ANS-C01 Network Security, Compliance and Governance Practice Test 8 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy a stack that includes an S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. The stack fails to create, and the error indicates that the bucket policy contains an invalid principal. Which condition key should be used to restrict access to a VPC endpoint in the bucket policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The condition key aws:SourceVpce. The correct condition key is aws:SourceVpce, which evaluates the VPC endpoint ID (vpce-xxxxxxxx) that the request traversed. In an S3 bucket policy, you use aws:SourceVpce in a Condition block to allow access only when the request comes through a specific VPC endpoint, which is the standard pattern for restricting S3 access to a VPC endpoint.

Answer

The VPC ID

Answer

The ARN of the VPC endpoint

Answer

The VPC endpoint service

Question 2

A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?

Accepted Answer

The target group health checks are failing, so the NLB is not sending traffic to those targets. If target group health checks fail, the NLB stops sending traffic to the unhealthy targets, even though the client IP is logged by the NLB. The traffic is dropped because NLB does not forward to unhealthy targets. Options B and C are incorrect because network ACLs or security groups would only affect traffic after NLB sends it, but health check failure prevents traffic from being sent at all. Option D is incorrect because NLB does not have security groups.

Answer

The target subnet network ACL blocks the client IP

Answer

The target instance security group does not allow traffic from the NLB

Answer

The NLB security group blocks the client IP

Question 3

A company is using AWS Client VPN to allow remote employees to access resources in a VPC. The security team wants to enforce multi-factor authentication (MFA) for all VPN connections. Which configuration should be used?

Accepted Answer

Use SAML-based federation with an identity provider that requires MFA. AWS Client VPN supports SAML-based federation with an identity provider (IdP) that requires MFA, making option D correct. Option A is incorrect because security groups do not enforce authentication, let alone MFA. Option B is incorrect because using AWS Managed Microsoft AD alone does not enforce MFA; MFA would require additional configuration such as AWS AD Connector or a third-party MFA solution. Option C is incorrect because mutual authentication with client certificates verifies the client's identity but does not enforce MFA.

Answer

Attach a security group to the Client VPN endpoint that only allows MFA-authenticated traffic

Answer

Use AWS Managed Microsoft AD for authentication

Answer

Use mutual authentication with client certificates

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is behind a NAT gateway in the public subnet. The security team wants to allow only outbound HTTPS traffic from the instance. Which configuration should be used?

Accepted Answer

Security group on the instance with outbound rule allowing HTTPS. A security group on the EC2 instance with an outbound rule allowing HTTPS (port 443) is the correct configuration. Security groups are stateful, so the outbound rule automatically permits the return traffic, requiring no explicit inbound rule. This ensures only outbound HTTPS is allowed from the instance. Option C is incorrect because network ACLs are stateless and would require explicit inbound rules for return traffic, but more importantly, NACLs are subnet‑level controls and are not the best practice for restricting traffic from a single instance. Option B is incorrect because VPC gateway endpoints are for private connectivity to AWS services, not for internet access. Option D is incorrect because a security group on the NAT gateway would control the NAT gateway's own traffic, not the instance behind it.

Answer

VPC gateway endpoint for S3

Answer

Network ACL on the private subnet with outbound rule allowing HTTPS and inbound rule allowing return traffic

Answer

Security group on the NAT gateway with outbound rule allowing HTTPS

Question 5

A company needs to audit network traffic in a VPC for compliance. Which THREE AWS services can be used to capture and analyze network traffic?

Accepted Answer

Traffic Mirroring. Traffic Mirroring (B) is correct because it copies live VPC packet data from ENIs and sends it to analysis appliances or tools for deep packet inspection, which directly supports capturing and analyzing network traffic. VPC Flow Logs (C) is correct because it captures IP traffic metadata (source/destination, ports, protocol, accept/reject) for ENIs, subnets, or VPCs and publishes it to CloudWatch Logs or S3 for auditing and analysis. AWS Network Firewall (D) is correct because it inspects and logs VPC traffic with stateful/stateless rules and can send alert and flow logs to CloudWatch, S3, or Kinesis Firehose for compliance analysis. AWS Config (A) is not for capturing traffic; it records resource configuration changes and evaluates compliance rules. AWS CloudTrail (E) is not for network traffic capture; it records AWS API activity and account events.

