ANS-C01 Network Security, Compliance and Governance Practice Test 7 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect its data center to a VPC. The security team wants to ensure that only the on-premises network can initiate connections to EC2 instances in the VPC, but the EC2 instances should be allowed to initiate outbound connections to the internet. Which configuration should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a security group with inbound allow from on-premises CIDR and outbound allow to 0.0.0.0/0. Security groups are stateful and support allow rules only; they can restrict inbound traffic to the on-premises CIDR while allowing all outbound traffic. This meets the requirement that only on-premises can initiate connections to EC2, while EC2 instances can initiate outbound internet connections. Network ACLs are stateless and would require careful ephemeral port handling, making them less suitable for this precise control.

Answer

Configure a network ACL with inbound allow from on-premises CIDR and outbound allow to 0.0.0.0/0

Answer

Configure a network ACL with inbound allow from 0.0.0.0/0 and outbound allow to 0.0.0.0/0

Answer

Configure a security group with inbound deny from 0.0.0.0/0 and outbound allow to 0.0.0.0/0

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket for backups. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be used?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and attach a bucket policy allowing access from the VPC. A VPC Gateway Endpoint for S3 provides private connectivity to S3 from within the VPC without needing an internet gateway, NAT gateway, or VPN. This minimizes data transfer costs and avoids internet traversal. Option A (Gateway Endpoint) is the correct solution. Option B (proxy server) introduces additional complexity and cost, and does not avoid internet traversal. Option C (Interface Endpoint) is more expensive and is not necessary because S3 supports Gateway Endpoints. Option D (public subnet with NAT) requires the instance to have a public IP and uses a NAT gateway, which incurs costs and uses the internet.

Answer

Set up a proxy server in the public subnet and configure the EC2 instance to use it

Answer

Create a VPC Interface Endpoint for S3 and associate it with the private subnet

Answer

Place the EC2 instance in a public subnet with a public IP and use a NAT gateway

Question 3

A company has a VPC with multiple subnets and is using Network Access Analyzer to identify unintended network access. It reports that an EC2 instance in a private subnet has a route to an internet gateway. Which two actions should be taken to remediate this?

Accepted Answer

Ensure the EC2 instance does not have a public IP address. Option A is correct because an EC2 instance in a private subnet should not have a public IP address; without a public IP (and with no Elastic IP), the instance cannot be directly reached from or route directly to the internet, which is the expected posture for a private subnet. Option B is correct because the unintended internet access stems from a route to an internet gateway in the subnet's route table; removing that 0.0.0.0/0 route (or the IGW route) eliminates the path that Network Access Analyzer flagged. Option C is wrong because assigning a public IP would increase exposure rather than remediate it. Option D is wrong because security groups are stateful allow-lists and cannot contain explicit deny rules, so you cannot 'deny' 0.0.0.0/0 outbound in a security group. Option E is wrong because attaching a NAT gateway would provide outbound internet access for the private subnet, which is the opposite of the intended remediation.

Answer

Assign a public IP address to the instance

Answer

Update the security group to deny outbound traffic to 0.0.0.0/0

Answer

Attach a NAT gateway to the private subnet

Question 4

Refer to the exhibit. A company has attached the IAM policy to an S3 bucket named example-bucket. Users report they cannot access objects in the bucket even when coming from the allowed IP range. What is the most likely cause?

Accepted Answer

S3 Block Public Access settings are enabled, overriding the policy. The policy allows anonymous access (Principal: "*") from a specific IP range. However, S3 Block Public Access settings can override bucket policies by blocking any public access. If S3 Block Public Access is enabled at the account or bucket level, it will deny all public access regardless of the bucket policy. Thus, even though the policy is valid, the Block Public Access setting prevents access. Option D is correct because S3 Block Public Access settings override the policy. Option A is incorrect because the Principal element of "*" is valid for a bucket policy. Option B is incorrect because the condition correctly restricts to the specified IP range; the issue is broader than IP mismatch. Option C is incorrect because aws:SourceIp is used correctly in the condition.

Answer

The policy syntax is invalid because of the Principal element

Answer

The IP address range in the condition does not match the users' IP

Answer

The condition uses aws:SourceIp incorrectly

Question 5

Refer to the exhibit. A network engineer is analyzing a VPC Flow Log record from a VPC with CIDR 10.0.0.0/16. The record indicates a REJECT action. Which component is most likely blocking the traffic?

