CCNA Network Security, Compliance and Governance Questions

The correct answers are C, D, and E. AWS Transit Gateway (C) is required to centrally interconnect multiple VPCs and route traffic through a common inspection point. A dedicated inspection VPC (E) hosts the third-party security appliance, segregating inspection traffic from production workloads.

Route tables in the inspection VPC (D) must direct inbound and outbound traffic through the appliance to enforce inspection. Option A is incorrect because VPC Peering does not support centralized inspection and creates a full mesh. Option B is incorrect because NAT Gateways only provide outbound internet access, not inter-VPC traffic inspection.

AWS Transit Gateway enables centralized traffic inspection by attaching VPCs and configuring route tables to route inter-VPC traffic to the security VPC's attachment. Note that the route must point to the security VPC attachment, not a blackhole route (which drops traffic). Option A is incorrect because network ACLs control traffic at the subnet level and cannot route traffic to another VPC.

Option C is incorrect because VPC peering does not provide a centralized inspection point without complex routing. Option D is incorrect because NAT gateways are for outbound internet traffic, not inter-VPC inspection.

Option B. To restrict access to an S3 bucket to only traffic from a specific Direct Connect VIF, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that allows access only from the VPC. Then, configure the VPC route table to route traffic destined for S3 through the Direct Connect VIF, ensuring that only traffic coming through that VIF can reach the endpoint.

Option A is incorrect because the Direct Connect VIF does not have a public IP address; it uses private IPs. Option C is incorrect because network ACLs are stateless and cannot enforce path-specific restrictions; also they operate at the subnet level, not for specific services like S3. Option D is incorrect because Direct Connect VIFs do not have public IP addresses; they use private IPs and traffic goes through private virtual interfaces.

Options A and D are correct. Using security group IDs as source in inbound rules ensures that only instances with the specified security group can communicate, providing fine-grained control. Option A allows web servers to communicate with app servers on port 8080.

Option D allows app servers to communicate with database servers on port 3306. Option B is incorrect because using CIDR blocks is less secure and less granular than using security group IDs. Option C is incorrect because network ACLs are stateless and operate at the subnet level, not at the instance level; security groups are more appropriate for this requirement.

Option E is incorrect because assigning the same security group to all instances would allow all instances to communicate with each other, violating the principle of least privilege.

VPC Peering connections do not support transitive routing. If traffic must pass through an intermediate VPC or on-premises network, the peering connection alone cannot route it. Option B is incorrect because VPC Peering does not require an IAM role for cross-account communication; instead, the accepter must accept the request and route tables must be updated.

Option C is incorrect because security groups are stateful and automatically allow return traffic, and the scenario states security groups allow traffic between CIDRs. Option D is incorrect because the issue is not about NACLs; if NACLs were blocking traffic, the problem would likely be related to stateless filtering, but the question focuses on security groups and routing.

Configuring the application to use TLS ensures end-to-end encryption of data in transit between EC2 instances, meeting the compliance requirement. Option B is incorrect because VPC Flow Logs only capture metadata about traffic (e.g., IP addresses, ports, protocols) and do not encrypt the data itself. Option C is incorrect because AWS Certificate Manager (ACM) provisions certificates but does not automatically encrypt traffic; the application must use those certificates within a TLS configuration.

Option D is incorrect because deploying a VPN connection between instances within the same VPC adds unnecessary complexity and does not automatically encrypt application-layer traffic.

To inspect traffic between subnet A and subnet B, the traffic must be routed through the Network Firewall endpoint. This is achieved by adding a route in subnet A's route table that points to the firewall endpoint's elastic network interface (ENI) for the destination subnet B (10.0.2.0/24), and similarly for subnet B's route table for subnet A (10.0.1.0/24). Additionally, the Network Firewall rule groups must be configured to allow the desired traffic; otherwise, the firewall will block it by default.

Options A, D, and E are incorrect: A (transit gateway) is not needed because both subnets are in the same VPC; D (VPC peering) is unnecessary for intra-VPC traffic; E (security group rule) does not route traffic—security groups are applied at the instance level, not to control traffic between subnets.

AWS Firewall Manager is the correct service for centrally managing and enforcing VPC security group rules across multiple accounts in AWS Organizations. It provides centralized security policy management, allowing you to define common security group rules and automatically apply them to new and existing accounts. AWS Config (Option A) is primarily for compliance auditing and resource configuration history, not enforcement.

