ANS-C01 Network Security, Compliance and Governance Practice Test 7 — 15 Questions

Question 1

A company has an AWS Direct Connect connection and wants to ensure that all traffic from its VPC to an S3 bucket in another region stays within the AWS network. How should this be accomplished?

Accepted Answer

Use a NAT gateway in the VPC and route traffic through the Direct Connect public VIF. To access an S3 bucket in another region from a VPC while keeping traffic on the AWS network, you can route traffic through a Direct Connect public virtual interface (VIF). A NAT gateway in the VPC can be used to route traffic from private subnets to the public VIF, which then connects to the S3 public endpoint across the AWS global backbone. This ensures traffic does not traverse the public internet. Option A is incorrect because VPC Gateway Endpoints are regional and can only be used for S3 buckets in the same region. Option B is incorrect because VPC Interface Endpoints for S3 are region-specific and cannot be used to access S3 buckets in another region. Option D is incorrect because VPN connections cannot be established directly to S3 buckets.

Answer

Create a VPC Gateway Endpoint for S3 in the source VPC

Answer

Create a VPC Interface Endpoint for S3 in the source VPC

Answer

Establish a VPN connection to the S3 bucket

Question 2

A company wants to monitor and log all changes to security group rules in their AWS account for compliance purposes. Which TWO services can be used together to achieve this?

Accepted Answer

Amazon EventBridge. (Amazon EventBridge) can capture AWS CloudTrail events and trigger notifications. Option E (AWS CloudTrail) logs API calls, including changes to security group rules. Together, they provide monitoring and logging of security group changes. Option A is wrong because AWS Trusted Advisor provides best-practice checks, not change logging. Option B is wrong because VPC Flow Logs capture traffic, not configuration changes. Option D is wrong because AWS Config records resource state but does not log API calls.

Answer

AWS Trusted Advisor

Answer

VPC Flow Logs

Answer

AWS Config

Question 3

A company is designing a network security solution for a VPC that hosts a multi-tier web application. The web servers are in a public subnet, and the application servers are in a private subnet. The company wants to ensure that the web servers can only be accessed on port 443 from the internet, and the application servers can only be accessed from the web servers on port 3306. Which THREE components should be configured?

Accepted Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports. The correct components are: a security group for web servers allowing inbound 443 from 0.0.0.0/0 (E), a security group for application servers allowing inbound 3306 from the web server security group (D), and a network ACL on the public subnet allowing inbound 443 and outbound ephemeral ports (B) to add a stateless filtering layer. Option A is incorrect because the NACL rule lacks an outbound rule for return traffic, making it incomplete. Option C is unnecessary because the access control for the private subnet is best achieved with security groups, and a NACL is not required for this purpose.

Answer

Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0

Answer

Network ACL on the private subnet allowing inbound 3306 from the public subnet CIDR

Question 4

A company is using AWS Organizations and wants to centrally manage and enforce the use of VPC endpoints for S3 across all accounts. Which THREE services/tools can be combined to achieve this?

Accepted Answer

AWS Config rules. To centrally manage and enforce the use of VPC endpoints for S3 across all accounts in AWS Organizations, you can combine AWS Service Control Policies (SCPs) to allow or deny VPC endpoint creation at the organizational level, AWS CloudFormation StackSets to deploy VPC endpoints consistently across multiple accounts, and AWS Config rules to detect non-compliant resources such as missing VPC endpoints. Option B (AWS Config rules) is correct because it can evaluate compliance and trigger remediation. Option C (AWS CloudFormation StackSets) is correct because it automates deployment of VPC endpoints in target accounts. Option D (AWS SCPs) is correct because it enforces policies on endpoint creation. Option A (VPC Flow Logs) is wrong because it only logs traffic, not enforce policies. Option E (AWS Transit Gateway) is wrong because it provides network connectivity, not endpoint management.

Answer

VPC Flow Logs

Answer

AWS Transit Gateway

Question 5

A company uses AWS Organizations with SCPs to restrict access. The security team wants to ensure that no IAM user or role can disable AWS Shield Advanced protections. Which SCP effect should be used?

Accepted Answer

Deny. (Deny) is correct because the Deny effect in an SCP explicitly prohibits specified actions, overriding any Allow statements in IAM policies. Option A (Deny in IAM policy) is not an SCP effect; SCPs are separate from IAM policies. Option C (Allow) permits actions but does not restrict, so it cannot be used to enforce prohibitions. Option D (Block) is invalid; AWS SCPs use Deny, not Block.

