ANS-C01 Network Security, Compliance and Governance — Timed 10 Questions

Question 1

A company has a hybrid network with an AWS Direct Connect connection to a VPC. They also have a site-to-site VPN connection as a backup. The VPC routing tables are configured with a route to the on-premises CIDR via the virtual private gateway. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect connection even when it is healthy. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

The VPC route table has a more specific route pointing to the VPN connection. When both Direct Connect and VPN are configured, the VPC route table typically has a single route to the on-premises CIDR via the virtual private gateway. Without more specific routing, the VPN BGP route may be preferred depending on route propagation and prefix matching. Option B is wrong because the VPN connection being down would not cause traffic to avoid Direct Connect. Option C is wrong because the Direct Connect virtual interface must be in the 'Available' state to pass traffic. Option D is wrong because the AWS Site-to-Site VPN connection uses a virtual private gateway or transit gateway, not a Customer Gateway as the target.

Answer

The VPN connection is down

Answer

The VPN connection is attached to a Customer Gateway

Answer

The Direct Connect virtual interface is in the 'Down' state

Question 2

A company uses AWS Shield Advanced for DDoS protection. During an attack, the security team notices that legitimate traffic is being throttled. They want to allow certain known IP addresses to bypass Shield Advanced rate-based rules. What should they do?

Accepted Answer

Create an AWS WAF rule with an IP set that allows the known IPs, and place it before the rate-based rule. AWS WAF rules can be configured with IP sets to allow traffic from specific IPs before applying rate-based rules. Option A is wrong because Shield Advanced does not support custom allow lists directly; it works with WAF. Option B is wrong because disabling rate-based rules would remove protection for all traffic. Option D is wrong because Shield Advanced does not have a bypass feature; it uses WAF for custom rules.

Answer

Disable rate-based rules during the attack

Answer

Use Shield Advanced automatic application layer DDoS mitigation

Answer

Create an allow list in AWS Shield Advanced to exempt the IPs from all protections

Question 3

Refer to the exhibit. A network engineer is troubleshooting connectivity issues from an EC2 instance in subnet-11111111. The instance can send traffic outbound, but cannot receive inbound HTTPS traffic from the internet. What is the likely cause?

Accepted Answer

The inbound rule only allows HTTPS, but the outbound rule allows all traffic; this is correct. The NACL inbound rule allows HTTPS (port 443) from 0.0.0.0/0, and the outbound rule allows all traffic. NACLs are stateless, so the outbound all-traffic rule correctly permits response traffic using ephemeral ports (1024–65535). Therefore, the NACL configuration is correct for inbound HTTPS traffic. The issue must lie elsewhere, such as the instance's security group not allowing inbound HTTPS, or a missing internet gateway route. Option C is correct because it acknowledges that the NACL is not misconfigured, which is the likely scenario given the exhibit.

Answer

The NACL is not associated with the correct subnet

Answer

The inbound rule should also allow ICMP traffic

Answer

The outbound rule should restrict traffic to only ephemeral ports

Question 4

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. The security team wants to minimize the attack surface. Which design should they choose?

Accepted Answer

Place the web tier in public subnets with an internet gateway, and the app and DB tiers in private subnets. Use security groups to allow traffic only from the web tier to the app tier and from the app tier to the DB tier.. It follows best practices by placing the web tier in public subnets for direct internet access via an internet gateway, and isolating the application and database tiers in private subnets. Security groups are used to allow traffic only from the web tier to the app tier and from the app tier to the DB tier, implementing least privilege. Option B is wrong because placing all tiers in private subnets with only a NAT gateway does not provide inbound internet access to the web tier; NAT gateway only supports outbound traffic. Option C is wrong because placing all tiers in the same subnet with a single security group violates the principle of least privilege, allowing unnecessary communication between tiers. Option D is wrong because placing all tiers in public subnets exposes the app and DB tiers to the internet, increasing the attack surface, and network ACLs are stateless and less flexible than security groups for controlling traffic between tiers.

Answer

Place all tiers in private subnets and use a NAT gateway for internet access.

Answer

Place all tiers in the same subnet and use a single security group for all instances.

Answer

Place all tiers in public subnets and use network ACLs to restrict inbound traffic to the app and DB tiers.

Question 5

A company wants to secure data at rest in an Amazon S3 bucket. Which TWO of the following can be used to achieve this? (Choose two.)

Accepted Answer

Enable server-side encryption (SSE-S3) on the bucket.. Server-side encryption (SSE-S3) and bucket policies that deny uploads without encryption both enforce encryption of data at rest in S3. Option A enables SSE-S3, which encrypts data automatically. Option C uses a bucket policy to require encryption on uploads, ensuring data is encrypted at rest. Option B (VPC endpoint) provides private connectivity but does not encrypt data at rest. Option D (client-side encryption) is a valid encryption method, but it is not managed by S3 and is not one of the two selected answers. Option E (Transfer Acceleration) improves transfer speed, not security.

Answer

Use an S3 VPC endpoint.

Answer

Use client-side encryption with AWS KMS.

Answer

Enable S3 Transfer Acceleration.

Question 6

A security engineer created the S3 bucket policy shown. After applying it, users from the 10.0.0.0/16 network (VPC CIDR) are able to access objects, but external users from 203.0.113.0/24 receive 'Access Denied' even though they are using HTTPS. What is the likely cause?

Accepted Answer

The VPC endpoint policy for the S3 endpoint restricts access to the bucket.. The bucket policy allows access from both the VPC CIDR (10.0.0.0/16) and the external IP range (203.0.113.0/24) when using HTTPS. However, external users are likely accessing the bucket through a VPC endpoint (e.g., Gateway Endpoint), not directly over the internet. When traffic goes through a VPC endpoint, the effective policy is the intersection of the bucket policy and the VPC endpoint policy. If the VPC endpoint policy restricts access (e.g., denies all or requires specific source VPCs), then even though the bucket policy allows the external IP, the endpoint policy denies it. This explains the 'Access Denied' for external users who are routed through the VPC endpoint. Option A correctly identifies this cause. Options B, C, and D are incorrect because the bucket policy itself is not the issue; the problem lies with the additional restriction imposed by the VPC endpoint policy.

Answer

The policy only allows 's3:GetObject' but the users are trying to list objects.

Answer

The policy does not include a 'Deny' statement for non-IP ranges.

Answer

The S3 bucket has 'Block public access' enabled, which overrides the policy.

Question 7

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet that needs to access an S3 bucket in the same region. Which approach provides the most secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 provides private connectivity to S3 without leaving the AWS network, at no additional cost. Option B is incorrect because using an Internet Gateway with a public IP would expose the instance to the internet and incur data transfer costs. Option C is incorrect because a VPN connection to on-premises adds unnecessary complexity and cost for accessing a service within the same region. Option D is incorrect because a NAT Gateway would require a public IP and incur costs, and S3 traffic would still traverse the internet; a Gateway Endpoint is more secure and cost-effective.

Answer

Use an Internet Gateway and a public IP

Answer

Set up a VPN connection to on-premises and access S3 via that

Answer

Use a NAT Gateway and route traffic through it

Question 8

A network security engineer is reviewing the NACL configuration. An EC2 instance in the subnet associated with this NACL is not receiving SSH connections from the internet. What is the issue?

Accepted Answer

The rule order is incorrect; the deny rule should have a lower rule number than the allow rule to effectively block traffic. NACL rules are evaluated in ascending order, and the first rule that matches the traffic determines the action. In this exhibit, rule 100 allows SSH traffic from 0.0.0.0/0, and rule 200 denies SSH traffic from 0.0.0.0/0. Since rule 100 is evaluated first and matches, the SSH traffic is allowed. The deny rule is never evaluated. However, the engineer likely intended to block SSH traffic, but due to the rule order, the allow rule takes precedence. To effectively block SSH, the deny rule should have a lower rule number (e.g., 100) than the allow rule (e.g., 200). This is the issue: the rule order is incorrect. The other options are not valid: Option A is not supported by the exhibit; Option B is false because protocol 6 is TCP, correct for SSH; Option D is false because port 22 is correct for SSH.

Answer

The NACL is not associated with the subnet

Answer

The protocol is incorrect; SSH uses TCP, but protocol 6 is for ICMP

Answer

The port range is incorrect; SSH uses port 22, but the rule allows port 22

Question 9

A security engineer is designing a network ACL for a public-facing web application in a VPC. The application uses an Application Load Balancer (ALB) in a public subnet, web servers in private subnets, and an RDS database in a private subnet. The engineer needs to allow HTTPS traffic from the internet to the ALB, and allow the ALB to forward traffic to the web servers on port 8080. The web servers need to query the database on port 3306. Which network ACL configuration should the engineer implement for the private subnet containing the web servers?

Accepted Answer

Inbound: allow 0.0.0.0/0 on port 8080; Outbound: allow 0.0.0.0/0 on all ports. The most correct because it allows inbound traffic on port 8080 from the internet (which is the port the ALB forwards to the web servers) and outbound traffic on all ports, enabling web servers to respond to the ALB (via ephemeral ports) and query the database on port 3306. Although allowing inbound from 0.0.0.0/0 is not as restrictive as using the ALB subnet CIDR, it is still functional since the web servers are in a private subnet with no direct internet route. Option C is incorrect because its outbound rule only allows traffic to the database subnet on port 3306, missing the required outbound rules for HTTP responses to the ALB (ALB subnet CIDR on ephemeral ports).

Answer

Inbound: allow 0.0.0.0/0 on port 3306; Outbound: allow 0.0.0.0/0 on port 8080

Answer

Inbound: allow ALB subnet CIDR on port 8080 and ephemeral ports; Outbound: allow database subnet CIDR on port 3306

Answer

Inbound: allow 0.0.0.0/0 on port 443; Outbound: allow 0.0.0.0/0 on port 3306

Question 10

A company has a requirement to encrypt all data in transit between its on-premises network and AWS over a VPN connection. Which solution provides encryption in transit?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN uses IPsec tunnels to encrypt data in transit. Option B is wrong because Transit Gateway alone does not provide encryption. Option C is wrong because VPC Peering does not encrypt traffic. Option D is wrong because Direct Connect does not natively encrypt traffic; encryption must be added at the application layer.

Answer

AWS Transit Gateway

Answer

VPC Peering

Answer

AWS Direct Connect