ANS-C01 Network Security, Compliance and Governance Practice Test 6 — 15 Questions

Question 1

A security engineer is troubleshooting connectivity between an EC2 instance in a private subnet and an S3 bucket. The instance has a VPC gateway endpoint for S3, and the route table has a route to the endpoint. The security group for the instance allows all outbound traffic. However, the instance cannot access the S3 bucket. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group outbound rule does not allow traffic to the S3 prefix list.. Although the security group allows all outbound traffic to 0.0.0.0/0, this rule does not apply to traffic destined for the S3 prefix list when using a VPC gateway endpoint. Gateway endpoints require a security group rule that explicitly allows HTTPS traffic to the S3 prefix list ID. Without this rule, traffic is blocked. Option A is correct. Option B is incorrect because the VPC endpoint is indeed associated with the route table. Option C is incorrect because a NAT gateway is not needed for S3 access via the endpoint. Option D is incorrect because the bucket policy is not the issue; the security group rule is missing.

Answer

The VPC endpoint is not associated with the route table.

Answer

The route table does not have a route to a NAT gateway.

Answer

The S3 bucket policy does not allow access from the VPC endpoint.

Question 2

A company has a requirement to encrypt all data in transit between EC2 instances and an RDS database. The database is in a private subnet, and the application connects using an SSL connection. The security team wants to ensure that even if the network is compromised, the data remains confidential. What additional measure should be taken?

Accepted Answer

Use a client-side encryption library to encrypt data before sending.. Using a client-side encryption library to encrypt data before sending ensures that data remains confidential even if the network is compromised, because encryption occurs at the application layer before transmission. This adds an extra layer of security beyond SSL, protecting against man-in-the-middle attacks and other network threats.

Answer

Deploy a VPN connection between the EC2 instances and the RDS database.

Answer

Enable encryption at rest on the RDS instance.

Answer

Use IAM database authentication with SSL.

Question 3

A company has a VPC with multiple subnets. They deploy a Network Firewall to inspect traffic. The firewall is configured with a stateful rule that allows outbound HTTP traffic to any destination. However, traffic from an EC2 instance in a private subnet to an external web server fails. The route table for the private subnet has a default route pointing to the firewall endpoint. What is the likely issue?

Accepted Answer

The firewall endpoint is in a different Availability Zone than the instance.. The firewall endpoint must be in the same Availability Zone as the subnet's route table target. If the endpoint is in a different AZ, traffic is not properly routed to it. The stateful rule allows HTTP, so A is incorrect. Security groups do not affect outbound traffic unless explicitly blocked, and default outbound is allow, so B is incorrect. A NAT gateway is not needed when using a firewall, so D is incorrect.

Answer

The stateful rule order is incorrect; a default deny rule is blocking traffic.

Answer

The EC2 instance security group does not allow outbound HTTP.

Answer

The subnet does not have a route to a NAT gateway.

Question 4

A company is designing a network security architecture for a multi-tier application. They need to ensure that the web tier can only communicate with the app tier on port 443, and the app tier can only communicate with the database tier on port 3306. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a security group for the web tier that allows outbound traffic to the app tier security group on port 443.. Option A is correct because a security group on the web tier must have an outbound (egress) rule permitting traffic to the app tier's security group on TCP port 443, which is how AWS security groups reference each other to scope traffic precisely. Option B is correct because security groups are stateful and traffic is only allowed if the destination also permits it, so the app tier's security group needs an inbound (ingress) rule allowing TCP 443 from the web tier's security group. Together, A and B create the required web-to-app flow on port 443 using security-group references rather than CIDR ranges. Option C is unnecessary because AWS Network Firewall is for advanced inspection/filtering, not basic tier-to-tier allow rules, and the scenario doesn't require deep packet inspection. Option D is not appropriate because network ACLs are stateless and subnet-level, requiring separate inbound and outbound rules plus ephemeral port ranges, which is more complex than the security-group approach needed here. Option E is wrong because a VPC endpoint policy controls access to specific AWS services via endpoints, not general traffic between application tiers, and denying all inter-tier traffic contradicts the requirement.

Answer

Deploy an AWS Network Firewall to inspect inter-tier traffic.

Answer

Use network ACLs to statelessly filter traffic on the subnets.