Answer

Deny in the IAM policy

Answer

Allow

Answer

Block

Question 6

A company needs to securely connect an on-premises data center to AWS using multiple VPN tunnels. The security team requires that all traffic between the VPC and on-premises be encrypted and that the tunnels use a second authentication mechanism beyond pre-shared keys. Which solution meets these requirements?

Accepted Answer

Use AWS VPN CloudHub with multiple VPN connections and configure certificate-based authentication for each tunnel. AWS VPN CloudHub allows multiple VPN connections with BGP routing and supports certificate-based authentication (mutual TLS) for each tunnel, providing a second authentication mechanism beyond pre-shared keys. Option A is incorrect because AWS Client VPN is designed for individual remote users, not for site-to-site connectivity between an on-premises data center and a VPC. Option B is incorrect because AWS Transit Gateway with VPN attachments uses pre-shared keys by default and does not support certificate-based authentication for the VPN tunnels. Option D is incorrect because while AWS Direct Connect with a public VIF and an IPsec VPN over it can provide encrypted traffic, the VPN itself typically relies on pre-shared keys, not a second authentication factor.

Answer

Use AWS Client VPN with mutual authentication

Answer

Use AWS Transit Gateway with VPN attachments and configure pre-shared keys

Answer

Use AWS Direct Connect with a public VIF and establish an IPsec VPN over the Direct Connect connection

Question 7

A security engineer is designing a VPC with public and private subnets. The company requires that all outbound traffic from private subnets to the internet must go through a single IP address for logging and compliance. Which service should be used?

Accepted Answer

NAT Gateway. NAT Gateway. A NAT Gateway provides outbound internet access from private subnets, and it uses a single Elastic IP address, meeting the requirement for a single IP for logging and compliance. Option A is wrong because a Transit Gateway is used for connecting multiple VPCs and on-premises networks, not for outbound internet from private subnets. Option B is wrong because an Internet Gateway allows inbound and outbound traffic from public subnets, not private subnets. Option D is wrong because a VPC Endpoint is for accessing AWS services privately without traversing the internet.

Answer

Transit Gateway

Answer

Internet Gateway

Answer

VPC Endpoint

Question 8

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices that a specific IP address is generating a high number of requests and wants to block it immediately. What is the MOST efficient way to block this IP address?

Accepted Answer

Add the IP address to an IP set in AWS WAF and update the rule to block it. AWS WAF allows adding an IP address to an existing IP set and updating the associated rule to block it, which takes effect quickly and is the most efficient method. Option B is wrong because security groups are stateful and cannot explicitly deny inbound traffic; they only allow rules. Option C is wrong because Network ACLs operate at the subnet level and require updating both inbound and outbound rules, which is slower and less granular than WAF IP sets. Option D is wrong because creating a new web ACL and associating it takes more steps than updating an existing rule, making it less immediate.

Answer

Add a deny rule in the security group attached to the ALB

Answer

Update the Network ACL associated with the ALB subnets to deny inbound traffic from the IP address

Answer

Create a new web ACL in AWS WAF and associate it with the ALB

Question 9

A company is migrating a legacy application to AWS. The application requires that all network traffic between two VPCs be inspected by a third-party firewall appliance. The firewall must be able to inspect traffic bidirectionally and automatically fail over if the appliance becomes unhealthy. Which architecture meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a Network Load Balancer in front of multiple firewall appliances. AWS Transit Gateway with a Network Load Balancer (NLB) in front of multiple firewall appliances enables bidirectional traffic inspection and automatic failover. The NLB performs health checks and distributes traffic to healthy firewall instances, ensuring high availability. Option B is wrong because VPC Peering does not support a central inspection point; traffic flows directly between VPCs without passing through a firewall. Option C is wrong because a single firewall instance is a single point of failure, lacking automatic failover. Option D is wrong because AWS PrivateLink uses VPC Endpoints for connectivity, which does not allow traffic inspection by a third-party firewall in the consumer VPC; it only allows one-way initiated connections.

Answer

Use VPC Peering between the two VPCs and route traffic through a firewall instance in one of the VPCs

Answer

Deploy a single firewall instance in a shared VPC and route all inter-VPC traffic through it

Answer

Use AWS PrivateLink to connect the VPCs and place the firewall in the consumer VPC

Question 10

A security engineer is configuring AWS CloudTrail to log all management events across all regions. The logs must be stored in an S3 bucket that is encrypted with an AWS KMS key. Which bucket policy element is required to allow CloudTrail to write logs?

Accepted Answer

kms:GenerateDataKey. CloudTrail requires kms:GenerateDataKey and kms:Decrypt permissions in the KMS key policy to deliver logs to an encrypted S3 bucket. kms:GenerateDataKey generates a data key for encrypting the log files, while kms:Decrypt validates the key. For this question, kms:GenerateDataKey is the required element for writing logs, as it enables the encryption process.