Accepted Answer

The destination instance's security group. Flow logs record traffic after security group and NACL evaluation. A REJECT indicates the traffic was dropped by a security group or NACL. Since the destination port is 80 (HTTP), a security group is likely blocking inbound HTTP. Option C is correct. Option A is wrong because the source IP is within the VPC. Option B is wrong because there is no indication of a missing route. Option D is wrong because NACL rules are stateless and would show REJECT if they block, but security groups are more common for instance-level blocking.

Answer

The destination instance's operating system firewall

Answer

A missing route in the route table

Answer

The network ACL of the destination subnet

Question 6

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains several EC2 instances that need to download software updates from the internet. The security team has configured the following: - A security group on the EC2 instances allows outbound traffic to 0.0.0.0/0 on ports 443 and 80. - The private subnet's route table has a default route (0.0.0.0/0) pointing to the NAT gateway. - The NAT gateway is in the public subnet with an Elastic IP and its security group allows inbound traffic from the private subnet CIDR on ports 443 and 80, and outbound to 0.0.0.0/0 on all ports. Despite this, the EC2 instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT gateway's security group inbound rule is too restrictive. The most likely cause is that the NAT gateway's security group inbound rule is too restrictive. NAT gateways are managed services and do not have security groups; if one were hypothetically attached, its inbound rule allowing only ports 443 and 80 would block return traffic on ephemeral ports. More critically, security groups are stateful—if outbound traffic is allowed, return traffic is automatically permitted regardless of inbound rules. Therefore, option D is incorrect. Option B is incorrect because the NAT gateway has an Elastic IP, and option C is incorrect because the private subnet route table has a default route to the NAT gateway.

Answer

The NAT gateway does not have an Elastic IP associated

Answer

The route table of the private subnet does not have a route to the NAT gateway

Answer

The EC2 instances' security group does not allow inbound traffic from the NAT gateway

Question 7

A company has a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The security team requires that all traffic between VPCs must be inspected by a centralized firewall appliance deployed in a security VPC. They have configured a Transit Gateway with a route table that has blackhole routes for all VPC CIDRs except the security VPC, and the security VPC appliance performs inspection and returns traffic to the Transit Gateway. Recently, they added a new VPC for a critical application. After configuration, some traffic from the new VPC to other VPCs is being dropped. The network engineer verifies that the Transit Gateway route table includes a blackhole route for the new VPC's CIDR and that the security VPC's firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.. For the security VPC to inspect traffic from the new VPC, the Transit Gateway route table must have a static route that directs traffic from the new VPC's CIDR to the security VPC attachment. Without this route, traffic from the new VPC to other VPCs will be dropped because the blackhole route for the new VPC's CIDR only affects traffic destined to the new VPC, not traffic originating from it.

Answer

The security VPC's network ACLs are blocking return traffic from the firewall appliance back to the Transit Gateway.

Answer

The new VPC's route table does not have a default route pointing to the Transit Gateway attachment.

Answer

The Transit Gateway route table propagates the new VPC's CIDR, overriding the static blackhole route.

Question 8

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS and that bucket policies restrict access to specific IAM roles. They have created an SCP that denies s3:PutBucketPolicy unless the bucket is encrypted with KMS (using a condition) and restricts the PutBucketPolicy action to a specific role. After applying the SCP, the development team reports that they cannot update bucket policies even when using the allowed role. The SCP is attached to the root OU. The allowed role is in the dev account and has full S3 permissions via an IAM policy. What is the most likely reason for the failure?

Accepted Answer

The SCP denies s3:PutBucketPolicy for all principals except the allowed role, but the SCP is applied at the root OU and affects all accounts, so the allowed role is still denied because SCPs are deny-by-default and the allow list in the SCP does not override the implicit deny.

Answer

The SCP must be applied to the dev account specifically, not the root OU, because SCPs attached to OUs do not affect member accounts unless explicitly inherited.

Answer

The SCP condition key for KMS encryption is incorrect because the s3:PutBucketPolicy action does not support condition keys for encryption.

Answer

The IAM policy attached to the allowed role does not include s3:PutBucketPolicy permission, even though it has full S3 access.

