ANS-C01 Network Security, Compliance and Governance Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive data that should only be accessible from the corporate network (192.0.2.0/24). What is a potential security issue with this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not require authentication; anonymous access is allowed from the specified IP range. The policy allows any principal (Principal: '*') to perform the s3:GetObject action under the condition that the request comes from the specified IP range. However, this condition only checks the IP address; it does not require authentication. If the bucket is publicly accessible (no bucket policy or ACL denying anonymous access), then unauthenticated requests from the allowed IP range would be allowed, which is a security issue. Option A is wrong because the condition belongs on the Action element, not the Principal. Option B is wrong because the Resource ARN includes the bucket name correctly (arn:aws:s3:::example-bucket/*). Option D is wrong because the IP range is specific and appropriate for the requirement.

Answer

The condition should be applied to the Principal element

Answer

The Resource ARN is missing the bucket name

Answer

The IP address range is not specific enough

Question 2

Refer to the exhibit. A security engineer applies this SCP to an AWS account. What is the effect of this policy?

Accepted Answer

All API calls that are not made over HTTPS will be denied. The SCP uses a Deny effect with a condition that blocks all API calls when the request is not made over HTTPS (i.e., aws:SecureTransport is false). This effectively denies any API call that uses HTTP instead of HTTPS. Option A is incorrect because the policy denies non-HTTPS calls, not allows them. Option B is incorrect because the policy applies to all AWS services, not just S3. Option C is incorrect because the condition checks for transport security, not multi-factor authentication. Option D correctly states that all API calls not made over HTTPS will be denied.

Answer

All API calls over HTTPS will be allowed

Answer

Only S3 API calls will be affected

Answer

The policy requires multi-factor authentication

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all Amazon S3 buckets in the organization are encrypted at rest. Which policy should be attached to the root organizational unit to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. A service control policy (SCP) attached to the root OU can deny the s3:CreateBucket action unless the bucket is configured with default encryption, thereby enforcing encryption at rest across all accounts in the organization. Option D is correct. Option A is incorrect because AWS Config rules can detect non-compliance but cannot enforce policies in real time; they are detective, not preventive. Option B is incorrect because IAM roles are account-specific and cannot enforce encryption across all accounts centrally. Option C is incorrect because S3 bucket policies apply only to individual buckets and cannot be applied to future buckets or across accounts without manual configuration.

Answer

Configure AWS Config rules to mark non-compliant buckets and trigger a Lambda function to add encryption.

Answer

Create an IAM role in each account that requires encryption for any S3 operation.

Answer

Use an S3 bucket policy on every existing and future bucket to deny unencrypted uploads.

Question 4

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team needs to block a specific IP address range that has been launching DDoS attacks. The solution must be implemented at the network edge, before traffic reaches the ALB. What should the security team do?

Accepted Answer

Create an AWS WAF web ACL with an IP set rule that blocks the IP range and attach it to the ALB.. AWS WAF web ACL attached to the ALB can filter traffic based on IP addresses. Option B is correct because WAF is deployed at the edge (ALB or CloudFront) and can block IP sets. Option A is wrong because security groups are stateful but work at the instance level, not at the edge. Option C is wrong because NACLs are applied at the subnet level, but ALB is in a subnet, so traffic reaches the ALB first; NACL is stateless and less suitable for layer 7 filtering. Option D is wrong because CloudFront with WAF is also edge, but the question says 'before traffic reaches the ALB' and ALB is already in place; adding CloudFront changes the architecture.

Answer

Update the security group for the ALB to deny traffic from the IP range.

Answer

Add a network ACL rule on the ALB's subnet to deny inbound traffic from the IP range.

Answer

Deploy Amazon CloudFront in front of the ALB and use AWS WAF to block the IP range at CloudFront.

Question 5

A company has a VPC with public and private subnets. The security team wants to allow instances in a private subnet to download software updates from the internet but prevent inbound internet traffic. Which AWS service should be used?

Accepted Answer

NAT gateway. A NAT gateway allows outbound internet traffic from private subnets while blocking unsolicited inbound traffic. Option D is correct. Option A is wrong because an internet gateway enables bidirectional traffic, which would allow inbound traffic. Option B is wrong because AWS Site-to-Site VPN is used for hybrid connectivity between on-premises and AWS, not for outbound internet access from private subnets. Option C is wrong because VPC peering connects VPCs together, not to the internet.