Answer

Configure a VPC endpoint policy to deny all traffic between tiers.

Question 5

A network engineer is troubleshooting connectivity from an EC2 instance in subnet-12345678 to a server on the internet. The instance has a public IP and a security group allowing all outbound traffic. However, traffic fails. Based on the exhibit, what is the issue?

Accepted Answer

The inbound rule only allows TCP traffic, which blocks return traffic for other protocols.. The inbound rule (egress=false) only allows TCP (protocol 6) on port unspecified (all ports), but the outbound rule allows all traffic. However, the inbound rule only allows TCP, so return traffic for non-TCP protocols (like ICMP) is blocked. But the question says connectivity fails, likely because the instance initiates outbound traffic (e.g., HTTP), which is TCP, so that should work. Actually, the issue is that the outbound rule allows all traffic, but the inbound rule only allows TCP, so return traffic for non-TCP (like UDP or ICMP) is blocked. But typical HTTP uses TCP, so maybe the issue is something else. Let's re-evaluate: The outbound rule allows all traffic (protocol -1), but the inbound rule only allows TCP. For outbound connections, the return traffic is inbound, so if the outbound connection is TCP, the return TCP packets are allowed by the inbound rule. However, if the outbound traffic is something else like ICMP (ping), the return ICMP is blocked. The question does not specify the protocol. Option A is correct because the inbound rule only allows TCP, blocking other protocols. Option B is wrong because the outbound rule allows all traffic. Option C is wrong because the security group allows outbound. Option D is wrong because the inbound rule does not restrict TCP on ephemeral ports; it allows TCP from 0.0.0.0/0.

Answer

The inbound rule blocks TCP traffic on ephemeral ports.

Answer

The outbound rule blocks all traffic.

Answer

The security group does not allow outbound traffic.

Question 6

A company uses AWS Organizations with multiple accounts and wants to centrally manage VPC security group rules. They need to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which service should they use to automatically detect and remediate noncompliant security groups?

Accepted Answer

AWS Config. AWS Config with managed rules like restricted-ssh can detect noncompliant security groups, and AWS Config remediation actions can automatically remediate them. AWS Firewall Manager can also centrally manage security group rules across accounts, but it is more about enforcement and policy management. Option A is correct because AWS Config is the primary service for compliance monitoring and remediation. Option C (AWS Firewall Manager) is also a valid service but is more for policy-based management across accounts; however, the question asks for detection and automatic remediation, which AWS Config does directly. Option D (AWS CloudTrail) is for auditing API calls, not for enforcement. Option B (Amazon GuardDuty) is for threat detection, not security group compliance.

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Answer

AWS CloudTrail

Question 7

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must only accept traffic from known corporate IP addresses, but the company also needs to allow healthy traffic from AWS health checkers. Which architecture meets these requirements securely?

Accepted Answer

Configure the Application Load Balancer's security group to allow inbound from corporate IPs, and the EC2 instances' security group to allow inbound from the ALB's security group.. Placing the corporate IP allowlist on the ALB's security group and allowing the EC2 instances' security group to accept traffic only from the ALB's security group creates a secure two-tier architecture. AWS health checkers originate from the ALB, so they are implicitly allowed because the ALB's security group permits them, and instances only trust the ALB. This meets both requirements without exposing instances.

Answer

Create two target groups: one for corporate traffic and one for health check traffic, each with different security groups.

Answer

Use AWS WAF on the ALB to create an IP set containing corporate IPs, and allow all traffic from ALB to instances.

Answer

Use a network ACL on the VPC subnet to allow inbound traffic from corporate IPs and AWS health checker IP ranges.

Question 8

A company needs to encrypt data in transit between an Application Load Balancer and EC2 instances. Which TWO actions should they take?

Accepted Answer

Upload a certificate to AWS Certificate Manager (ACM).. Option C is correct because the ALB needs an SSL/TLS certificate to terminate HTTPS connections, and AWS Certificate Manager (ACM) is the recommended service for provisioning and managing that certificate. Option D is correct because configuring the target group to use HTTPS protocol ensures the ALB re-encrypts traffic when forwarding requests to the EC2 instances, providing end-to-end encryption in transit. Option A is incorrect because a TCP listener operates at Layer 4 and does not provide HTTP/HTTPS termination or the ability to configure HTTPS on the target group. Option B is incorrect because CloudFront encrypts traffic between clients and the edge, but does not encrypt traffic between the ALB and the EC2 instances. Option E is incorrect because while a self-signed certificate could technically be installed on the instances, it is not a recommended or managed solution and does not by itself configure the ALB-to-target encryption; the target group protocol must still be set to HTTPS.