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

A company wants to block inbound traffic from a specific IP address range (203.0.113.0/24) at the VPC level using AWS WAF. Which resource should the AWS WAF web ACL be associated with?

Accepted Answer

Application Load Balancer. AWS WAF web ACLs can only be associated with resources that process HTTP/HTTPS at layer 7 — Application Load Balancers, Amazon CloudFront distributions, API Gateway stages, and AppSync GraphQL APIs. An ALB is the correct target here because WAF inspects HTTP requests and can apply IP set match rules (e.g., blocking 203.0.113.0/24) before traffic reaches the backend. Associating the web ACL with the ALB enforces the block at the VPC ingress point for that application.

Answer

Network Load Balancer

Answer

VPC peering connection

Answer

Security group

Question 7

A company uses AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate for a domain hosted on Route 53. The certificate is used by an Application Load Balancer. After renewal, the ALB continues to serve the old certificate. What is the most likely cause?

Accepted Answer

DNS validation failed during renewal.. ACM automatically renews public certificates if they are validated via DNS and the validation records remain in Route 53. If DNS validation fails during renewal, ACM cannot issue the new certificate, so the ALB continues to serve the old (expired or soon-to-expire) certificate. The most likely cause is that the DNS validation records were removed or altered, causing renewal to fail. This is a common operational issue when Route 53 records are cleaned up or when the validation CNAME is accidentally deleted.

Answer

The certificate was not imported into ACM correctly.

Answer

The ALB listener is not configured to use the new certificate.

Answer

The certificate is a private certificate and cannot be used with an ALB.

Question 8

A company wants to allow a specific IAM user to manage network ACLs for a specific VPC only. Which IAM policy action should be used?

Accepted Answer

ec2:ModifyNetworkAclAttribute. Managing network ACLs requires multiple IAM actions, including creating, deleting, and modifying rules and attributes. None of the listed actions alone sufficiently allows full management. ec2:ModifyNetworkAclAttribute only modifies attributes like tags, ec2:CreateNetworkAcl only creates new ACLs, ec2:DescribeNetworkAcls is read-only, and ec2:AuthorizeSecurityGroupIngress is for security groups. To allow a user to manage network ACLs, a combination of actions such as ec2:CreateNetworkAcl, ec2:DeleteNetworkAcl, ec2:ReplaceNetworkAclEntry, etc. is needed.

Answer

ec2:AuthorizeSecurityGroupIngress

Answer

ec2:CreateNetworkAcl

Answer

ec2:DescribeNetworkAcls

Question 9

A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?

Accepted Answer

AWS Network Firewall. AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A (AWS WAF) is wrong because it works at the application layer for inbound web traffic and does not block outbound traffic at the instance level. Option B (Network ACL) is wrong because NACLs are stateless and work at the subnet level. Option C (Security group with outbound rules) is wrong because security groups do not support allowlisting based on domain names.

Answer

AWS WAF

Answer

Network ACL

Answer

Security group with outbound rules

Question 10

A company is using AWS Transit Gateway to connect multiple VPCs. The security team wants to inspect all traffic between VPCs with a third-party firewall appliance deployed in a centralized inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

Accepted Answer

Configure Transit Gateway route tables with a blackhole route for the inter-VPC traffic and a route pointing to the inspection VPC.. By configuring Transit Gateway route tables with a blackhole route for inter-VPC traffic and a more specific route pointing to the inspection VPC, traffic between VPCs is forced to go through the inspection VPC for firewall inspection. Option A is wrong because VPC peering does not support transitive routing and would require full mesh. Option B is wrong because AWS PrivateLink is used for private connectivity to services, not for routing traffic between VPCs. Option D is wrong because a Network Load Balancer is not designed for traffic inspection and would add unnecessary complexity.

Answer

Create VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Use AWS PrivateLink to route traffic through the inspection VPC.

Answer

Attach a Network Load Balancer in each VPC and route traffic through it.

