ANS-C01 Network Security, Compliance and Governance Practice Test 9 — 15 Questions

Question 1

A company is designing a multi-VPC architecture with AWS Transit Gateway. The security requirements include: (1) all inter-VPC traffic must be inspected by a central firewall, (2) traffic to the internet must egress through a centralized egress VPC, and (3) traffic to on-premises via Direct Connect must go through the same inspection firewall. Which THREE components are required to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Network Firewall in an inspection VPC. Option B is correct because AWS Network Firewall deployed in a dedicated inspection VPC provides the centralized traffic inspection required for all inter-VPC, internet-bound, and on-premises-bound traffic, and it can be referenced as a TGW attachment target. Option C is correct because a Virtual Private Gateway (VGW) attached to the inspection VPC (or a Transit VIF on the Direct Connect gateway associated with the TGW) is needed to bring Direct Connect traffic into the inspection path so on-premises traffic is inspected by the same firewall. Option E is correct because AWS Transit Gateway with multiple route tables enables segmentation and steering of traffic from spoke VPCs into the inspection VPC, then to the egress VPC or on-premises, which is essential for centralized inspection and egress. Option A is not needed because VPC peering does not support transitive routing through a central inspection VPC and would bypass the required inspection and centralized egress. Option D is not required because NAT gateways in each VPC would provide distributed internet egress, contradicting the requirement for centralized egress through a single egress VPC.

Answer

VPC peering connections between all VPCs

Answer

NAT gateways in each VPC

Question 2

A security team needs to implement a solution to detect and alert on suspicious network traffic within a VPC. The solution should analyze VPC Flow Logs and generate findings for potential threats. Which THREE AWS services can be used together to achieve this?

Accepted Answer

VPC Flow Logs. VPC Flow Logs (A) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, accept/reject) for ENIs in the VPC, providing the raw network telemetry the solution must analyze. Amazon GuardDuty (C) is correct because it continuously ingests VPC Flow Logs (along with DNS logs and CloudTrail events) and applies threat intelligence and ML anomaly detection to generate findings for suspicious activity such as port scanning, crypto-mining, or communication with known malicious IPs. Amazon Detective (B) is correct because it consumes GuardDuty findings and VPC Flow Log data to build behavior graphs and visualizations that help investigate and confirm potential threats. AWS CloudTrail (D) is not correct here because it records API activity in the account, not network traffic within the VPC, so it does not analyze flow logs. AWS Config (E) is not correct because it evaluates resource configuration compliance and changes, not network traffic patterns or threat detection.

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to use a proxy server running on an EC2 instance in the public subnet. The security group for the proxy server must allow inbound HTTP/HTTPS from the instance in the private subnet. The security group for the private instance must allow outbound HTTP/HTTPS to the proxy server. However, the private instance cannot connect to the proxy. What is the most likely cause?

Accepted Answer

The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.. The route table for the private subnet likely has a default route pointing to a NAT gateway or internet gateway, causing traffic to bypass the proxy server. Even though security groups are configured correctly, routing decisions are made first. Traffic from the private instance to the proxy server would be directed to the default gateway (NAT/internet gateway) instead of the proxy's IP address. Option A is incorrect: the security group for the private instance does allow outbound HTTP/HTTPS to the proxy. Option B is incorrect: network ACLs are stateless and must allow both inbound and outbound; but if they blocked inbound from the proxy, that would affect return traffic, not the initial connection. Option D is incorrect: the proxy's security group is configured to allow inbound from the private instance.

Answer

The security group for the private instance does not allow outbound traffic to the proxy server.

Answer

The network ACL for the private subnet blocks inbound traffic from the proxy.

Answer

The security group for the proxy server does not allow inbound traffic from the private instance's security group.

Question 4

A company needs to audit all changes to security groups in a VPC. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in an AWS account, including changes to security groups. When a security group is created, modified, or deleted, CloudTrail logs the event with details such as the user, time, and source IP. This makes CloudTrail the correct service for auditing changes to security groups. AWS Config can also track changes but is more focused on compliance and configuration history, while CloudTrail is specifically for API auditing.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch

Question 5

A security engineer is designing a network security solution for a multi-tier application. The web tier must be accessible from the internet on ports 80 and 443. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier on port 3306. Which THREE network access control mechanisms should be used?

Accepted Answer

Security groups that allow traffic from specific security groups for the database tier.. Option A is correct because security groups can reference other security groups as sources, so the database tier's security group can allow inbound TCP 3306 only from the application tier's security group, ensuring only application instances can reach the database. Option E is correct because security groups referencing other security groups as sources is the core mechanism that enforces tier-to-tier isolation without hardcoding CIDR ranges, which is exactly what the application tier needs to accept traffic only from the web tier. Option D is correct because network ACLs provide stateless subnet-level filtering, adding a defense-in-depth layer that can control traffic entering and leaving each tier's subnet, complementing the stateful security groups. Option B is not appropriate because AWS WAF filters HTTP/HTTPS web traffic at the application layer and cannot filter MySQL port 3306 traffic to a database tier. Option C is not appropriate because IAM policies control API-level permissions and identity access to AWS resources, not network-level traffic between application tiers.