Answer

Create a TCP listener on the ALB.

Answer

Place Amazon CloudFront in front of the ALB.

Answer

Use a self-signed certificate on the EC2 instances.

Question 9

A company is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets across the organization are encrypted with AWS KMS. Which approach should be used to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) at the root level that denies S3 bucket creation unless encryption is configured.. A service control policy (SCP) applied at the root of AWS Organizations enforces guardrails across all member accounts, denying S3 bucket creation unless encryption is configured. SCPs are the correct mechanism for organization-wide preventive controls because they define the maximum permissions for all principals in the affected accounts.

Answer

Configure each S3 bucket with a bucket policy that denies access if encryption is not used.

Answer

Use AWS Config rules to detect unencrypted S3 buckets and automatically remediate them.

Answer

Create an IAM policy that denies creating S3 buckets without encryption and attach it to all users.

Question 10

Refer to the exhibit. A company has an S3 bucket policy that denies PutObject if the object is not encrypted with SSE-KMS. However, uploads are still being allowed without encryption. What is the most likely reason?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' is not present in the upload request, so the condition is not evaluated and the Deny is not applied.. The bucket policy uses a condition key 's3:x-amz-server-side-encryption' to deny uploads that are not encrypted with SSE-KMS. However, if the upload request does not include the 'x-amz-server-side-encryption' header at all, the condition key is not present in the request, so the condition is not evaluated. As a result, the Deny effect is not applied, and the upload is allowed. Option A is incorrect because the policy is valid JSON and would be enforced if the condition were met. Option B is incorrect because an explicit Allow in an IAM policy cannot override a Deny in a bucket policy; the Deny would still apply. Option D is incorrect because bucket policies are evaluated regardless of region as long as the bucket is in the same region as the request's endpoint; the region is not the issue here.

Answer

The bucket policy has a syntax error and is not being enforced.

Answer

The IAM user has an explicit Allow that overrides the Deny in the bucket policy.

Answer

The bucket policy must be attached to the bucket in the same region as the request.

Question 11

A company has a hybrid network architecture with an AWS Direct Connect connection between its on-premises data center and an Amazon VPC. The VPC has a single private subnet with Amazon EC2 instances running a critical application. The on-premises network uses BGP to advertise a route for the VPC's CIDR (10.0.0.0/16) to the on-premises routers. Recently, the company added a new application in a second VPC (VPC-B) with CIDR 10.1.0.0/16 and peered it with the original VPC (VPC-A). After the peering, users on-premises can still reach resources in VPC-A, but cannot reach resources in VPC-B. The VPC-A route table has a route for VPC-B's CIDR pointing to the peering connection. The VPC-B route table has a route for VPC-A's CIDR pointing to the peering connection. The on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface. What is the most likely cause of the issue?

Accepted Answer

The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.. The on-premises network is not advertising VPC-B's CIDR via BGP over Direct Connect. While the on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface, this only directs traffic from on-premises to VPC-B. For return traffic from VPC-B to on-premises, VPC-B needs a route to the on-premises network. Normally, this route would be learned via BGP over Direct Connect if the on-premises network advertised the VPC-B CIDR to the VPC. Without that advertisement, VPC-B does not have a route back to on-premises, causing the connectivity failure. Option A is incorrect because the VPC peering connection is working: VPC-A and VPC-B can communicate, as the issue is only with on-premises reachability. Option C is incorrect because security groups are stateful; if traffic from on-premises reached VPC-B, the return traffic would be automatically allowed. The issue is routing, not security. Option D is incorrect because route propagation for the virtual private gateway only affects VPC-A (if it is attached to the VGW), not VPC-B, which is connected via peering.

Answer

The VPC peering connection is not properly configured.

Answer

The security group on VPC-B instances is blocking inbound traffic from on-premises IP ranges.

Answer

The virtual private gateway does not have route propagation enabled for VPC-B.