Question 9

A company is using AWS Client VPN for remote access. They want to ensure that only clients with a valid client certificate can connect, and that traffic is routed through a centralized inspection VPC. The VPN endpoint is configured with mutual authentication using server and client certificates. The route table in the VPN VPC has a default route pointing to an AWS Network Firewall endpoint in the inspection VPC. Users report that they can connect to the VPN but cannot access any internal resources. The network engineer checks the Client VPN endpoint configuration and confirms that the authorization rules allow access to the internal CIDR (10.0.0.0/8). What is the most likely cause?

Accepted Answer

The route table in the VPN VPC has a default route (0.0.0.0/0) pointing to the Network Firewall, but the Network Firewall's route table needs a route back to the VPN VPC for the client CIDR, which is missing.. The most likely cause is that the Network Firewall's route table lacks a route back to the VPN VPC for the client CIDR. In a centralized inspection architecture, traffic from the VPN clients is routed through the Network Firewall, but for return traffic to reach the clients, the firewall's subnet route table must have a route pointing to the VPN VPC (or the Client VPN endpoint). Without this return route, the firewall drops the return packets, and users cannot access internal resources.

Answer

The client certificate is not associated with the same CA as the server certificate, causing TLS handshake failure.

Answer

The subnet route table in the VPN VPC does not have a route for the client CIDR (assigned by the VPN) pointing to the VPN endpoint's network interface.

Answer

The AWS Network Firewall in the inspection VPC is blocking traffic from the VPN client CIDR because it does not have a rule allowing it.

Question 10

A company is using AWS Transit Gateway to interconnect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is encrypted in transit. They also want to minimize changes to existing VPC route tables. Which solution should they use?

Accepted Answer

Use a transit VPC architecture with EC2-based VPN appliances in a security VPC that encrypt traffic between VPCs.. Transit Gateway does not natively encrypt VPC-to-VPC traffic; its attachments are unencrypted. To encrypt inter-VPC traffic while minimizing route table changes, deploy EC2-based VPN appliances in a central security/transit VPC and route VPC-to-VPC traffic through them, which is the classic transit VPC pattern. This keeps existing VPC route tables largely intact by pointing default/aggregate routes at the TGW or the appliance ENI.

Answer

Enable Transit Gateway VPN attachments between each VPC and the Transit Gateway with IPsec VPN.

Answer

Use AWS Network Firewall to inspect and encrypt traffic between VPCs.

Answer

Implement VPC peering with encryption enabled.

Question 11

A company uses AWS WAF to protect their web application. They have a rate-based rule that blocks IPs after 100 requests in 5 minutes. However, they notice that legitimate users behind a corporate NAT gateway are being blocked because the aggregate traffic from the NAT IP exceeds the threshold. Which TWO actions would resolve this issue without compromising security? (Choose TWO.)

Accepted Answer

Use a scope-down statement to exclude traffic from the corporate NAT IP range.. Option D is correct because a scope-down statement in AWS WAF lets you narrow the scope of a rate-based rule so that requests matching a specific condition — such as traffic from the corporate NAT IP range — are excluded from the rate counting, preventing legitimate NAT traffic from triggering the block while still protecting the rest of the application. Option E is correct because raising the rate limit threshold above the aggregate volume generated by the corporate NAT gateway prevents legitimate users sharing that IP from being blocked, while the rule still blocks genuinely abusive traffic at the higher threshold. Option A is not ideal because an allow rule does not exempt traffic from the rate-based rule's counting and blocking logic, so the NAT IP could still be blocked. Option B is incorrect because changing the action to count disables blocking entirely, which compromises security. Option C is incorrect because AWS Shield Advanced provides DDoS protection and does not resolve rate-based rule false positives from NAT aggregation.

Answer

Implement a custom WAF rule to allow traffic from the corporate IP range.

Answer

Change the rate-based rule to count instead of block.

Answer

Use AWS Shield Advanced for automatic mitigation.

Question 12

A financial services company has a multi-account AWS environment managed via AWS Organizations. The security team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key (CMK) from the security account. Currently, some accounts have S3 buckets with SSE-S3 encryption or no encryption. The security team must not be able to read the data in the buckets, but must be able to detect and remediate non-compliant buckets. The solution must use AWS native services and minimize operational overhead. Which combination of actions should the security team take?