Question 11

A company has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. A security engineer needs to restrict access to only the company's public IP range (203.0.113.0/24). What is the correct way to modify the security group rule?

Accepted Answer

Edit the existing inbound rule and change the source CIDR to 203.0.113.0/24.. The CIDR should be changed from 0.0.0.0/0 to 203.0.113.0/24. Option B is wrong because adding a second rule does not remove the open rule. Option C is wrong because security groups do not support deny rules; they are allow-only. Option D is wrong because removing the rule and adding a new deny rule is not how security groups work; security groups are allow-only.

Answer

Add a new inbound rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

Answer

Remove the security group rule and add a new rule to deny SSH from 0.0.0.0/0.

Answer

Create a network ACL that denies SSH from 0.0.0.0/0.

Question 12

A company is deploying an AWS Network Firewall in a centralized inspection VPC and needs to send traffic from multiple VPCs through it. The VPCs are attached to a Transit Gateway. What configuration is required to route traffic to the firewall?

Accepted Answer

Create a Transit Gateway route table with a route to the Network Firewall endpoint and attach the VPCs to it.. The Transit Gateway route table must have a route pointing to the Network Firewall endpoint, and the VPCs attached to that route table will have their traffic inspected by the firewall. Options B, C, and D are incorrect: VPC Gateway Endpoints are for accessing AWS services, not for routing traffic through a firewall; adding routes directly to the firewall's ENI in each VPC subnet is not supported without an endpoint; and NAT gateways are used for outbound internet traffic, not for routing to a firewall.

Answer

Create a VPC Gateway Endpoint for the firewall service.

Answer

Add a route in each VPC's subnet routing table pointing to the firewall's elastic network interface.

Answer

Configure a NAT gateway in each VPC and route traffic through it.

Question 13

A company has a requirement to audit all network traffic leaving a VPC. The traffic includes traffic to the internet, to on-premises via VPN, and to other VPCs via Transit Gateway. Which AWS service can capture and log all outbound traffic for compliance analysis?

Accepted Answer

VPC Traffic Mirroring. (VPC Traffic Mirroring) is correct because it captures and copies all outbound network traffic, including full packets, for compliance analysis. Option B (VPC Flow Logs) is incorrect because it only logs metadata (e.g., IP addresses, ports, protocols) but not the full packet content. Option C (AWS CloudTrail) is incorrect because it logs API calls and management events, not network traffic. Option D (Amazon GuardDuty) is incorrect because it is a threat detection service that analyzes traffic for anomalies, but it does not log all traffic for auditing purposes.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 14

A company wants to securely connect an on-premises data center to an AWS VPC over the internet using IPsec. Which AWS service should be used?

Accepted Answer

AWS Site-to-Site VPN. WS Site-to-Site VPN, which creates IPsec tunnels over the internet to securely connect an on-premises data center to an AWS VPC. Option A (AWS Transit Gateway) is a network transit hub that can interconnect multiple VPCs and VPNs, but it is not the VPN service itself. Option B (AWS Direct Connect) provides a dedicated physical connection, not over the internet. Option C (AWS Client VPN) is for individual remote users, not for site-to-site connections.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Client VPN

Question 15

A network engineer needs to ensure that all traffic between two VPCs (VPC A and VPC B) is encrypted in transit. The VPCs are in the same region and are connected via a VPC peering connection. What should the engineer do?

Accepted Answer

No additional action is required; all traffic over VPC peering is automatically encrypted.. VPC peering traffic within the same AWS region is automatically encrypted at the physical layer by AWS, ensuring data in transit is encrypted without additional configuration. Option A is incorrect because VPN over VPC peering is not supported and unnecessary. Option C is incorrect while application-level encryption like TLS can be added for extra security, it is not required as the traffic is already encrypted. Option D is incorrect because AWS Transit Gateway with VPN attachments adds unnecessary complexity and cost when VPC peering already provides encrypted connectivity.

Answer

Establish a VPN connection between the VPCs over the peering connection.

Answer

Implement application-level encryption such as TLS.

Answer

Use AWS Transit Gateway with VPN attachments between VPCs.