CCNA Network Security, Compliance and Governance Questions

AWS WAF Bot Control managed rule group is designed to detect and block requests from bots, including those that use obfuscated payloads. Since the malicious requests have valid tokens but obfuscated payloads, Bot Control can analyze behavior patterns and signature heuristics to identify such traffic. Rate-based rules (option B) are used to limit request rates, not to detect obfuscated payloads.

SQL injection match conditions (option C) detect SQL injection patterns, not general obfuscation. IP set match rules (option D) block or allow based on IP addresses, which is ineffective against obfuscated payloads.

VPC peering does not encrypt traffic natively. To ensure encryption between VPCs, you need to establish an IPsec tunnel, which can be achieved by deploying a third-party VPN appliance in each VPC. Option B is incorrect because a VPN connection using virtual private gateways is typically used to connect a VPC to an on-premises network, not directly between VPCs.

Option C is incorrect because VPC peering does not support enabling encryption on the peering connection itself; encryption must be added via an overlay. Option D is incorrect because AWS Direct Connect is used for dedicated connections to on-premises data centers, not for inter-VPC traffic.

AWS KMS (Key Management Service) is the AWS service that manages encryption keys for Amazon S3. AWS KMS allows you to create, rotate, and control access to encryption keys used to encrypt data at rest in S3. Option A (AWS Secrets Manager) is incorrect because it manages secrets like database credentials, not encryption keys for S3.

Option B (AWS Certificate Manager) is incorrect because it manages SSL/TLS certificates, not encryption keys. Option C (AWS CloudHSM) is incorrect because while it provides hardware security modules for key storage, it is not the default or primary key manager for S3; AWS KMS is the integrated service for S3 encryption.

The most likely reason is that the bucket also has a bucket ACL that grants public read access. When both a bucket policy and an ACL are present, the effective permissions are the union of allowed actions. If the ACL allows everyone to read objects, then the IP restriction in the bucket policy is not effective because the ACL already permits the access.

Option D correctly identifies this scenario. Option A is incorrect because the condition key for source IP is aws:SourceIp, not aws:SourceIpAddress, but that is a minor typo; however, the policy would still be evaluated. Option B is incorrect because bucket policies are evaluated regardless of region.

Option C is incorrect because server-side encryption does not affect policy evaluation.

To route traffic through AWS Network Firewall, you must add a route in the subnet route tables that sends 0.0.0.0/0 traffic to the firewall endpoint's elastic network interface (ENI). This forces outbound traffic to be inspected by the firewall before reaching the internet gateway. Option A is incorrect because a VPC Gateway Endpoint is used for private access to AWS services, not for routing traffic through a firewall.

Option B is incorrect because a NAT gateway provides outbound connectivity but does not inspect traffic; adding another hop to the firewall would be redundant and not supported. Option D is incorrect because a transit gateway is used to connect multiple VPCs or on-premises networks, not to route traffic through a single firewall.

AWS WAF can be associated with an Application Load Balancer to filter incoming traffic based on IP addresses at the edge (before reaching the ALB). Option B is wrong because Network ACLs operate at the subnet level and do not inspect HTTP traffic or block at the edge. Option C is wrong because Security Groups are stateful firewalls that operate at the instance or ENI level, not at the edge, and they cannot block traffic before the ALB.

Option D is wrong because CloudFront is a CDN that can be used with WAF, but the question specifically asks for blocking at the edge before the ALB, and CloudFront alone does not provide IP filtering for an ALB without WAF.

The inbound rule (egress=false) only allows TCP (protocol 6) on port unspecified (all ports), but the outbound rule allows all traffic. However, the inbound rule only allows TCP, so return traffic for non-TCP protocols (like ICMP) is blocked. But the question says connectivity fails, likely because the instance initiates outbound traffic (e.g., HTTP), which is TCP, so that should work.

Actually, the issue is that the outbound rule allows all traffic, but the inbound rule only allows TCP, so return traffic for non-TCP (like UDP or ICMP) is blocked. But typical HTTP uses TCP, so maybe the issue is something else. Let's re-evaluate: The outbound rule allows all traffic (protocol -1), but the inbound rule only allows TCP.

For outbound connections, the return traffic is inbound, so if the outbound connection is TCP, the return TCP packets are allowed by the inbound rule. However, if the outbound traffic is something else like ICMP (ping), the return ICMP is blocked. The question does not specify the protocol.

Option A is correct because the inbound rule only allows TCP, blocking other protocols. Option B is wrong because the outbound rule allows all traffic. Option C is wrong because the security group allows outbound.