Accepted Answer

Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.. AWS Config supports organization conformance packs, which allow a single rule to be deployed across all accounts in an AWS Organization from the security account. The conformance pack can check that S3 buckets are encrypted with the specific KMS CMK, and automatic remediation via AWS Systems Manager Automation can apply the required encryption configuration without the security team needing read access to the bucket data. This meets the requirements of centralized detection and remediation with minimal operational overhead.

Answer

Enable AWS Config in each member account individually and create a custom rule using AWS Lambda to check bucket encryption, then send compliance results to the security account via Amazon EventBridge.

Answer

Use a service control policy (SCP) to deny s3:PutObject unless the request includes a specific KMS key ID.

Answer

Enable AWS CloudTrail in the security account and create a metric filter to detect PutBucketEncryption API calls, then trigger a Lambda function to remediate.

Question 13

A company is using Amazon VPC with a public subnet and a private subnet. The public subnet has a NAT gateway. The private subnet has an Amazon RDS for MySQL database. The security team wants to ensure that the database is not accessible from the internet, but they need to allow a specific on-premises network (IP range 203.0.113.0/24) to connect to the database for maintenance. The company also wants to restrict outbound traffic from the database to only necessary AWS services (e.g., S3 for backups) and deny all other outbound traffic. Which configuration should the security team implement?

Accepted Answer

Modify the database security group to allow inbound TCP 3306 from 203.0.113.0/24. Create a VPC endpoint for S3. Update the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list.. The correct configuration places the database in a private subnet, uses a security group to allow inbound MySQL (TCP 3306) from the on-premises CIDR, creates an S3 VPC endpoint for private access to S3, and uses a network ACL on the private subnet to deny all outbound traffic except to the S3 endpoint prefix list. This ensures the database is not internet-accessible, allows specific on-premises access, and restricts outbound traffic to only S3.

Answer

Create a security group for the database that allows inbound from the on-premises network using a prefix list for 203.0.113.0/24. Create a VPC endpoint for S3 and allow outbound traffic to the endpoint. Keep the private subnet's network ACL default (allow all outbound).

Answer

Set up a Site-to-Site VPN between the on-premises network and the VPC. Modify the route tables to route 203.0.113.0/24 through the VPN. Place the database in a private subnet and allow inbound from the VPN CIDR. Use an internet gateway for outbound traffic to S3.

Answer

Place the database in a public subnet and use a security group that allows inbound from 203.0.113.0/24. Use the NAT gateway for outbound traffic to S3. Configure the public subnet's network ACL to deny all outbound traffic except to S3.

Question 14

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

Accepted Answer

Transit Gateway with appliance mode and a dedicated inspection VPC. Transit Gateway with appliance mode and a dedicated inspection VPC is the correct architecture because it enables symmetric routing, forcing traffic through the inspection VPC for centralized inspection. Option A (AWS PrivateLink) is incorrect; PrivateLink provides private connectivity to services, not traffic inspection between VPCs. Option B (AWS Network Firewall in each VPC) is incorrect because deploying a firewall in each VPC is distributed, not centralized, and does not leverage Transit Gateway. Option C (VPC peering) is incorrect because VPC peering does not support transitive routing; peering each VPC to an inspection VPC would be complex and does not take advantage of Transit Gateway's centralized routing capabilities.

Answer

AWS PrivateLink endpoints in each VPC

Answer

AWS Network Firewall deployed in each VPC

Answer

VPC peering between each VPC and the inspection VPC

Question 15

A company has a VPC with public and private subnets. The private subnets need to access the internet through a NAT gateway. The security team wants to ensure that traffic from the private subnets cannot bypass the NAT gateway. Which configuration should be used?

Accepted Answer

Add a route in the private subnet route table with destination 0.0.0.0/0 pointing to the NAT gateway. A NAT gateway is used by private subnets to reach the internet, and the mechanism that forces traffic through it is the route table entry: destination 0.0.0.0/0 pointing to the NAT gateway. Without that default route, private subnet instances have no path to the internet at all, and with it, all internet-bound traffic is directed through the NAT gateway, which performs source NAT using its Elastic IP. This ensures traffic cannot bypass the NAT gateway because there is no alternative route to the internet from the private subnet.

Answer

Deploy a forward proxy in a public subnet and configure the private subnets to use it

Answer

Use an egress-only internet gateway for the private subnets

Answer

Attach a security group to the NAT gateway that only allows outbound traffic