Answer

Internet gateway

Answer

AWS Site-to-Site VPN

Answer

VPC peering connection

Question 6

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to ensure that traffic between the on-premises network and AWS is encrypted. Which solution meets this requirement?

Accepted Answer

Establish an IPSec VPN tunnel over the Direct Connect connection using a public VIF or transit VIF.. Direct Connect does not provide encryption by default. To encrypt traffic between on-premises and AWS over a Direct Connect connection, you can establish an IPSec VPN tunnel over a public VIF or transit VIF. This encrypts the traffic while still using the Direct Connect link. Option A is correct. Option B (VPC peering) is not applicable to on-premises networks. Option C (private VIF) does not provide encryption. Option D (IPSec VPN over the internet) does not use Direct Connect and does not meet the requirement to use Direct Connect.

Answer

Establish a VPC peering connection between the on-premises network and the VPC.

Answer

Use a private virtual interface (VIF) over Direct Connect.

Answer

Use an IPSec VPN connection over the internet.

Question 7

A security engineer needs to centrally manage and enforce rules for network traffic between VPCs in a large AWS environment. Which AWS service provides this capability?

Accepted Answer

AWS Network Firewall. AWS Network Firewall provides centralized management of firewall rules across multiple VPCs, allowing security engineers to enforce consistent network traffic controls. Option A (VPC peering) is just a connectivity mechanism, not a filtering service. Option B (Security groups) operate at the ENI level and are not centrally managed across VPCs. Option C (Network ACLs) are stateless and applied per subnet, not centrally. Therefore, D is correct.

Answer

VPC peering

Answer

Security groups

Answer

Network ACLs

Question 8

A company has an AWS account with multiple VPCs. The security team wants to ensure that no VPC has an internet gateway attached. Which AWS service can be used to automatically detect and remediate non-compliant VPCs?

Accepted Answer

AWS Config with a managed rule to detect internet gateways and an automatic remediation action to detach them.. AWS Config rules can evaluate compliance of resources and trigger automatic remediation actions. A managed rule such as 'restricted-common-ports' or a custom rule can detect VPCs with internet gateways, and an accompanying remediation action can automatically detach them. Option A (Amazon GuardDuty) is a threat detection service, not a configuration compliance tool. Option B (AWS CloudTrail) logs API calls but does not evaluate current resource configurations. Option C (Service control policies, SCPs) define permissions boundaries but cannot detect or remediate existing non-compliant resources. Option D is correct.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

Service control policies (SCPs)

Question 9

A company is migrating a legacy application to AWS. The application requires that all traffic between the web and application tiers be encrypted, but the application does not support TLS. What should a network engineer do to meet this requirement without modifying the application?

Accepted Answer

Establish a VPN connection between the web and application instances.. Establishing a VPN connection between the web and application instances encrypts all traffic at the network layer, making encryption transparent to the application. This meets the requirement without modifying the application. Option B is incorrect because a Network Load Balancer with TLS termination only encrypts traffic between clients and the NLB; traffic from the NLB to targets is sent in cleartext, so targets must support TLS for end-to-end encryption. Since the application does not support TLS, this does not satisfy the requirement. Option C is incorrect because an Application Load Balancer terminates TLS but forwards HTTP traffic to targets in cleartext. Option D is incorrect because a Classic Load Balancer with TCP listeners does not provide any encryption.

Answer

Use a Network Load Balancer (NLB) with TLS termination and target groups with TCP, then enable encryption on the NLB.

Answer

Use an Application Load Balancer (ALB) with TLS termination between the tiers.

Answer

Use a Classic Load Balancer with TCP listeners.

Question 10

A company wants to audit all changes to security group rules in a VPC. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to the AWS environment, including calls to modify security group rules (such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, etc.). This provides a detailed audit trail of who made the change, when, and from where. AWS Config can record resource configuration changes and can provide a history of security group rule changes, but it is not the primary service for auditing API calls; it focuses on configuration compliance and resource relationships. VPC Flow Logs capture metadata about network traffic, not configuration changes. CloudWatch monitors performance metrics and logs. Therefore, CloudTrail is the correct answer.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch

Question 11

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to enforce that all VPCs use a specific set of security group rules for inbound SSH access. Which TWO steps should the team take? (Choose two.)