Answer

AWS WAF to filter traffic to the database tier.

Answer

IAM policies to restrict access to the database.

Question 6

A company is designing a network architecture for a highly sensitive application that must meet strict compliance requirements. The application is deployed in a VPC with multiple subnets. The company needs to ensure that all traffic between subnets is encrypted and that no traffic can bypass the encryption. Which TWO steps should be taken?

Accepted Answer

Use network ACLs to block all traffic except encrypted protocols (e.g., IPSec).. Option A is correct because network ACLs are stateless subnet-level filters that can explicitly deny all traffic except the encrypted protocol (e.g., IPSec/ESP, UDP 500/4500), which enforces encryption at the subnet boundary and prevents any unencrypted traffic from bypassing the requirement. Option C is correct because a VPC CNI plugin with encryption support (e.g., enabling pod-to-pod encryption via IPsec or WireGuard at the CNI layer) transparently encrypts all inter-pod traffic across subnets, ensuring traffic between subnets is encrypted regardless of application awareness. Option B is not correct because VPN connections are established between VPCs or on-premises networks via virtual private gateways or transit gateways, not between individual subnet route tables, so it does not satisfy intra-VPC subnet-to-subnet encryption. Option D is not correct because security groups are stateful allow-list filters that cannot enforce encryption—they only permit or deny traffic based on IP, port, and protocol, and cannot distinguish encrypted from unencrypted payloads. Option E is not correct because VPC Flow Logs only record metadata about IP traffic (source, destination, ports, bytes, accept/reject) and cannot detect whether traffic is encrypted, nor do they prevent unencrypted traffic from flowing.

Answer

Set up VPN connections between each subnet's route tables.

Answer

Use security groups to allow only encrypted traffic.

Answer

Enable VPC Flow Logs to detect unencrypted traffic.

Question 7

A company is using AWS Direct Connect to connect its on-premises network to VPCs in multiple AWS accounts. The company wants to ensure that traffic from the on-premises network can only access specific VPCs based on the source IP address. Which AWS service should be used to enforce this segmentation?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub that connects on-premises networks via Direct Connect to multiple VPCs across accounts. It supports route table segmentation, allowing traffic from specific source IP ranges to be directed only to designated VPCs. This enforces the required segmentation based on source IP.

Answer

VPC Peering

Answer

AWS PrivateLink

Answer

Security Groups

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which policy type should be used?

Accepted Answer

Service Control Policy (SCP). The Service Control Policy (SCP). SCPs are used in AWS Organizations to centrally control the maximum available permissions for all accounts in an organization. They can be used to prevent security groups from allowing inbound SSH from 0.0.0.0/0 by denying the ability to create or modify security group rules that permit such traffic. Network ACLs (Option A) operate at the subnet level and are not account-wide; they control traffic entering/exiting subnets, but cannot enforce organizational policies across multiple accounts. IAM policies (Option B) apply to users, groups, or roles, and cannot directly restrict security group configurations. AWS Config rules (Option D) are detective controls that can evaluate compliance but are not preventive; they do not block the creation of non-compliant security group rules. Therefore, SCP is the appropriate preventive policy type.

Answer

Network ACL

Answer

IAM policy

Answer

AWS Config rule

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to centrally enforce that no Amazon S3 buckets are publicly accessible across all accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Apply a service control policy (SCP) in AWS Organizations that denies the s3:PutBucketPublicAccessBlock action or enforces a bucket policy condition.. A service control policy (SCP) in AWS Organizations can centrally deny actions like s3:PutBucketPublicAccessBlock or enforce conditions that prevent public bucket policies across all accounts. SCPs apply to all IAM principals in member accounts (except the management account) and require no per-account setup, meeting the least operational overhead requirement.

Answer

Use AWS Trusted Advisor to check for public buckets and send alerts.

Answer

Create an IAM role in each account with a policy to deny public bucket access, and require users to assume that role.

Answer

Configure security group rules to block public internet access to the S3 endpoints.

Question 10

A company is using AWS CloudHSM to store sensitive encryption keys. Which of the following is a security best practice for managing the HSM?

Accepted Answer

Store the CloudHSM security officer (CO) password in AWS Secrets Manager.. Storing the CloudHSM security officer (CO) password in AWS Secrets Manager is a security best practice because it centralizes secret storage, enables encryption at rest with KMS, supports automatic rotation, and provides auditability via CloudTrail. This avoids hardcoding credentials in scripts or storing them insecurely.

Answer

Disable two-factor authentication for the HSM to simplify management.

Answer

Use AWS KMS to automatically rotate the CloudHSM partition password.

Answer

Allow AWS to manage the CloudHSM cluster by granting AWS support access.

Question 11

A company is designing a network security architecture for a multi-account environment using AWS Organizations. The security team needs to ensure that all internet-bound traffic from VPCs in the organization goes through a centralized egress VPC where it is inspected by a firewall. Which TWO steps are required to enforce this?