Option D is wrong because the inbound rule does not restrict TCP on ephemeral ports; it allows TCP from 0.0.0.0/0.

The most secure approach is to use a bastion host (jump box) in a public subnet. The bastion host's security group restricts SSH access to only the auditor's known IP address. The target EC2 instance's security group allows SSH only from the bastion host's private IP, minimizing direct exposure.

Option A (assigning a public IP to the instance) exposes the instance directly to the internet, even with a restricted security group, increasing attack surface. Option B (allowing SSH from the entire VPC CIDR) is insecure because any compromised resource within the VPC could access the instance. Option D (client VPN) is secure but adds complexity and cost for a temporary single-instance access; the bastion host is simpler and more direct.

VPC Traffic Mirroring allows you to capture and mirror all traffic from the elastic network interfaces (ENIs) of instances in private subnets to a network security appliance (e.g., partner firewall) for deep packet inspection and logging. This meets the requirement for inspecting traffic for malicious activity. Option A is incorrect because AWS Shield Advanced provides DDoS protection but does not provide deep packet inspection or logging of all traffic.

Option B is incorrect because AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at the application layer, not network-level traffic from private subnets. Option C is incorrect because VPC Flow Logs only capture metadata (IP addresses, ports, protocols) and do not inspect packet payloads for malicious activity.

The instance can receive inbound HTTP traffic because the security group ingress rule allows HTTP. However, it cannot initiate outbound traffic to the internet. The security group egress rule allows all traffic, so outbound is not restricted.

The most likely cause is that the instance is in a private subnet without a NAT gateway or route to an internet gateway. Private subnets cannot directly access the internet without a NAT device. Therefore, Option B is correct.

Option A is incorrect because the egress rule is permissive. Option C is incorrect because the security group is properly attached (inbound works). Option D is incorrect because the ingress rule is not the issue.

A Service Control Policy (SCP) applied to the root OU can deny the s3:PutBucketEncryption action unless specific encryption settings (AES256 or aws:kms) are used. This prevents any account in the organization from creating or modifying S3 buckets without encryption. Option A is wrong because IAM policies are attached to principals (users/roles), not to OUs, and cannot enforce encryption across all accounts.

Option B is wrong because SCPs are applied to OUs or accounts, not to individual resources like S3 buckets. Option D is wrong because AWS Config rules can detect non-compliance but do not enforce via SCPs; they would require an automated remediation action.

Using separate route tables for each VPC with a blackhole route pointing to the inspection VPC is not standard; the correct approach is to have a shared route table that propagates routes and uses a static route to the inspection VPC. Option D is correct: associate all VPCs with a single route table that has a default route pointing to the inspection VPC's attachment, and enable route propagation from the inspection VPC. Option A is wrong because it does not force traffic through the inspection VPC.

Option B is wrong because it only inspects traffic from one VPC. Option C is wrong because a blackhole route drops traffic.

A Service Control Policy (SCP) in AWS Organizations can be attached to the root or an OU to deny the creation of S3 buckets that do not use a specific KMS key for encryption. This is a preventive control that applies across all accounts in the organization. Option A (S3 bucket policy) is incorrect because bucket policies are applied at the bucket level after creation and cannot prevent the creation of the bucket.

Option B (IAM policy) is incorrect because IAM policies are per-account and cannot be enforced centrally across all accounts. Option C (AWS Config rule with auto-remediation) is incorrect because Config rules are detective and can only trigger remediation after a non-compliant bucket is created, not prevent the creation.

The most likely cause is that the network ACL (NACL) on the private subnet has an inbound deny rule for port 3306. NACLs are stateless and evaluate rules in order; even though the default NACL allows all traffic, a custom NACL applied to the subnet could have a deny rule that overrides the default allow. This would block the inbound traffic from the application servers to the database on port 3306, preventing connectivity.

Option B is incorrect because security groups are stateful; outbound rules do not affect return traffic for allowed inbound connections. Options A and D are irrelevant to the connectivity issue.

To prefer the Direct Connect path over the VPN for traffic from on-premises to the VPC, the on-premises router should prepend its AS number multiple times for the routes advertised over the VPN connection. This increases the AS path length, making the Direct Connect path more preferred. AWS does not allow manipulation of BGP attributes on the customer side of the Direct Connect or VPN connections, so the change must be made on the on-premises router.

Option A is incorrect because local preference is a Cisco-specific feature and affects outbound traffic, not inbound. Option B is incorrect because VPC route tables only apply to traffic inside the VPC, not to BGP path selection. Option C is incorrect because MED is typically used to influence outbound traffic from AWS to on-premises and is not as effective as AS path prepending for this scenario.