Accepted Answer

Use AWS Config rules to detect non-compliant security groups and trigger automatic remediation.. SCPs can deny the ec2:AuthorizeSecurityGroupIngress action if the rule does not comply with the standard, enforcing compliance at the organization level (Option D). AWS Config rules can detect non-compliant security groups and trigger automatic remediation via AWS Systems Manager Automation (Option A). Option B is incorrect because CloudTrail logs but does not enforce. Option C is incorrect because GuardDuty monitors for threats, not compliance. Option E is incorrect because IAM roles per account are not centralized and do not enforce across accounts.

Answer

Enable AWS CloudTrail to log all security group changes and send alerts.

Answer

Enable Amazon GuardDuty to monitor for malicious traffic.

Answer

Create an IAM role in each account that only allows creation of compliant security groups.

Question 12

A company has a VPC with public and private subnets. The security team wants to inspect all traffic leaving the VPC to the internet for malicious activity. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

VPC Flow Logs. A NAT gateway (E) enables outbound traffic from private subnets to the internet. VPC Flow Logs (A) capture metadata of traffic flows. Amazon GuardDuty (C) can analyze flow logs to detect malicious activity. Together, these three services allow inspection of all outbound traffic. Option B (Internet gateway) is for inbound traffic from the internet. Option D (AWS Network Firewall) can also inspect traffic but is not part of this common three-service combination.

Answer

Internet gateway

Answer

AWS Network Firewall

Question 13

A security engineer reviews VPC Flow Logs and sees the entries shown. The last entry shows a REJECT for traffic from 203.0.113.5 to 10.0.1.5 on port 443. However, the third entry shows ACCEPT for traffic from 10.0.1.5 to 203.0.113.5 on port 443. What is the most likely reason for the REJECT?

Accepted Answer

The network ACL associated with the subnet of 10.0.1.5 does not allow inbound traffic from 203.0.113.5.. The VPC Flow Logs show outbound traffic from 10.0.1.5 to 203.0.113.5 on port 443 was allowed (ACCEPT), but the inbound response was rejected. Security groups are stateful, so they automatically allow return traffic for established connections. Therefore, a security group (Option C) would not cause this REJECT. Network ACLs are stateless and require explicit inbound rules; if the inbound rule for traffic from 203.0.113.5 is missing, the response is dropped, resulting in a REJECT. Option A correctly identifies this. Option B (AWS WAF) operates at the application layer (Layer 7) and is not reflected in VPC Flow Logs, which capture Layer 3/4 traffic. Option D (route table) would cause a lack of connectivity, not a REJECT entry in flow logs.

Answer

AWS WAF is blocking the inbound traffic.

Answer

The security group attached to the instance 10.0.1.5 does not allow inbound traffic from 203.0.113.5.

Answer

The route table for the subnet of 10.0.1.5 does not have a route to the internet.

Question 14

A network administrator attached the IAM policy shown to a user. The user tries to create an internet gateway in us-east-1 without any tags. What will happen?

Accepted Answer

The internet gateway creation is denied because the Deny statement applies.. The first statement allows CreateInternetGateway in us-east-1. The second statement denies CreateInternetGateway if the resource tag 'purpose' is not 'production'. When creating a resource without tags, the condition StringNotEquals evaluates to true (since no tag, it's not equal to 'production'), so the Deny applies. The Deny overrides the Allow, so the action is denied. Therefore, option C is correct because the Deny statement applies. Option A is incorrect because the first statement does allow it in us-east-1, but the Deny overrides. Option B is incorrect because the creation is denied, not permitted with a warning. Option D is incorrect because the Deny overrides the Allow.

Answer

The internet gateway creation fails because the first statement does not allow it in us-east-1.

Answer

The internet gateway is created but the user receives a warning.

Answer

The internet gateway is created successfully because the first statement allows it.

Question 15

A company wants to restrict access to an S3 bucket so that only traffic from a specific AWS account is allowed. Which S3 bucket policy condition key should be used to achieve this?

Accepted Answer

aws:SourceAccount. Using the 'aws:SourceAccount' condition key ensures that only requests originating from the specified AWS account are allowed. Option A is wrong because 'aws:PrincipalAccount' checks the principal's account, not the source account. Option B is wrong because 'aws:Referer' checks the HTTP referer header, not the source account. Option D is wrong because 'aws:SourceArn' checks the ARN of the source resource, not the account.

Answer

aws:PrincipalAccount

Answer

aws:Referer

Answer

aws:SourceArn