AWS CloudFormation StackSets (Option B) can deploy resources across accounts but does not provide ongoing enforcement of security policies. IAM Policies (Option D) control permissions, not security group configurations.

ACM access is controlled via IAM identity-based policies attached to IAM roles, which allow specifying which roles can request, renew, or delete certificates. Option A is incorrect because AWS managed policies are a type of IAM policy, but the question asks for the policy type used to enforce access for specific IAM roles, and AWS managed policies can be used but are not the only type; however, the key point is that identity-based policies are the mechanism. Option B is incorrect because service control policies (SCPs) apply to all accounts in an AWS Organization and cannot target specific IAM roles within an account.

Option D is incorrect because ACM does not support resource-based policies; only IAM policies can be used to control access to certificates.

Storing the CloudHSM security officer (CO) password in AWS Secrets Manager is a security best practice. Secrets Manager provides secure storage, automatic rotation, and fine-grained access control for sensitive credentials, reducing the risk of exposure. Option A is incorrect because disabling two-factor authentication would weaken the security posture of the HSM.

Option B is incorrect because AWS KMS cannot rotate CloudHSM partition passwords; KMS manages encryption keys, not HSM passwords. Option D is incorrect because granting AWS support access would compromise the customer-managed security model of CloudHSM, where only the customer controls the HSM cluster.

An SCP applied at the root OU can deny ec2:RunInstances when the request includes a public IP address, using the ec2:AssociatePublicIpAddress condition key, and can further limit based on VPC using conditions like ec2:Vpc. This centrally prevents non-compliant EC2 launches across all accounts. Option B is incorrect because IAM policies must be attached to each user/role individually and do not scale across accounts; SCPs are designed for this purpose.

Option C is incorrect because AWS Config can detect non-compliant instances but cannot prevent the initial launch. Option D is incorrect because CloudWatch Events can trigger actions after launch but does not prevent the launch itself.

The most likely cause is that DNS validation failed during renewal. ACM attempts to automatically renew public certificates using DNS validation when the domain is in Route 53. If the DNS validation fails (e.g., due to incorrect CNAME record or permissions), the certificate will not be renewed, and the ALB will continue to serve the old certificate.

Option B is incorrect because ACM automatically redeploys renewed public certificates to associated resources such as ALB listeners; no manual update is required. Option A is incorrect because ACM handles renewal and does not require import. Option C is incorrect because the certificate is public, not private.

The policy has two allow statements: one for source IP range and one for source VPC. The EC2 instance's source IP (198.51.100.10) is not in the allowed IP range (203.0.113.0/24). The second statement allows requests from the VPC, but the condition aws:SourceVpc is only present when the request comes through a VPC endpoint (Gateway or Interface endpoint).

If the EC2 instance accesses S3 via the internet (public IP), the aws:SourceVpc condition is not satisfied, so the second statement does not apply. The first statement does not allow the IP, resulting in implicit deny. Option A is wrong because the policy allows GetObject.

Option C is wrong because the policy does not require both conditions. Option D is wrong because there is no explicit deny.

AWS Verified Access is the correct service because it provides secure access to corporate applications hosted in a VPC without requiring a VPN, and it integrates with identity providers such as Active Directory for authentication and fine-grained access control. Option A (AWS SSO) is designed for federating access to AWS accounts and applications, not for securing access to internal VPC-based applications without a VPN. Option C (AWS Client VPN) requires VPN client software and a VPN connection, which does not meet the requirement of not using a VPN.

Option D (Application Load Balancer with OIDC authentication) can authenticate users but typically requires the ALB to be publicly accessible or connected via VPN, and it does not provide the same purpose-built zero-trust access capabilities as Verified Access.

Referencing security group A as the source allows inbound traffic on port 3306 from any instance associated with security group A, which is the most specific and secure method. This approach automatically adapts if instances in security group A change IP addresses. Option A is wrong because it allows traffic from any instance in the specified subnet, not just those that need to communicate.

Option B is wrong because it allows traffic from all IP addresses, violating the principle of least privilege. Option C is wrong because it ties the rule to a single instance's IP address, which can change and requires updates if the instance is replaced.

The correct answers are C and E. Option C uses security groups to control traffic between tiers: the web tier security group allows HTTP/HTTPS from 0.0.0.0/0, and the app and database tier security groups only allow traffic from the web tier security group. This ensures that the application and database tiers are not directly accessible from the internet.