Question 12

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to implement a centralized inspection architecture where all traffic between VPCs must be inspected by a security appliance (e.g., firewall) deployed in a dedicated inspection VPC. Currently, traffic flows directly between VPCs using the Transit Gateway. Which architecture change would enforce that all inter-VPC traffic passes through the inspection VPC?

Accepted Answer

Configure the Transit Gateway to use separate route tables for each VPC attachment, with a default route pointing to the inspection VPC's attachment. Then, in the inspection VPC, route traffic back to the Transit Gateway for final delivery.. By using Transit Gateway route tables, you can create separate route tables for each VPC attachment and propagate only a default route pointing to the inspection VPC. This forces all traffic to go through the inspection VPC. Option A is incorrect because VPC peering does not integrate with Transit Gateway. Option C is incorrect because Direct Connect Gateway is for on-premises connectivity, not for inter-VPC routing. Option D is incorrect because Network Load Balancer does not provide routing control.

Answer

Create VPC peering connections between each VPC and the inspection VPC, and remove the Transit Gateway attachments.

Answer

Use AWS Direct Connect Gateway to route traffic through the inspection VPC.

Answer

Deploy a Network Load Balancer in each VPC and configure it to forward traffic to the inspection VPC.

Question 13

A company hosts a multi-tier web application in a VPC. The web servers are in a public subnet, and the application servers are in a private subnet. The application servers need to access a third-party API over the internet. The company wants to ensure that the application servers' IP addresses are not exposed to the internet, and that all outbound traffic to the internet is logged. Additionally, the company wants to restrict outbound traffic to only the specific API endpoints. Which solution should be used?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route in the private subnet's route table pointing to the NAT gateway. Use security groups on the application servers to restrict outbound traffic to the API endpoints. Enable logs on the NAT gateway using VPC Flow Logs or NAT gateway logs.. A NAT gateway in a public subnet allows instances in private subnets to access the internet while hiding their private IPs. By controlling the outbound rules in the security group or using a network firewall, you can restrict traffic to specific API endpoints. AWS CloudWatch Logs or VPC Flow Logs can capture the NAT gateway logs. Option A is incorrect because a VPC endpoint is used for accessing AWS services privately and cannot be used for internet API access. Option B is incorrect because attaching an internet gateway directly to the private subnet would expose the instances' private IPs to the internet. Option C is incorrect because while a proxy server could work, it adds unnecessary complexity and management overhead compared to a NAT gateway.

Answer

Use a VPC endpoint for the third-party API service.

Answer

Attach an internet gateway directly to the private subnet and configure the route table to send default traffic to the internet gateway. Use security groups to restrict outbound traffic to the API endpoints. Enable VPC Flow Logs for logging.

Answer

Deploy a proxy server in the public subnet and configure the application servers to use the proxy. Restrict outbound traffic from the proxy using security groups. Log proxy access logs.

Question 14

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which policy type should be used?

Accepted Answer

Attach an S3 bucket policy with a condition for aws:SourceVpc. An S3 bucket policy with a condition for aws:SourceVpc restricts access to requests originating from a specific VPC. This condition key is available in the request context when the request comes through a VPC endpoint, and it allows you to deny or allow access based on the VPC ID. This is the most direct way to restrict bucket access to a VPC.

Answer

Configure a VPC endpoint policy

Answer

Configure a network ACL to block all traffic except from the VPC CIDR

Answer

Use an S3 access point with a network origin condition

Question 15

A company has multiple AWS accounts under AWS Organizations. The security team wants to centrally log all network traffic that is denied by security group rules across all accounts. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Enable VPC Flow Logs with organization-level aggregation and publish to a central S3 bucket. VPC Flow Logs can capture rejected traffic, and publishing to a central S3 bucket using Organization-level aggregation simplifies management. Option D is correct because it uses VPC Flow Logs with organization-level aggregation. Option A is wrong because AWS Config does not log network traffic. Option B is wrong because it requires per-account setup. Option C is wrong because CloudTrail does not capture network flows.

Answer

Enable AWS Config rules for security group changes and send logs to a central account

Answer

Create VPC Flow Logs in each account and publish to a central S3 bucket

Answer

Use AWS CloudTrail to log all API calls and filter for security group events