AWS Config with managed rules like restricted-ssh can detect noncompliant security groups, and AWS Config remediation actions can automatically remediate them. AWS Firewall Manager can also centrally manage security group rules across accounts, but it is more about enforcement and policy management. Option A is correct because AWS Config is the primary service for compliance monitoring and remediation.

Option C (AWS Firewall Manager) is also a valid service but is more for policy-based management across accounts; however, the question asks for detection and automatic remediation, which AWS Config does directly. Option D (AWS CloudTrail) is for auditing API calls, not for enforcement. Option B (Amazon GuardDuty) is for threat detection, not security group compliance.

AWS CloudTrail records API calls made to the AWS environment, including calls to modify security group rules (such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, etc.). This provides a detailed audit trail of who made the change, when, and from where. AWS Config can record resource configuration changes and can provide a history of security group rule changes, but it is not the primary service for auditing API calls; it focuses on configuration compliance and resource relationships.

VPC Flow Logs capture metadata about network traffic, not configuration changes. CloudWatch monitors performance metrics and logs. Therefore, CloudTrail is the correct answer.

In AWS, when a VPC route table has both a static route and a propagated route (learned via BGP) for the same destination, the static route takes precedence regardless of the gateway type. In this scenario, the VPN route is a static route pointing to the virtual private gateway, while the Direct Connect route is a propagated route automatically added via BGP from the Direct Connect virtual interface. Therefore, the static route to the VPN gateway is used.

Note that AWS does not allow two static routes with the same destination in the same route table; thus the Direct Connect route must be propagated.

Placing web servers in public subnets with an internet gateway and database servers in private subnets with no direct internet access ensures only the web tier is accessible from the internet. Option A is incorrect because a NAT gateway is used for outbound internet access from private subnets, not for allowing inbound traffic to the database servers. Option C is incorrect because an AWS Site-to-Site VPN is used to connect on-premises networks to a VPC, not to provide internet access to private subnets.

Option D is incorrect because placing database servers in public subnets directly exposes them to the internet; security groups alone do not prevent internet routability, and best practice is to place databases in private subnets.

The bucket policy uses a condition key 's3:x-amz-server-side-encryption' to deny uploads that are not encrypted with SSE-KMS. However, if the upload request does not include the 'x-amz-server-side-encryption' header at all, the condition key is not present in the request, so the condition is not evaluated. As a result, the Deny effect is not applied, and the upload is allowed.

Option A is incorrect because the policy is valid JSON and would be enforced if the condition were met. Option B is incorrect because an explicit Allow in an IAM policy cannot override a Deny in a bucket policy; the Deny would still apply. Option D is incorrect because bucket policies are evaluated regardless of region as long as the bucket is in the same region as the request's endpoint; the region is not the issue here.

Transit Gateway route tables can direct traffic between VPCs through a central inspection VPC by using route propagation and appropriate route table associations. Option A is wrong because VPC peering does not support transitive routing; traffic would need to traverse multiple non-transitive connections, and peering alone cannot force traffic through a centralized firewall. Option B is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; traffic between VPCs would flow directly unless routing forces it through the firewall, which is not described.

Option D is wrong because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing traffic between VPCs through an inspection VPC.

Options A and E are correct. Option A: A central egress VPC with an Internet Gateway and NAT Gateway or firewall is required to route and inspect all internet-bound traffic. Option E: An SCP denying ec2:CreateInternetGateway in all accounts except the central network account prevents other accounts from creating their own Internet Gateways, thereby forcing traffic through the central VPC.

Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/S traffic, not a method to block all internet access at the network level. Option C is incorrect because AWS Direct Connect is for private on-premises connectivity, not for routing internet traffic. Option D is incorrect because VPC endpoints provide private access to AWS services without traversing the internet; they do not enforce internet egress routing.

Options A and C are correct. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, enabling security analysis of traffic patterns. AWS CloudTrail logs API calls to the AWS Management Console and SDKs, providing visibility into user activity and resource changes.

Option B (AWS Config) is incorrect because it evaluates resource configurations for compliance, not network traffic logging. Option D (Amazon Inspector) is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure. Option E (Amazon GuardDuty) is a threat detection service that analyzes data sources like DNS logs and VPC Flow Logs, but it is not itself a logging service for network traffic.

