ANS-C01 Network Security, Compliance and Governance Practice Test 9 — 15 Questions

Question 1

A company has a VPC with public and private subnets. They want to allow instances in the private subnet to download software updates from the internet while preventing inbound traffic from the internet. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT Gateway. A NAT Gateway allows outbound internet traffic from private subnets while blocking inbound traffic, making it the correct choice. Option A (VPC Peering) is incorrect because it does not provide internet access. Option C (Internet Gateway) is incorrect because it allows inbound traffic from the internet. Option D (VPN Connection) is incorrect because it typically provides private connectivity to an on-premises network, not direct internet access.

Answer

VPC Peering

Answer

Internet Gateway

Answer

VPN Connection

Question 2

A company uses AWS WAF to protect a web application. They notice that some malicious requests are being allowed. After investigating, they find that the requests have valid AWS WAF tokens but the payloads are obfuscated. Which WAF configuration should be reviewed to improve detection?

Accepted Answer

Bot Control managed rule group. AWS WAF Bot Control managed rule group is designed to detect and block requests from bots, including those that use obfuscated payloads. Since the malicious requests have valid tokens but obfuscated payloads, Bot Control can analyze behavior patterns and signature heuristics to identify such traffic. Rate-based rules (option B) are used to limit request rates, not to detect obfuscated payloads. SQL injection match conditions (option C) detect SQL injection patterns, not general obfuscation. IP set match rules (option D) block or allow based on IP addresses, which is ineffective against obfuscated payloads.

Answer

Rate-based rule

Answer

SQL injection match condition

Answer

IP set match rule

Question 3

A security engineer needs to audit all API calls made in an AWS account for compliance. The engineer wants to capture the source IP address and the user agent for each call. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls and includes source IP and user agent, making it the correct service for auditing API calls. Option A (AWS Config) is incorrect because it records resource changes, not API calls. Option C (Amazon CloudWatch Logs) is incorrect because it stores logs but does not capture API calls directly. Option D (VPC Flow Logs) is incorrect because it captures network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 4

A company has a VPC with multiple subnets. They want to enforce that all traffic between subnets must be inspected by a security appliance deployed in a centralized inspection VPC. Which AWS feature should be used to route traffic to the inspection VPC without changing the routing on each subnet?

Accepted Answer

Transit Gateway with route tables. A Transit Gateway with route tables allows central routing and inspection. Option A is wrong because VPC peering does not support centralized inspection easily. Option B is correct because Transit Gateway can route traffic between VPCs and subnets with centralized inspection. Option C is wrong because NAT Gateway is for outbound internet traffic. Option D is wrong because a Network Load Balancer is for load balancing, not routing.

Answer

VPC Peering

Answer

NAT Gateway

Answer

Network Load Balancer

Question 5

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its backend targets. Which AWS service should be used to terminate TLS at the ALB and re-encrypt traffic to the targets?

Accepted Answer

Application Load Balancer with HTTPS listeners. An ALB can terminate TLS and optionally re-encrypt traffic to targets using HTTPS. Option A is wrong because AWS Certificate Manager provides certificates, not encryption. Option B is wrong because AWS Shield is for DDoS protection. Option C is correct. Option D is wrong because AWS WAF is a web application firewall.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Answer

AWS WAF

Question 6

A company uses AWS Network Firewall to inspect traffic. They notice that some traffic is bypassing the firewall. The VPC has a route table with a default route (0.0.0.0/0) pointing to the firewall endpoint. Which configuration could cause traffic to bypass the firewall?

Accepted Answer

The route table has a more specific route for the destination traffic. A more specific route (e.g., a /32 or /24 for the destination network) in the VPC route table will take precedence over the default route (0.0.0.0/0) that points to the firewall endpoint. This causes traffic destined for that specific network to bypass the firewall. Option A is incorrect because route propagation adds routes from VPN or Direct Connect but does not inherently cause bypass. Option B is incorrect because if the subnet is not associated with the firewall's route table, it uses the main route table, which could bypass the firewall, but the key issue here is the existence of a more specific route. Option C is incorrect because the firewall endpoint being in a different Availability Zone does not cause traffic to bypass; it can cause increased latency or other issues but not bypass.

Answer

The route table has route propagation enabled

Answer

The subnet is not associated with the route table

Answer

The firewall endpoint is in a different Availability Zone

Question 7

A company needs to provide temporary, limited-privilege credentials to users so they can access AWS resources from mobile apps. Which AWS service should they use?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) enables you to request temporary, limited-privilege credentials for users, which is ideal for mobile apps. Option A (KMS) is used for encryption key management, not credential generation. Option B (Cognito user pools) provides user identity management but does not directly issue temporary AWS credentials. Option D (IAM user with access keys) provides long-term credentials, not temporary.

Answer

AWS Key Management Service (KMS)

Answer

Amazon Cognito user pools

Answer

IAM user with access keys

Question 8

A company is designing a network security architecture for a multi-account environment using AWS Organizations. Which TWO services can be used to centrally manage security policies across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Firewall Manager provides centralized management of firewall rules (including AWS WAF, AWS Shield Advanced, and security groups) across all accounts in AWS Organizations. AWS Organizations Service Control Policies (SCPs) allow you to centrally define and enforce permission boundaries and security policies across all member accounts. In contrast, AWS Config and AWS CloudTrail operate per account and do not provide centralized policy management across multiple accounts. Amazon VPC is a per-account networking service. Therefore, the correct answers are C (SCPs) and D (Firewall Manager).