Answer

kms:Encrypt

Answer

kms:CreateKey

Answer

kms:Decrypt

Question 11

A company's security team is investigating a potential data exfiltration incident. They notice that an EC2 instance in a private subnet is making HTTPS connections to an unknown external IP address. The instance's security group only allows outbound HTTPS to a specific set of IPs. What is the MOST likely cause of the traffic?

Accepted Answer

The instance is routing traffic through a NAT Gateway that has a route to the internet. A NAT Gateway in a public subnet can allow outbound traffic to any destination, bypassing security group restrictions if the security group allows traffic to the NAT Gateway. Option B is wrong because security groups are stateful; outbound rules apply regardless. Option C is wrong because an Internet Gateway is not in a private subnet. Option D is wrong because a VPC Endpoint is for AWS services, not external IPs.

Answer

The instance is using a VPC Endpoint to connect to the external IP

Answer

The security group outbound rules are being overridden by a Network ACL

Answer

The instance has a public IP address and is using an Internet Gateway directly

Question 12

A company wants to ensure that all IAM users have multi-factor authentication (MFA) enabled. Which AWS service can be used to enforce this policy?

Accepted Answer

IAM policy with a condition for aws:MultiFactorAuthPresent. An IAM policy with a condition that checks aws:MultiFactorAuthPresent can require MFA for API calls, enforcing MFA usage. Option A is wrong because AWS Organizations SCPs can enforce policies at the account level but cannot require MFA for individual IAM users without an accompanying IAM policy. Option B is wrong because AWS Config can detect non-compliance with MFA rules but cannot enforce the policy itself. Option D is wrong because AWS CloudTrail is used for logging API activity, not for enforcement.

Answer

AWS Organizations SCP

Answer

AWS Config

Answer

AWS CloudTrail

Question 13

Which TWO statements are correct regarding the use of AWS Network Firewall? (Choose 2)

Accepted Answer

It supports stateful inspection using Suricata-compatible rules. A: Correct. AWS Network Firewall supports stateful inspection using Suricata-compatible rules, allowing deep packet inspection for threat detection. B: Correct. Network Firewall can be integrated with AWS Transit Gateway to enable centralized inspection of traffic across multiple VPCs. C: Incorrect. Network Firewall is deployed within a VPC, not as a standalone service, and it requires a VPC to inspect traffic; it cannot inspect traffic between on-premises and AWS without a VPC. D: Incorrect. Network Firewall does not provide automatic SSL/TLS decryption; it can only inspect traffic that is not encrypted or after decryption is performed by another service. E: Incorrect. Network Firewall is a managed service, but it is always deployed inside a VPC, not outside.

Answer

It can be used to inspect traffic between on-premises and AWS without a VPC

Answer

It provides automatic SSL/TLS decryption

Answer

It is a managed service that can be deployed outside of a VPC

Question 14

Which THREE actions can AWS Config perform to help with network security compliance? (Choose 3)

Accepted Answer

Evaluate whether security groups allow unrestricted SSH access. AWS Config can evaluate whether security groups allow unrestricted SSH access using managed rules like 'restricted-ssh'. Option C is correct because Config records configuration changes to Network ACLs and security groups, enabling tracking. Option D is correct because Config can trigger custom rules or send notifications via Amazon SNS when a security group rule is modified. Option B is incorrect because Config does not block traffic; it only evaluates and can trigger remediation actions via other services. Option E is incorrect because Config evaluates resources after creation; it cannot prevent creation, though it can trigger automated remediation via Lambda or Systems Manager.

Answer

Automatically block non-compliant traffic

Answer

Prevent creation of VPCs that do not have a specific tag

Question 15

Which TWO features are provided by AWS Shield Advanced that are not available in AWS Shield Standard? (Choose 2)

Accepted Answer

DDoS cost protection. Shield Advanced provides DDoS cost protection (option B) and 24/7 access to the AWS DDoS Response Team (option D). Option A is incorrect because automatic web application firewall rule updates are not a feature of Shield Advanced; AWS WAF can be integrated but rules are not automatically updated. Option C is incorrect because detailed DDoS logs are not a distinct feature of Shield Advanced; both Standard and Advanced provide access to AWS Shield logs. Option E is incorrect because network-layer DDoS protection (e.g., SYN flood, UDP flood) is provided by both Shield Standard and Shield Advanced; Advanced adds application-layer protection and other benefits.

Answer

Automatic web application firewall rule updates

Answer

Access to detailed DDoS logs

Answer

Network-layer DDoS protection