ANS-C01 Network Security, Compliance and Governance Practice Test 6 — 15 Questions

Question 1

A company needs to encrypt data at rest in Amazon S3. Which AWS service manages the encryption keys?

Accepted Answer

AWS KMS. AWS KMS (Key Management Service) is the AWS service that manages encryption keys for Amazon S3. AWS KMS allows you to create, rotate, and control access to encryption keys used to encrypt data at rest in S3. Option A (AWS Secrets Manager) is incorrect because it manages secrets like database credentials, not encryption keys for S3. Option B (AWS Certificate Manager) is incorrect because it manages SSL/TLS certificates, not encryption keys. Option C (AWS CloudHSM) is incorrect because while it provides hardware security modules for key storage, it is not the default or primary key manager for S3; AWS KMS is the integrated service for S3 encryption.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 2

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made in the AWS account, including calls to authorize security group rule changes (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). This makes it the appropriate service for auditing changes to security group rules. AWS Config (Option B) records resource configurations and can track changes, but it is not the primary service for API-level auditing. VPC Flow Logs (Option C) capture network traffic metadata, not configuration changes. Amazon Inspector (Option D) is a vulnerability assessment service, not an audit service for changes.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 3

A company uses AWS Direct Connect to connect their on-premises network to AWS. They want to encrypt all traffic between their on-premises router and the AWS Direct Connect location. Which solution should they implement?

Accepted Answer

Enable MACsec on the Direct Connect connection.. MACsec provides encryption at Layer 2 for Direct Connect. Option A is wrong because IPsec VPN over the internet is not over Direct Connect. Option B is wrong because TLS is for application layer. Option D is wrong because AWS PrivateLink is for VPC endpoints.

Answer

Use an IPsec VPN over the internet for additional encryption.

Answer

Use AWS PrivateLink to create a secure connection.

Answer

Use TLS to encrypt the traffic at the application layer.

Question 4

A company needs to block traffic from a specific IP address range in their VPC. Which component should be used?

Accepted Answer

Network ACL. Network ACLs are stateless and can explicitly deny traffic from specific IP address ranges at the subnet level. Option A is wrong because route tables control the path of network traffic, not filtering. Option C is wrong because an internet gateway provides internet connectivity but does not filter traffic. Option D is wrong because security groups are stateful and can only allow traffic, not deny specific IP ranges.

Answer

Route table

Answer

Internet gateway

Answer

Security group

Question 5

A company wants to implement a defense-in-depth strategy for a web application hosted on AWS. Which TWO services should they use to protect against common web exploits and DDoS attacks?

Accepted Answer

AWS WAF. And B are correct: AWS WAF protects against common web exploits like SQL injection and cross-site scripting, and AWS Shield Advanced provides enhanced DDoS protection for web applications. Option C (Amazon Inspector) is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not inline protection. Option D (AWS Network Firewall) is a managed network firewall for filtering traffic at the VPC level, not specifically for web exploits. Option E (Amazon GuardDuty) is a threat detection service that continuously monitors for malicious activity, but it does not provide inline prevention.

Answer

Amazon Inspector

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Question 6

A company is designing a network security architecture for a multi-account environment using AWS Organizations. They need to centrally manage and enforce security policies across all accounts. Which THREE services should they consider?

Accepted Answer

AWS Firewall Manager. Options B, C, and E are correct: AWS Firewall Manager centrally manages firewall rules across accounts; AWS Security Hub provides a unified view of security alerts and compliance checks; AWS CloudTrail logs API calls across accounts for auditing and monitoring. Option A is wrong because AWS Direct Connect is a dedicated network connection service, not a policy enforcement service. Option D is wrong because Amazon Route 53 Resolver DNS Firewall is a DNS-layer filtering service, but the question asks for central policy enforcement and management across accounts, which is not its primary function.

Answer

AWS Direct Connect

Answer

Amazon Route 53 Resolver DNS Firewall

Question 7

A company is using Amazon S3 to store sensitive data. They want to ensure that data is encrypted at rest and that access is logged. Which TWO services should they enable?

Accepted Answer

S3 Server Access Logs. And E are correct: S3 Server-Side Encryption (SSE) encrypts data at rest, fulfilling the encryption requirement; S3 Server Access Logs log requests to the bucket, fulfilling the logging requirement. Option A (AWS Config) is incorrect because it monitors configuration changes, not data access. Option C (VPC Flow Logs) is incorrect because it captures network traffic, not S3 requests. Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls but S3 Server Access Logs provide more granular object-level logging, and the question asks for access logging, not API call logging.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 8

A company wants to restrict access to its S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to require that objects uploaded to the bucket are encrypted with a specific KMS key, thus enforcing SSE-KMS. Option B (s3:x-amz-server-side-encryption) only checks for any server-side encryption, not a specific key. Option C (kms:ViaService) is a condition key for KMS key policies, not S3 bucket policies. Option D (kms:EncryptionContext) is used in KMS policies to restrict encryption contexts, not applicable to S3 bucket policies.

Answer

s3:x-amz-server-side-encryption

Answer

kms:ViaService

Answer

kms:EncryptionContext

Question 9

A security team requires that all traffic between Amazon EC2 instances in different subnets of a VPC be logged. Which AWS service should be used to capture and log the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces and can be published to Amazon CloudWatch Logs or Amazon S3. This allows logging of all traffic between EC2 instances in different subnets. Option B is incorrect because AWS CloudTrail logs API calls and actions taken on AWS resources, not network traffic. Option C is incorrect because VPC Traffic Mirroring copies traffic for deep packet inspection and analysis, but it is not a logging service; it is used for traffic monitoring and security analysis. Option D is incorrect because AWS Config tracks resource configuration changes and evaluates compliance, not network traffic.