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon VPC

Question 9

A company wants to secure network traffic between on-premises data centers and AWS using AWS Site-to-Site VPN. Which TWO components are required to establish a VPN connection?

Accepted Answer

Customer Gateway (CGW). AWS Site-to-Site VPN requires a Virtual Private Gateway (VGW) on the AWS side and a Customer Gateway (CGW) representing the on-premises VPN device. Option A (Transit Gateway) is not required; it's optional for complex routing. Option C (VPN Connection) is not a component; it's the logical connection object that ties VGW and CGW together. Option D (Direct Connect connection) is a different service.

Answer

Transit Gateway

Answer

VPN Connection

Answer

Direct Connect connection

Question 10

A company wants to monitor and log all network traffic within a VPC for security analysis. Which THREE services can be used to achieve this?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling monitoring and logging. AWS Network Firewall provides stateful inspection and logs traffic that passes through the firewall. AWS Traffic Mirroring replicates network traffic from an elastic network interface for analysis. Amazon CloudWatch is a monitoring service that can collect logs but does not directly capture network traffic. Amazon S3 is object storage and cannot capture or log network traffic itself.

Answer

Amazon CloudWatch

Answer

Amazon S3

Question 11

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. Users in a different VPC with IP range 10.0.0.0/16 are able to access objects, but users in a different VPC with IP range 10.1.0.0/16 cannot. What is the most likely cause?

Accepted Answer

The users are accessing the bucket through a NAT Gateway, which changes the source IP. The users in 10.1.0.0/16 are likely accessing the bucket through a NAT Gateway, which translates their private source IPs to the NAT's public IP. The bucket policy uses 'aws:SourceIp' with the condition '10.1.0.0/16', but after NAT, the source IP is no longer in that range, causing access to be denied. Option A is incorrect because the condition key 'aws:SourceIp' is appropriate; the problem is the IP after translation. Option C is incorrect because the resource ARN is specified correctly. Option D is incorrect because bucket policies can be written without a principal to apply to all principals; it's valid.

Answer

The bucket policy uses the wrong condition key

Answer

The bucket policy specifies the wrong resource ARN

Answer

The bucket policy does not specify a principal

Question 12

Refer to the exhibit. A network engineer examines the network ACL for a subnet. Which statement best describes the effect of this network ACL?

Accepted Answer

Inbound TCP traffic is allowed, but all outbound traffic is denied. The inbound rule explicitly allows TCP traffic (protocol 6) from any source (0.0.0.0/0). However, the outbound rules consist only of a default deny rule, which blocks all outbound traffic. Therefore, inbound TCP traffic is allowed, but all outbound traffic is denied. Option A is incorrect because outbound traffic is denied, not allowed. Option C is incorrect because only inbound TCP is allowed, not all inbound traffic. Option D is incorrect because outbound traffic is denied.

Answer

Both inbound and outbound TCP traffic are allowed

Answer

All inbound traffic is allowed

Answer

All outbound traffic is allowed

Question 13

Refer to the exhibit. A company applies this bucket policy to an S3 bucket. What is the effect of the policy?

Accepted Answer

Only HTTPS requests are allowed, and HTTP requests are denied. The bucket policy uses a Deny effect that blocks any request where SecureTransport is false, which corresponds to HTTP requests. Therefore, only HTTPS requests are allowed, and HTTP requests are denied. Option B is correct.

Answer

All requests are denied

Answer

Only HTTP requests are allowed

Answer

All requests are allowed

Question 14

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets have server-side encryption enabled. Which SCP should be applied to the root OU?

Accepted Answer

Deny s3:PutBucketEncryption unless encryption settings include AES256 or aws:kms. A Service Control Policy (SCP) applied to the root OU can deny the s3:PutBucketEncryption action unless specific encryption settings (AES256 or aws:kms) are used. This prevents any account in the organization from creating or modifying S3 buckets without encryption. Option A is wrong because IAM policies are attached to principals (users/roles), not to OUs, and cannot enforce encryption across all accounts. Option B is wrong because SCPs are applied to OUs or accounts, not to individual resources like S3 buckets. Option D is wrong because AWS Config rules can detect non-compliance but do not enforce via SCPs; they would require an automated remediation action.

Answer

Create an IAM policy that allows s3:PutBucketEncryption only with specific conditions

Answer

Attach an IAM policy to each S3 bucket requiring encryption

Answer

Use AWS Config rules to auto-enable encryption on existing buckets

Question 15

A network engineer is designing a VPC with private subnets for workloads that must not have direct internet access. However, the workloads need to download patches from a specific third-party vendor's IP range. Which solution minimizes the attack surface?

Accepted Answer

Create a managed prefix list for the vendor's IPs and add a route in the private subnet route table to a NAT gateway, with the prefix list as destination. Using a managed prefix list for the vendor's IPs and adding a route to a NAT gateway in the private subnet route table allows traffic only to those specific IPs, minimizing attack surface by avoiding direct internet access. Option B (VPC endpoint) is for AWS services only, not third-party. Option C (proxy server) would allow all internet traffic, not just to the vendor, increasing exposure. Option D (VPN) introduces complexity and potential trust issues, and still might allow other traffic if not carefully restricted.

Answer

Configure a VPC endpoint for the vendor's service

Answer

Deploy a proxy server in a public subnet and configure the workloads to use it for all internet traffic

Answer

Establish a VPN connection to the vendor's network and route all traffic to the vendor through the VPN