Option E places the web tier in a public subnet with an internet gateway in its route table, so it can receive inbound traffic from the internet. The app and database tiers are placed in private subnets without a direct route to the internet gateway, so they cannot be accessed from the internet. Option A is incorrect because a VPC Gateway Endpoint is used for private connectivity to AWS services like S3 or DynamoDB, not for internet access.

Option B is incorrect because a NAT gateway provides outbound internet access for private subnets, not inbound internet access to the web tier. Option D is incorrect because placing all tiers in a public subnet exposes the application and database tiers to the internet, even with restrictive security groups, because they would still have a route to the internet gateway.

The correct approach to block outbound traffic to known malicious IPs involves a combination of routing and stateful firewall inspection. Option B is correct because updating the VPC route table to send traffic for the malicious IPs to a network firewall appliance (e.g., AWS Network Firewall) enables centralized inspection and blocking. Option C is correct because deploying AWS Network Firewall provides stateful, application-layer inspection that can handle allow/deny rules for specific IPs.

Option D is correct because a firewall rule within AWS Network Firewall can explicitly deny traffic to the malicious IPs. Option A is incorrect because network ACLs are stateless and require individual rules for each IP, making them impractical for dynamic blocklists. Option E is incorrect because security groups support only allow rules, not explicit deny; they cannot block specific IPs outbound.

A security group on the EC2 instance with an outbound rule allowing HTTPS (port 443) is the correct configuration. Security groups are stateful, so the outbound rule automatically permits the return traffic, requiring no explicit inbound rule. This ensures only outbound HTTPS is allowed from the instance.

Option C is incorrect because network ACLs are stateless and would require explicit inbound rules for return traffic, but more importantly, NACLs are subnet‑level controls and are not the best practice for restricting traffic from a single instance. Option B is incorrect because VPC gateway endpoints are for private connectivity to AWS services, not for internet access. Option D is incorrect because a security group on the NAT gateway would control the NAT gateway's own traffic, not the instance behind it.

The Network Access Analyzer report indicates that the EC2 instance in a private subnet has an unintended route to an internet gateway. To remediate this, two actions are needed: (1) Remove the route to the internet gateway from the subnet's route table, which eliminates the direct path to the internet. (2) Ensure the EC2 instance does not have a public IP address, because even without a route, a public IP could allow direct internet access via the internet gateway. Option A directly addresses the public IP, and option B fixes the route table.

Options C (assigning a public IP) would worsen the issue. Option D (updating security group to deny outbound 0.0.0.0/0) does not affect routing and would not remove the internet gateway route. Option E (attaching a NAT gateway) would add another internet route, not remove the existing one.

AWS WAF is a web application firewall that can inspect HTTP/S traffic and block requests based on conditions such as IP addresses. By creating an IP set containing the malicious IPs and associating it with a web ACL on the ALB, the security team can block those IPs at the application layer. This is more granular and efficient than network-level controls.

Option A (Network ACLs) are stateless and operate at the subnet level, not designed for application-layer filtering, and would require managing deny rules that conflict with the default allow. Option C (AWS Shield Advanced) provides DDoS protection and cost protection, but does not offer granular IP blocking based on a custom list. Option D (Security Groups) are stateful firewalls that only support allow rules; they cannot deny specific IP addresses.

S3 bucket policies can use the aws:SourceVpc condition key to restrict access to requests originating from a specific VPC. Option A is wrong because IAM policies are attached to users, roles, or groups, not to the bucket itself, and they cannot restrict based on VPC directly. Option B is wrong because security groups cannot be attached to S3 buckets; they are used for EC2 instances and other resources.

Option D is wrong because a VPC Endpoint policy controls what actions are allowed through the endpoint, but it does not restrict access based on the source VPC; the bucket policy is required for that.

The inbound deny rule (Rule 100) for TCP (Protocol 6) from 0.0.0.0/0 denies all TCP traffic, including HTTP on port 80. Network ACLs evaluate rules in ascending order, so this deny rule is evaluated before any allow rules. Even though Rule 200 allows all traffic, the deny rule takes precedence because it comes first.

Therefore, inbound HTTP traffic from the internet is blocked. Option A is incorrect because the subnet association does not affect the rule order; the deny rule applies to the subnet. Option C is incorrect because the outbound rule allows all traffic, so return traffic is not the issue.

Option D is incorrect because the allow rule is wide enough (all traffic), but it is evaluated after the deny rule.