Accepted Answer

Create a central egress VPC with an Internet Gateway and a NAT Gateway or firewall.. Option A is correct because the centralized egress VPC must actually exist and contain the components that provide and inspect internet connectivity: an Internet Gateway for the public path, plus a NAT Gateway or firewall appliance to perform the egress and inspection for spoke VPCs. Option E is correct because an AWS Organizations service control policy (SCP) that denies ec2:CreateInternetGateway in every account except the central network account prevents other accounts from creating their own internet gateways, which is the enforcement mechanism that keeps internet-bound traffic flowing through the centralized egress VPC. Option B is not correct because AWS WAF protects web applications at the application layer and cannot block or redirect general VPC internet egress. Option C is not correct because AWS Direct Connect is a private dedicated connection to AWS, not a mechanism for routing internet-bound traffic through a central VPC. Option D is not correct because VPC endpoints provide private access to specific AWS services and do not force general internet-bound traffic through a central egress VPC.

Answer

Use AWS WAF to block internet access from all VPCs except the central egress VPC.

Answer

Set up an AWS Direct Connect connection to route internet traffic through the central VPC.

Answer

Configure VPC endpoints for all AWS services to force traffic through the central VPC.

Question 12

A company is building a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The security team requires that all API requests are authenticated and authorized, and that the Lambda function has only the necessary permissions to access DynamoDB. Which THREE steps should be taken?

Accepted Answer

Configure API Gateway to use an Amazon Cognito user pool or a Lambda authorizer for authentication.. Option B is correct because API Gateway natively supports Amazon Cognito user pools and Lambda authorizers as authentication/authorization mechanisms, which validate caller identity (JWT tokens or custom logic) before invoking the backend, satisfying the requirement that all API requests are authenticated and authorized. Option D is correct because Lambda assumes an IAM execution role, and scoping that role's policy to only the specific DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem) and specific table ARN enforces least privilege for the function's data access. Option E is correct because a DynamoDB resource-based policy can restrict access to a specific principal, such as the Lambda function's IAM role, adding an explicit resource-side control that only that role may access the table. Option A is not required: placing Lambda in a VPC with a DynamoDB gateway endpoint is a network-isolation/private-access measure, not an authentication or least-privilege permission control, and it is unnecessary for the stated requirements. Option C is incorrect because API keys in API Gateway are for usage plans, throttling, and identification of client applications, not for authenticating or authorizing users, so they do not meet the security team's requirement.

Answer

Place the Lambda function inside a VPC and use a VPC endpoint for DynamoDB.

Answer

Use API keys in API Gateway to authenticate requests.

Question 13

A company is designing a network security architecture for a multi-account AWS environment using AWS Transit Gateway. They need to ensure that all traffic between VPCs must be inspected by a centralized security appliance (e.g., firewall) in a shared services VPC. Which routing design meets this requirement?

Accepted Answer

Attach the inspection VPC and all spoke VPCs to the same Transit Gateway route table, and add a static route for the spoke VPC CIDRs pointing to the inspection VPC attachment, with blackhole routes for the same CIDRs.. By attaching both the inspection VPC and the spoke VPCs to the same route table with blackhole routes, traffic between spokes is forced to go through the inspection VPC. Option A is incorrect because it uses separate route tables, which would allow direct routing. Option B allows direct traffic. Option D is not a standard practice.

Answer

Attach all VPCs to a single route table and enable VPC peering for inspection VPC.

Answer

Use a centralized NAT gateway in the inspection VPC and configure all spokes to route traffic through it.

Answer

Create separate route tables for each VPC attachment and propagate routes from all VPCs.

Question 14

A company uses AWS Shield Advanced for DDoS protection. They want to receive near real-time notifications when a DDoS attack is detected. Which AWS service should be used to trigger the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). AWS Shield Advanced integrates directly with Amazon Simple Notification Service (SNS) to deliver near real-time notifications when a DDoS attack is detected. When Shield Advanced detects an attack, it publishes an event to an SNS topic, which can then fan out notifications via email, SMS, or HTTP endpoints. This is the native, built-in mechanism for Shield Advanced alerts, requiring no custom code or additional services.

Answer

Amazon EventBridge

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 15

A security engineer is troubleshooting an issue where Amazon Inspector is not finding any vulnerabilities in an EC2 instance. The instance has the AWS Systems Manager Agent (SSM Agent) installed and is managed by AWS Systems Manager. What is the most likely reason for Inspector not reporting findings?

Accepted Answer

The EC2 instance does not have an IAM role that allows Inspector to scan it.. Amazon Inspector requires an IAM role that grants it permission to assess the EC2 instance. Without such a role, Inspector cannot perform vulnerability scans, even if the SSM Agent is installed and the instance is managed by Systems Manager. The other options are incorrect: the instance is managed by SSM (contradicting D), and missing NAT gateway or security group outbound rules do not prevent Inspector from scanning (Inspector initiates scans internally).

Answer

The EC2 instance is in a private subnet without a NAT gateway.

Answer

The EC2 instance's security group blocks outbound traffic to the Inspector service.

Answer

The EC2 instance is not managed by AWS Systems Manager.