

A company wants to allow its developers to access Amazon RDS databases from their on-premises network without traversing the public internet. Which solution meets this requirement?

Accepted Answer

Establish an AWS Site-to-Site VPN connection. Option B is correct because an AWS Site-to-Site VPN connection creates an encrypted tunnel between on-premises and the VPC, allowing private access to RDS. Option A is wrong because RDS does not have a VPC endpoint. Option C is wrong because NAT gateways are used for outbound traffic to the internet, not inbound. Option D is wrong because VPC Peering connects VPCs, not on-premises networks.

Answer

Use a NAT gateway in the VPC

Answer

Create a VPC endpoint for RDS

Answer

Configure VPC Peering between the on-premises network and the VPC

Question 3

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

Accepted Answer

Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket. Option A is correct because the Lambda function's execution role needs an IAM policy allowing s3:GetObject (or appropriate actions) on the bucket. The bucket policy must also grant access to the Lambda execution role. Option B is wrong because VPC endpoints do not grant access; IAM permissions are still needed. Option C is wrong because a VPC endpoint is not required for Lambda to access S3 in the same account if the bucket policy allows the role. Option D is wrong because the Lambda function does not need an internet gateway if it uses a VPC endpoint or if the bucket policy allows the role.

Answer

Remove the bucket policy that denies all principals

Answer

Attach an internet gateway to the VPC and a public IP to the Lambda function

Answer

Create a VPC endpoint for S3 and attach it to the Lambda function's VPC

Question 4

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. They need to centrally manage and enforce VPC security group rules across all accounts. Which service should they use?

Accepted Answer

AWS Firewall Manager. Option C is correct because AWS Firewall Manager allows centralized management of security groups and AWS WAF rules across accounts in AWS Organizations. Option A is wrong because AWS Config is for compliance and configuration tracking, not enforcement. Option B is wrong because AWS CloudFormation StackSets deploy resources but do not centrally enforce security group rules. Option D is wrong because AWS Service Catalog is for provisioning approved resources, not managing security groups.

Answer

AWS CloudFormation StackSets

Answer

AWS Config

Answer

AWS Service Catalog

Question 5

A company wants to ensure that all traffic to and from its Amazon EC2 instances in a VPC is inspected by a third-party security appliance. The instances are in private subnets and must maintain their private IP addresses. Which solution should be used?

Accepted Answer

Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC. Option A is correct because Gateway Load Balancer with a Gateway Load Balancer endpoint (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' IP addresses. Option B is wrong because a Network Load Balancer is for load balancing, not inline inspection. Option C is wrong because VPC Peering does not provide traffic inspection. Option D is wrong because a Transit Gateway with a VPN does not provide inline inspection.

Answer

Deploy a Transit Gateway with a site-to-site VPN to the appliance

Answer

Use VPC Peering to connect to a central inspection VPC

Answer

Set up a Network Load Balancer in front of the instances

Question 6

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?

Accepted Answer

IP set match condition in AWS WAF. Option C is correct because AWS WAF has IP set match conditions that allow you to specify IP addresses to block or allow. Option A is wrong because security groups are stateful firewalls for EC2 instances, not for ALB. Option B is wrong because NACLs are stateless firewalls at the subnet level, not integrated with ALB. Option D is wrong because AWS Shield Advanced is for DDoS protection, not IP-based blocking.

Answer

Security group associated with the ALB

Answer

AWS Shield Advanced

Answer

Network ACL on the ALB's subnets

Question 7

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?

Accepted Answer

Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC. Option D is correct because with overlapping CIDRs, VPC Peering cannot route traffic correctly due to identical CIDR blocks. A Transit Gateway with Network Manager can be used with a VPN connection or Direct Connect to connect the VPCs, but the question asks for a solution to allow communication without changing CIDRs. However, the only way to allow communication with overlapping CIDRs is to use PrivateLink (VPC endpoint services) where one VPC hosts the service and the other VPC accesses it via an endpoint, avoiding routing conflicts. Option A is wrong because security groups do not solve routing issues. Option B is wrong because NAT gateways do not resolve overlapping CIDR routing. Option C is wrong because a Transit Gateway does not resolve overlapping CIDRs without additional configuration like NAT.

Answer

Configure a NAT gateway in each VPC

Answer

Use security group references to allow traffic between the instances

Answer

Create a Transit Gateway and attach both VPCs

Question 8

A company has an AWS Direct Connect connection and wants to ensure that all traffic from its VPC to an S3 bucket in another region stays within the AWS network. How should this be accomplished?

Accepted Answer

Use a NAT gateway in the VPC and route traffic through the Direct Connect public VIF. Option A is correct because a VPC Gateway Endpoint for S3 is regional and allows traffic to stay within the AWS network only within the same region. For cross-region access, using a Gateway Endpoint in the source region combined with a Direct Connect connection does not keep traffic on the AWS network; it goes over the public internet. The correct approach is to use a VPC Gateway Endpoint in the source region to access S3 in the same region, but for cross-region, you must use a Direct Connect Virtual Interface (public VIF) or a Direct Connect Gateway to route traffic via AWS backbone. Option B is wrong because a VPC interface endpoint for S3 is not supported. Option C is wrong because a NAT gateway would route traffic over the internet. Option D is wrong because a VPN does not keep traffic on the AWS backbone for cross-region S3 access.

Answer

Create a VPC Gateway Endpoint for S3 in the source VPC

Answer

Create a VPC Interface Endpoint for S3 in the source VPC

Answer

Establish a VPN connection to the S3 bucket

Question 9

A company wants to monitor and log all changes to security group rules in their AWS account for compliance purposes. Which TWO services can be used together to achieve this?

Accepted Answer

Amazon EventBridge. Option A (AWS CloudTrail) logs API calls, including changes to security group rules. Option D (Amazon EventBridge) can capture CloudTrail events and trigger notifications. Together, they provide monitoring and logging. Option B is wrong because VPC Flow Logs capture traffic, not configuration changes. Option C is wrong because AWS Config records resource state but does not log API calls. Option E is wrong because AWS Trusted Advisor provides best-practice checks, not change logging.

Answer

AWS Trusted Advisor

Answer

VPC Flow Logs

Answer

AWS Config

Question 10

A company is designing a network security solution for a VPC that hosts a multi-tier web application. The web servers are in a public subnet, and the application servers are in a private subnet. The company wants to ensure that the web servers can only be accessed on port 443 from the internet, and the application servers can only be accessed from the web servers on port 3306. Which THREE components should be configured?

Accepted Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports. Option A (Security group for web servers) allows inbound 443 from internet. Option D (Security group for application servers) allows inbound 3306 from web server security group. Option E (Network ACL on public subnet) can add a layer of stateless filtering. Option B is wrong because a NACL on private subnet would allow all traffic unless explicitly denied, but the security group is the primary control. Option C is wrong because a NACL on the public subnet is acceptable, but for the private subnet, the security group is sufficient, and NACL is not required.

Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0

Answer

Network ACL on the private subnet allowing inbound 3306 from the public subnet CIDR

Question 11

A company is using AWS Organizations and wants to centrally manage and enforce the use of VPC endpoints for S3 across all accounts. Which THREE services/tools can be combined to achieve this?

Accepted Answer

AWS Config rules. Option A (AWS Service Control Policy) can enforce that VPC endpoint creation is allowed or denied. Option C (AWS CloudFormation StackSets) can deploy VPC endpoints across multiple accounts. Option E (AWS Config rules) can detect non-compliant resources. Option B is wrong because VPC Flow Logs do not enforce compliance. Option D is wrong because AWS Transit Gateway is for network connectivity, not policy enforcement.

Answer

VPC Flow Logs

Answer

AWS Transit Gateway

Question 12

A company uses AWS Organizations with SCPs to restrict access. The security team wants to ensure that no IAM user or role can disable AWS Shield Advanced protections. Which SCP effect should be used?

Accepted Answer

Deny. Option C is correct because the Deny effect in an SCP explicitly prohibits actions. Option A is wrong because Allow in an SCP does not restrict, it only permits. Option B is wrong because Deny in an IAM policy is not as effective when SCPs are present; SCPs can override IAM allows. Option D is wrong because there is no 'Block' effect in SCPs.

Answer

Deny in the IAM policy

Answer

Allow

Answer

Block

Question 13

A company needs to securely connect an on-premises data center to AWS using multiple VPN tunnels. The security team requires that all traffic between the VPC and on-premises be encrypted and that the tunnels use a second authentication mechanism beyond pre-shared keys. Which solution meets these requirements?

Accepted Answer

Use AWS VPN CloudHub with multiple VPN connections and configure certificate-based authentication for each tunnel. Option B is correct because AWS VPN CloudHub uses multiple VPN connections with BGP routing and supports certificate-based authentication with mutual TLS for enhanced security. Option A is wrong because Direct Connect does not provide encryption by default; VPN over Direct Connect adds encryption but not a second authentication factor beyond PSK. Option C is wrong because Client VPN is for individual clients, not site-to-site. Option D is wrong because Transit Gateway with VPN attachments uses PSK by default; certificate-based authentication is not supported.

Answer

Use AWS Client VPN with mutual authentication

Answer

Use AWS Transit Gateway with VPN attachments and configure pre-shared keys

Answer

Use AWS Direct Connect with a public VIF and establish an IPsec VPN over the Direct Connect connection

Question 14

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for logging and compliance. Which service should be used?

Accepted Answer

NAT Gateway. Option A is correct because a NAT Gateway provides outbound internet access from private subnets with a single Elastic IP. Option B is wrong because an Internet Gateway allows inbound and outbound traffic from public subnets. Option C is wrong because a VPC Endpoint is for accessing AWS services privately. Option D is wrong because a Transit Gateway is for connecting multiple VPCs and on-premises networks.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPC Endpoint

Question 15

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices that a specific IP address is generating a high number of requests and wants to block it immediately. What is the MOST efficient way to block this IP address?

Accepted Answer

Add the IP address to an IP set in AWS WAF and update the rule to block it. Option C is correct because AWS WAF allows creating an IP set and updating a rule to block it, providing immediate effect. Option A is wrong because a Network ACL can block IPs at the subnet level but requires updating the NACL, which is less granular and slower. Option B is wrong because security groups cannot block specific IPs in inbound rules for ALB traffic; they work at the instance level. Option D is wrong because creating a new web ACL and associating it takes more steps than updating an existing rule.

Answer

Add a deny rule in the security group attached to the ALB

Answer

Update the Network ACL associated with the ALB subnets to deny inbound traffic from the IP address

Answer

Create a new web ACL in AWS WAF and associate it with the ALB