ANS-C01 Network Security, Compliance and Governance Practice Test 8 — 15 Questions

Question 1

A company has a VPC with multiple subnets. They want to enforce that all traffic between subnets must be inspected by a security appliance deployed in a centralized inspection VPC. Which AWS feature should be used to route traffic to the inspection VPC without changing the routing on each subnet?

Accepted Answer

Transit Gateway with route tables. A Transit Gateway with route tables allows central routing and inspection. Option A is wrong because VPC peering does not support centralized inspection easily. Option B is wrong because NAT Gateway is for outbound internet. Option D is wrong because a Network Load Balancer is for load balancing, not routing.

Answer

VPC Peering

Answer

NAT Gateway

Answer

Network Load Balancer

Question 2

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its backend targets. Which AWS service should be used to terminate TLS at the ALB and re-encrypt traffic to the targets?

Accepted Answer

Application Load Balancer with HTTPS listeners. An ALB can terminate TLS and optionally re-encrypt traffic to targets using HTTPS. Option A is wrong because AWS Certificate Manager provides certificates, not encryption. Option B is wrong because AWS WAF is for web application firewall. Option D is wrong because AWS Shield is for DDoS protection.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Answer

AWS WAF

Question 3

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet that needs to access an S3 bucket in the same region. Which approach provides the most secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 provides private and free access to S3. Option B is wrong because NAT Gateway incurs cost and is less secure. Option C is wrong because Internet Gateway is not private. Option D is wrong because a VPN connection is unnecessary and costly.

Answer

Use an Internet Gateway and a public IP

Answer

Set up a VPN connection to on-premises and access S3 via that

Answer

Use a NAT Gateway and route traffic through it

Question 4

A company uses AWS Network Firewall to inspect traffic. They notice that some traffic is bypassing the firewall. The VPC has a route table with a default route (0.0.0.0/0) pointing to the firewall endpoint. Which configuration could cause traffic to bypass the firewall?

Accepted Answer

The route table has a more specific route for the destination traffic. If a subnet has a route for the specific destination that overrides the default route, traffic may bypass the firewall. Option A is wrong because more specific routes take precedence. Option B is wrong because subnet association does not cause bypass. Option C is wrong because firewall endpoint is in a different subnet. Option D is wrong because route propagation does not bypass.

Answer

The route table has route propagation enabled

Answer

The subnet is not associated with the route table

Answer

The firewall endpoint is in a different Availability Zone

Question 5

A company needs to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile apps. Which AWS service should they use?

Accepted Answer

AWS Security Token Service (STS). AWS STS allows you to request temporary credentials. Option B is wrong because IAM user credentials are long-term. Option C is wrong because Cognito is for user pools. Option D is wrong because KMS is for encryption keys.

Answer

AWS Key Management Service (KMS)

Answer

Amazon Cognito user pools

Answer

IAM user with access keys

Question 6

A company is designing a network security architecture for a multi-account environment using AWS Organizations. Which TWO services can be used to centrally manage security policies across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Firewall Manager centrally manages WAF rules and Shield protections across accounts. AWS Organizations SCPs centrally control permissions. Option C is wrong because AWS Config is per-account. Option D is wrong because CloudTrail is per-account. Option E is wrong because VPC is per-account.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon VPC

Question 7

A company wants to secure network traffic between on-premises data centers and AWS using AWS Site-to-Site VPN. Which TWO components are required to establish a VPN connection?

Accepted Answer

Customer Gateway (CGW). A virtual private gateway is required on the AWS side, and a customer gateway represents the on-premises VPN device. Option C is wrong because a transit gateway is optional. Option D is wrong because a VPN connection is the object that ties them together. Option E is wrong because a Direct Connect connection is separate.

Answer

Transit Gateway

Answer

VPN Connection

Answer

Direct Connect connection

Question 8

A company wants to monitor and log all network traffic within a VPC for security analysis. Which THREE services can be used to achieve this?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information. AWS Network Firewall provides stateful inspection and logs. AWS Traffic Mirroring replicates network traffic for analysis. Option D is wrong because CloudWatch is for monitoring, not capturing traffic. Option E is wrong because S3 is storage.

Answer

Amazon CloudWatch

Answer

Amazon S3

Question 9

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. Users in a different VPC with IP range 10.0.0.0/16 are able to access objects, but users in a different VPC with IP range 10.1.0.0/16 cannot. What is the most likely cause?