Answer

AWS CloudTrail

Answer

VPC Traffic Mirroring

Answer

AWS Config

Question 10

A company wants to allow its developers to access Amazon RDS databases from their on-premises network without traversing the public internet. Which solution meets this requirement?

Accepted Answer

Establish an AWS Site-to-Site VPN connection. An AWS Site-to-Site VPN connection establishes a secure, encrypted tunnel between the on-premises network and the Amazon VPC, allowing resources like RDS databases to be accessed privately without traversing the public internet. Option A is incorrect because a NAT gateway enables outbound internet traffic from a private subnet, not inbound private access from on-premises. Option B is incorrect because while Amazon RDS supports interface VPC endpoints, these endpoints are only accessible from within the VPC and do not provide connectivity from an on-premises network; a VPC endpoint alone does not meet the requirement. Option C is incorrect because VPC Peering connects two VPCs within AWS, not an on-premises network to a VPC.

Answer

Use a NAT gateway in the VPC

Answer

Create a VPC endpoint for RDS

Answer

Configure VPC Peering between the on-premises network and the VPC

Question 11

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

Accepted Answer

Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket. The Lambda execution role needs an IAM policy that allows s3:GetObject (or appropriate actions) on the S3 bucket. In this scenario, the bucket policy denies all principals except those explicitly allowed. Since the Lambda function is supposed to access the bucket, the bucket policy already explicitly allows the Lambda role. Therefore, only the IAM permission is missing. Adding the IAM policy (Option A) resolves the issue. Option B is wrong because removing the bucket policy would allow all principals, violating the security intent. Option C is wrong because Lambda functions in a VPC do not require internet gateways or public IPs to reach S3, and it does not address permissions. Option D is wrong because a VPC endpoint provides network connectivity but does not grant IAM permissions; the Lambda execution role still needs the IAM policy.

Answer

Remove the bucket policy that denies all principals

Answer

Attach an internet gateway to the VPC and a public IP to the Lambda function

Answer

Create a VPC endpoint for S3 and attach it to the Lambda function's VPC

Question 12

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. They need to centrally manage and enforce VPC security group rules across all accounts. Which service should they use?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager allows centralized management of security groups and AWS WAF rules across accounts in AWS Organizations. Option A is wrong because AWS CloudFormation StackSets deploy resources but do not centrally enforce security group rules. Option B is wrong because AWS Config is for compliance and configuration tracking, not enforcement. Option D is wrong because AWS Service Catalog is for provisioning approved resources, not managing security groups.

Answer

AWS CloudFormation StackSets

Answer

AWS Config

Answer

AWS Service Catalog

Question 13

A company wants to ensure that all traffic to and from its Amazon EC2 instances in a VPC is inspected by a third-party security appliance. The instances are in private subnets and must maintain their private IP addresses. Which solution should be used?

Accepted Answer

Configure a Gateway Load Balancer and Gateway Load Balancer endpoints in the VPC. Gateway Load Balancer (GWLB) with Gateway Load Balancer endpoints (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' private IP addresses. The GWLB acts as a transparent layer between the VPC and the appliance, inspecting all traffic. Option A is incorrect because a Transit Gateway with a site-to-site VPN does not provide inline inspection without modifying the routing and IP addresses. Option C is incorrect because VPC Peering does not inherently provide traffic inspection; you would still need to route traffic through an appliance. Option D is incorrect because a Network Load Balancer is designed for load balancing, not for inline inspection of all traffic.

Answer

Deploy a Transit Gateway with a site-to-site VPN to the appliance

Answer

Use VPC Peering to connect to a central inspection VPC

Answer

Set up a Network Load Balancer in front of the instances

Question 14

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?

Accepted Answer

IP set match condition in AWS WAF. AWS WAF includes IP set match conditions that allow you to specify IP addresses to block or allow, which directly addresses the requirement to block requests from a specific IP address range. Option A is wrong because security groups are stateful firewalls for EC2 instances and cannot be directly associated with an ALB to filter web requests. Option C is wrong because AWS Shield Advanced provides DDoS protection but does not offer granular IP-based blocking. Option D is wrong because network ACLs operate at the subnet level and are not integrated with ALB for web request filtering.

Answer

Security group associated with the ALB

Answer

AWS Shield Advanced

Answer

Network ACL on the ALB's subnets

Question 15

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?

Accepted Answer

Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC. With overlapping CIDRs (both VPCs use 10.0.0.0/16), VPC Peering cannot route traffic correctly due to identical IP ranges. AWS PrivateLink (VPC endpoint services) allows instances in one VPC (service consumer) to access a service hosted in the other VPC (service provider) via private IP addresses, creating a logical connection that bypasses the routing conflict. The service is fronted by a Network Load Balancer, and consumer instances access it through a VPC endpoint. This works without modifying CIDRs. Option A is incorrect because NAT gateways are used for outbound internet access and do not resolve overlapping CIDR routing. Option C is incorrect because security group references allow traffic based on security group IDs but still rely on IP routing, which fails with overlapping CIDRs. Option D is incorrect because a Transit Gateway does not resolve overlapping CIDRs; overlapping routes would cause routing conflicts unless additional measures like NAT are used, which the question precludes.

Answer

Configure a NAT gateway in each VPC

Answer

Use security group references to allow traffic between the instances

Answer

Create a Transit Gateway and attach both VPCs