ANS-C01 Network Security, Compliance and Governance Practice Test 7 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to ensure that traffic between the on-premises network and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN tunnel over the Direct Connect connection using a public VIF or transit VIF.. Direct Connect does not provide encryption by default; using a VPN tunnel over Direct Connect encrypts traffic. Option D is correct. Option A is wrong because Direct Connect private VIF does not encrypt. Option B is wrong because VPC peering is not for on-premises. Option C is wrong because IPSec over public internet does not use Direct Connect.

Answer

Establish a VPC peering connection between the on-premises network and the VPC.

Answer

Use a private virtual interface (VIF) over Direct Connect.

Answer

Use an IPSec VPN connection over the internet.

Question 2

A security engineer needs to centrally manage and enforce rules for network traffic between VPCs in a large AWS environment. Which AWS service provides this capability?

Accepted Answer

AWS Network Firewall. AWS Network Firewall can centrally manage firewall rules across VPCs. Option B is correct. Option A is wrong because security groups are per-ENI, not central. Option C is wrong because VPC peering is connectivity, not filtering. Option D is wrong because NACLs are per-subnet.

Answer

VPC peering

Answer

Security groups

Answer

Network ACLs

Question 3

A company has an AWS account with multiple VPCs. The security team wants to ensure that no VPC has an internet gateway attached. Which AWS service can be used to automatically detect and remediate non-compliant VPCs?

Accepted Answer

AWS Config with a managed rule to detect internet gateways and an automatic remediation action to detach them.. AWS Config rules can evaluate compliance and trigger remediation. Option A is correct. Option B is wrong because GuardDuty is for threat detection, not configuration compliance. Option C is wrong because SCPs prevent actions but do not detect existing resources. Option D is wrong because CloudTrail is for auditing API calls, not real-time compliance.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Service control policies (SCPs)

Question 4

A company is migrating a legacy application to AWS. The application requires that all traffic between the web and application tiers be encrypted, but the application does not support TLS. What should a network engineer do to meet this requirement without modifying the application?

Accepted Answer

Use a Network Load Balancer (NLB) with TLS termination and target groups with TCP, then enable encryption on the NLB.. Using a Network Load Balancer (NLB) with TLS termination can offload encryption/decryption. Option C is correct. Option A is wrong because Application Load Balancer works at layer 7 and requires TLS support from the app. Option B is wrong because Classic Load Balancer is deprecated and less capable. Option D is wrong because VPN is for hybrid connectivity, not within a VPC.

Answer

Establish a VPN connection between the web and application instances.

Answer

Use an Application Load Balancer (ALB) with TLS termination between the tiers.

Answer

Use a Classic Load Balancer with TCP listeners.

Question 5

A company wants to audit all changes to security group rules in a VPC. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls, including changes to security groups. Option B is correct. Option A is wrong because CloudWatch is for monitoring metrics and logs. Option C is wrong because VPC Flow Logs capture network traffic, not configuration changes. Option D is wrong because AWS Config records resource configuration changes, but CloudTrail is specifically for API call auditing.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch

Question 6

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to enforce that all VPCs use a specific set of security group rules for inbound SSH access. Which TWO steps should the team take? (Choose two.)

Accepted Answer

Use AWS Config rules to detect non-compliant security groups and trigger automatic remediation.. SCPs can deny creation of security groups that don't meet rules, and AWS Config can detect non-compliant groups. Options B and D are correct. Option A is wrong because IAM roles don't enforce across accounts. Option C is wrong because CloudTrail logs but doesn't enforce. Option E is wrong because GuardDuty is for threats.

Answer

Enable AWS CloudTrail to log all security group changes and send alerts.

Answer

Enable Amazon GuardDuty to monitor for malicious traffic.

Answer

Create an IAM role in each account that only allows creation of compliant security groups.

Question 7

A company has a VPC with public and private subnets. The security team wants to inspect all traffic leaving the VPC to the internet for malicious activity. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

VPC Flow Logs. A NAT gateway routes outbound traffic, VPC Flow Logs capture metadata, and Amazon GuardDuty analyzes flow logs for threats. Options A, C, and D are correct. Option B is wrong because Internet Gateway is for inbound. Option E is wrong because Network Firewall can inspect, but the combination of NAT, Flow Logs, and GuardDuty is a common pattern for outbound inspection.

Answer

Internet gateway

Answer

AWS Network Firewall

Question 8

A company wants to secure data at rest in an Amazon S3 bucket. Which TWO of the following can be used to achieve this? (Choose two.)

Accepted Answer

Enable server-side encryption (SSE-S3) on the bucket.. S3 server-side encryption and default bucket encryption enforce at-rest encryption. Options A and C are correct. Option B is wrong because client-side encryption is not managed by AWS. Option D is wrong because S3 Transfer Acceleration is for speed. Option E is wrong because VPC endpoint is for private connectivity.

Answer

Use an S3 VPC endpoint.

Answer

Use client-side encryption with AWS KMS.

Answer

Enable S3 Transfer Acceleration.

Question 9

A security engineer created the S3 bucket policy shown. After applying it, users from the 10.0.0.0/16 network (VPC CIDR) are able to access objects, but external users from 203.0.113.0/24 receive 'Access Denied' even though they are using HTTPS. What is the likely cause?