Accepted Answer

The users are accessing the bucket through a NAT Gateway, which changes the source IP. The condition 'aws:SourceIp' checks the source IP address. If the users in 10.1.0.0/16 are accessing via a NAT, the source IP will be the NAT's public IP, not the private IP, and will not match the condition. Option A is wrong because the policy allows all principals. Option B is wrong because the resource is correct. Option C is wrong because the action is correct.

Answer

The bucket policy uses the wrong condition key

Answer

The bucket policy specifies the wrong resource ARN

Answer

The bucket policy does not specify a principal

Question 10

Refer to the exhibit. A network engineer examines the network ACL for a subnet. Which statement best describes the effect of this network ACL?

Accepted Answer

Inbound TCP traffic is allowed, but all outbound traffic is denied. The inbound rule allows TCP traffic (protocol 6) from all sources, but the default deny rule blocks all other inbound traffic. Outbound traffic is all denied. The explicit allow rule for inbound TCP takes precedence over the default deny. Option A is wrong because it allows TCP inbound. Option B is wrong because it allows TCP inbound. Option C is wrong because outbound is denied.

Answer

Both inbound and outbound TCP traffic are allowed

Answer

All inbound traffic is allowed

Answer

All outbound traffic is allowed

Question 11

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. What is the effect of the policy?

Accepted Answer

Only HTTPS requests are allowed, and HTTP requests are denied. This policy denies all S3 actions on the bucket if the request is not using HTTPS (SecureTransport false). Option A is wrong because it does not allow all. Option B is wrong because it denies HTTP only. Option C is wrong because it does not allow HTTPS.

Answer

All requests are denied

Answer

Only HTTP requests are allowed

Answer

All requests are allowed

Question 12

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which SCP should be applied to the root OU?

Accepted Answer

Deny s3:PutBucketEncryption unless encryption settings include AES256 or aws:kms. Option A is correct because an SCP that denies the PutBucketEncryption action unless the bucket has encryption settings matching the desired configuration enforces encryption. Option B is wrong because SCPs cannot be applied to individual resources. Option C is wrong because SCPs cannot modify resources. Option D is wrong because SCPs are not IAM policies.

Answer

Create an IAM policy that allows s3:PutBucketEncryption only with specific conditions

Answer

Attach an IAM policy to each S3 bucket requiring encryption

Answer

Use AWS Config rules to auto-enable encryption on existing buckets

Question 13

A network engineer is designing a VPC with private subnets for workloads that must not have direct internet access. However, the workloads need to download patches from a specific third-party vendor's IP range. Which solution minimizes the attack surface?

Accepted Answer

Create a managed prefix list for the vendor's IPs and add a route in the private subnet route table to a NAT gateway, with the prefix list as destination. Option C is correct because a managed prefix list in the route table for the private subnets allows traffic only to the vendor's IPs via a NAT gateway. Option A is wrong because a VPN to the vendor introduces unnecessary complexity and trust. Option B is wrong because a proxy server sends all traffic, not just to vendor. Option D is wrong because a VPC endpoint is for AWS services only.

Answer

Configure a VPC endpoint for the vendor's service

Answer

Deploy a proxy server in a public subnet and configure the workloads to use it for all internet traffic

Answer

Establish a VPN connection to the vendor's network and route all traffic to the vendor through the VPN

Question 14

A security engineer notices that a security group allows inbound SSH from 0.0.0.0/0. Which immediate action should be taken to reduce risk?

Accepted Answer

Modify the security group inbound rule to allow SSH only from the company's public IP range. Option B is correct because restricting SSH access to known corporate IPs reduces exposure. Option A is wrong because deleting the security group may affect running instances. Option C is wrong because a NACL is stateless and less precise. Option D is wrong because moving instances is disruptive.

Answer

Add a network ACL deny rule for SSH from 0.0.0.0/0

Answer

Move the instances to a different subnet with a restrictive NACL

Answer

Delete the security group and create a new one with the correct rules

Question 15

A company uses AWS Direct Connect to connect its on-premises network to AWS. The security team wants to encrypt all traffic traversing the Direct Connect link. Which solution should be used?

Accepted Answer

Establish an IPsec VPN tunnel over the Direct Connect link. Option D is correct because IPsec VPN over Direct Connect provides encryption while maintaining low latency. Option A is wrong because Direct Connect does not inherently encrypt. Option B is wrong because TLS is for application layer, not link. Option C is wrong because VPC endpoints are for specific services.

Answer

Enable encryption on the Direct Connect virtual interface

Answer

Use TLS on all applications that communicate across the link

Answer

Use VPC endpoints for all AWS services accessed