AWS WAF allows you to create an IP set containing the partner IP addresses and then add a rule with a higher priority than the blocking rules to allow traffic from that IP set. This ensures that partner traffic is explicitly allowed even if other rules would block it. Option A is incorrect because Network ACLs operate at the subnet level and are not evaluated by AWS WAF for application-layer traffic; they also do not have a whitelist feature within WAF.

Option B is incorrect because removing blocking rules would leave the application vulnerable; Shield Advanced provides DDoS protection but does not replace WAF rule logic. Option C is incorrect because AWS Shield Advanced does not have an IP whitelist feature; it focuses on mitigating DDoS attacks, not on application-layer allowlisting.

The policy allows anonymous access (Principal: "*") from a specific IP range. However, S3 Block Public Access settings can override bucket policies by blocking any public access. If S3 Block Public Access is enabled at the account or bucket level, it will deny all public access regardless of the bucket policy.

Thus, even though the policy is valid, the Block Public Access setting prevents access. Option D is correct because S3 Block Public Access settings override the policy. Option A is incorrect because the Principal element of "*" is valid for a bucket policy.

Option B is incorrect because the condition correctly restricts to the specified IP range; the issue is broader than IP mismatch. Option C is incorrect because aws:SourceIp is used correctly in the condition.

Security groups act as a virtual firewall for EC2 instances, allowing you to specify outbound rules that restrict traffic to only the necessary destinations, such as the patch server's IP address on HTTPS. This provides granular control over outbound traffic. Option A is incorrect because removing the NAT gateway and attaching an internet gateway to the private subnet would give instances direct internet access, violating the restriction.

Option B is incorrect because an egress-only internet gateway is used for IPv6 traffic only, not IPv4. Option C is incorrect because network ACLs are stateless and apply to the subnet as a whole, making them less suitable for per-instance granular control; they also require rules for return traffic, complicating the configuration.

AWS Config organization conformance packs allow centralized definition of a custom rule to check S3 bucket encryption settings across all accounts. Automatic remediation via Systems Manager Automation can apply the required KMS key to non-compliant buckets without granting the security team data access. Option A is incorrect because it requires per-account AWS Config setup and custom Lambda rules, increasing operational overhead and lacking centralized enforcement.

Option B is incorrect because SCPs cannot enforce encryption settings on existing buckets and only apply to IAM principals, not to S3 service actions like bucket configuration; they also cannot detect or remediate non-compliant configurations. Option D is incorrect because CloudTrail trails only log API calls and cannot proactively detect existing bucket encryption settings; metric filters are reactive and not suitable for continuous compliance monitoring.

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic from the internet. Option A is incorrect because a VPC endpoint for Amazon S3 only provides private access to S3, not general internet access. Option C is incorrect because a VPN connection to an on-premises data center does not provide internet access; it connects to the on-premises network.

Option D is incorrect because attaching an internet gateway to a private subnet's route table would allow direct inbound internet traffic, violating the requirement that database servers must not have direct internet access.

Options A (AWS Network Firewall), B (Service Control Policies), and E (AWS Firewall Manager) are correct. AWS Network Firewall provides stateful inspection to filter traffic across VPCs. Service Control Policies (SCPs) centrally manage permissions and enforce guardrails across all accounts in the organization.

AWS Firewall Manager centrally manages firewall rules, including AWS Network Firewall policies, across accounts. Option C (Security Groups) is incorrect because security groups are per-resource and cannot be centrally managed across accounts. Option D (AWS Config) is incorrect because AWS Config is for compliance monitoring and auditing, not for enforcing network security policies.

AWS CloudTrail records all API calls to AWS services, enabling logging and monitoring. Amazon CloudWatch Events (now Amazon EventBridge) can be configured to trigger notifications based on specific API events, such as creating a security group rule via the ec2:AuthorizeSecurityGroupIngress API call. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls.

Option C is incorrect because AWS Config evaluates resource configuration and compliance, not API call logging; Amazon SNS alone does not provide monitoring capabilities. Option D is incorrect because AWS Shield provides DDoS protection and AWS WAF is a web application firewall, neither of which log API calls.

The ALB security group should allow inbound from 0.0.0.0/0 on ports 80 and 443, and outbound to the web server security group on the application port. The web server security group should allow inbound from the ALB security group on the application port, and outbound to 0.0.0.0/0 on ephemeral ports to allow outbound internet access for updates. Option B correctly describes these rules.

Option A is incorrect because it suggests using NACLs instead, which are stateless and less granular for security group requirements. Option C is incorrect because the ALB outbound rule should allow traffic to web servers, not deny all. Option D is incorrect because the web server inbound should be from the ALB security group, not the VPC CIDR, to ensure only ALB traffic is received.