Accepted Answer

The VPC endpoint policy for the S3 endpoint restricts access to the bucket.. The policy requires both conditions: source IP from either range AND SecureTransport true. For external users, the IP condition is satisfied, but the problem states they are using HTTPS, so SecureTransport is true. However, the 'Access Denied' suggests the policy is not being evaluated as expected. Actually, the policy allows access only if both conditions are met. For external users, both conditions are met, so they should be allowed. But the external users get denied, meaning the policy might not be the only one. However, the most likely cause is that the policy is missing a statement to explicitly deny all other traffic, or there is a bucket policy that denies. But given options, the most plausible is that the condition 'aws:SecureTransport' requires the request to be made over HTTPS; external users might be using HTTP? The stem says they use HTTPS. So perhaps the issue is that the VPC endpoint adds a source IP that is not 10.0.0.0/16? Actually, the policy allows from 10.0.0.0/16 and 203.0.113.0/24. The external users are from 203.0.113.0/24, which is allowed. So why denied? Maybe the policy is attached to the bucket but there is also a VPC endpoint policy that denies. Option D is most likely: the VPC endpoint policy is blocking access. Option A is wrong because all actions are allowed. Option B is wrong because the policy allows GetObject. Option C is wrong because public access could be blocked but the policy allows. So D is correct.

Answer

The policy only allows 's3:GetObject' but the users are trying to list objects.

Answer

The policy does not include a 'Deny' statement for non-IP ranges.

Answer

The S3 bucket has 'Block public access' enabled, which overrides the policy.

Question 10

A security engineer reviews VPC Flow Logs and sees the entries shown. The last entry shows a REJECT for traffic from 203.0.113.5 to 10.0.1.5 on port 443. However, the third entry shows ACCEPT for traffic from 10.0.1.5 to 203.0.113.5 on port 443. What is the most likely reason for the REJECT?

Accepted Answer

The network ACL associated with the subnet of 10.0.1.5 does not allow inbound traffic from 203.0.113.5.. The flow logs show outbound traffic allowed, but inbound response rejected. This is typical of a stateless firewall rule, such as a network ACL, that allows outbound but not inbound. Security groups are stateful, so they would allow return traffic. Hence, a NACL is blocking the return traffic. Option B is correct. Option A is wrong because security groups are stateful. Option C is wrong because route table does not cause reject. Option D is wrong because WAF is layer 7 and not seen in flow logs at layer 3/4.

Answer

AWS WAF is blocking the inbound traffic.

Answer

The security group attached to the instance 10.0.1.5 does not allow inbound traffic from 203.0.113.5.

Answer

The route table for the subnet of 10.0.1.5 does not have a route to the internet.

Question 11

A network administrator attached the IAM policy shown to a user. The user tries to create an internet gateway in us-east-1 without any tags. What will happen?

Accepted Answer

The internet gateway creation is denied because the Deny statement applies.. The first statement allows CreateInternetGateway in us-east-1. The second statement denies CreateInternetGateway if the resource tag 'purpose' is not 'production'. When creating a resource without tags, the condition StringNotEquals evaluates to true (since no tag, it's not equal to 'production'), so the Deny applies. The Deny overrides the Allow. So the action is denied. Option B is correct. Option A is wrong because the Deny applies. Option C is wrong because the Deny does not require explicit allow. Option D is wrong because the Deny is effective.

Answer

The internet gateway creation fails because the first statement does not allow it in us-east-1.

Answer

The internet gateway is created but the user receives a warning.

Answer

The internet gateway is created successfully because the first statement allows it.

Question 12

A company wants to restrict access to an S3 bucket so that only traffic from a specific AWS account is allowed. Which S3 bucket policy condition key should be used to achieve this?

Accepted Answer

aws:SourceAccount. Using the 'aws:SourceAccount' condition key ensures that only requests originating from the specified AWS account are allowed. Option A is wrong because 'aws:PrincipalAccount' checks the principal's account, not the source account. Option B is wrong because 'aws:SourceArn' checks the ARN of the source resource. Option D is wrong because 'aws:Referer' checks the HTTP referer header.

Answer

aws:PrincipalAccount

Answer

aws:Referer

Answer

aws:SourceArn

Question 13

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?

Accepted Answer

NAT Gateway. A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic. Option A is wrong because an Internet Gateway allows inbound traffic. Option B is wrong because a VPC Peering connection does not provide internet access. Option D is wrong because a VPN connection does not provide internet access.

Answer

VPC Peering

Answer

Internet Gateway

Answer

VPN Connection

Question 14

A company uses AWS WAF to protect a web application. They notice that some malicious requests are being allowed. After investigating, they find that the requests have valid AWS WAF tokens but the payloads are obfuscated. Which WAF configuration should be reviewed to improve detection?

Accepted Answer

Bot Control managed rule group. AWS WAF Bot Control can detect and block requests from bots that may use obfuscated payloads. Option A is wrong because rate-based rules limit request rate. Option B is wrong because IP set rules block by IP. Option D is wrong because SQL injection match conditions detect SQLi patterns, not obfuscation.

Answer

Rate-based rule

Answer

SQL injection match condition

Answer

IP set match rule

Question 15

A security engineer needs to audit all API calls made in an AWS account for compliance. The engineer wants to capture the source IP address and the user agent for each call. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls and includes source IP and user agent. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because CloudWatch Logs stores logs but does not capture API calls directly. Option D is wrong because AWS Config records resource changes, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs