ANS-C01 Network Security, Compliance and Governance Practice Question
A financial services company must meet PCI DSS compliance. They have a VPC with public and private subnets. The private subnets host applications that process credit card data. The security team wants to ensure that no data leaves the VPC to the internet except through a controlled egress point. Which THREE measures should be implemented? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a central inspection VPC with AWS Network Firewall to inspect all outbound traffic.
To meet PCI DSS compliance, the company needs to control and inspect outbound traffic from private subnets. Option A is correct because a central inspection VPC with AWS Network Firewall can inspect and control all outbound traffic, providing a controlled egress point. Option B is correct because VPC endpoints for S3 and DynamoDB keep traffic to these services within the AWS network, avoiding the internet. Option E is correct because a NAT gateway allows private subnets to access the internet for necessary updates or patches, but combined with other controls (like Network Firewall) it provides a controlled egress. Option C is incorrect because security groups deny all outbound traffic by default, but that would block all necessary outbound connections, including to AWS services; it does not provide a controlled egress point. Option D is incorrect because an Internet Gateway allows direct outbound access without inspection or control, violating PCI DSS requirements for controlled egress.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a central inspection VPC with AWS Network Firewall to inspect all outbound traffic.
Why this is correct
Correct: Central inspection provides controlled egress with inspection.
- ✓
Create VPC endpoints for Amazon S3 and DynamoDB to keep traffic within the AWS network.
Why this is correct
Correct: VPC endpoints prevent data from leaving AWS network.
- ✗
Configure security groups to deny all outbound traffic from private subnets.
Why it's wrong here
Wrong: Security groups cannot inspect or control egress beyond allow/deny; they would block all outbound, which is not desired.
- ✗
Attach an Internet Gateway to the VPC and allow all outbound traffic.
Why it's wrong here
Wrong: IGW allows uncontrolled egress.
- ✓
Deploy a NAT gateway in a public subnet and route private subnet traffic to it for internet access.
Why this is correct
Correct: NAT gateway is a controlled egress point.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.