Amazon Route 53 Resolver Query Logging (Option A) logs all DNS queries that are forwarded by the Route 53 Resolver within a VPC. Amazon Route 53 Resolver DNS Firewall (Option C) provides DNS filtering and can log DNS queries that match the firewall rules. Both are valid AWS solutions for logging DNS queries from EC2 instances.

Option B (AWS CloudTrail) logs API calls, not DNS queries. Option D (Amazon CloudWatch Logs with a custom agent) is not a native AWS service for DNS logging; it requires custom configuration and is not a managed solution. Option E (VPC Flow Logs) captures IP traffic metadata, not DNS queries.

A NAT gateway in a public subnet allows instances in private subnets to access the internet while hiding their private IPs. By controlling the outbound rules in the security group or using a network firewall, you can restrict traffic to specific API endpoints. AWS CloudWatch Logs or VPC Flow Logs can capture the NAT gateway logs.

Option A is incorrect because a VPC endpoint is used for accessing AWS services privately and cannot be used for internet API access. Option B is incorrect because attaching an internet gateway directly to the private subnet would expose the instances' private IPs to the internet. Option C is incorrect because while a proxy server could work, it adds unnecessary complexity and management overhead compared to a NAT gateway.

Network ACLs can be configured to block all traffic except encrypted protocols like IPSec, thereby enforcing encryption at the subnet level. Option C is correct: A VPC CNI plugin that supports encryption can enforce encryption for pods in Kubernetes clusters, which is relevant for containerized workloads in the VPC. Option B is incorrect: VPN connections are established between VPCs or between a VPC and on-premises networks, not between subnets within the same VPC.

It is not possible to set up VPN connections between subnet route tables. Option D is wrong: Security groups only filter traffic based on IP addresses and ports; they cannot inspect or enforce encryption of the traffic content. Option E is wrong: VPC Flow Logs only log metadata about traffic and cannot enforce or detect whether the traffic payload is encrypted.

Therefore, the correct steps are A and C.

The most cost-effective solution because a Gateway VPC Endpoint for S3 provides private connectivity to S3 without any hourly charges, and it does not require a NAT Gateway or Internet Gateway. Option A is incorrect because an Internet Gateway would route traffic through the internet, which violates the requirement and is not cost-effective. Option C is incorrect because an Interface VPC Endpoint for S3 incurs hourly charges, making it more expensive than a Gateway Endpoint.

Option D is incorrect because a NAT Gateway also incurs hourly and data processing charges, and it routes traffic through the internet, which is not desired.

Options A, D, and E are correct network access control mechanisms. Option A is correct because security groups can allow traffic based on source security group IDs, enabling tier-specific access. Option D is correct because network ACLs provide stateless filtering at the subnet level, adding a layer of defense.

Option E is correct because security groups can reference other security groups as sources, allowing the database tier to accept traffic only from the application tier security group. Option B is incorrect because AWS WAF is a web application firewall that filters HTTP/HTTPS traffic at the application layer, not suitable for database tier access control. Option C is incorrect because IAM policies manage user and resource permissions, not network-level traffic filtering.

AWS Config allows you to define and enforce rules that evaluate resource configurations across accounts, and you can aggregate compliance data centrally using Config aggregators. AWS Organizations enables you to apply service control policies (SCPs) to centrally manage permissions across all accounts in the organization. Option B (VPC Flow Logs) captures IP traffic metadata but does not enforce security policies.

Option C (CloudTrail) records API activity for auditing, not policy enforcement. Option D (IAM) manages permissions but is per-account and not designed for centralized policy management across multiple accounts.

The users in 10.1.0.0/16 are likely accessing the bucket through a NAT Gateway, which translates their private source IPs to the NAT's public IP. The bucket policy uses 'aws:SourceIp' with the condition '10.1.0.0/16', but after NAT, the source IP is no longer in that range, causing access to be denied. Option A is incorrect because the condition key 'aws:SourceIp' is appropriate; the problem is the IP after translation.

Option C is incorrect because the resource ARN is specified correctly. Option D is incorrect because bucket policies can be written without a principal to apply to all principals; it's valid.

Configuring the RDS DB instance to require SSL/TLS connections ensures that the application encrypts data in transit when connecting to the database. This is the most secure way to enforce encryption for traffic between EC2 and RDS. Option A is incorrect because IAM database authentication controls access, not encryption.

Option B is incorrect because a security group rule allowing only port 443 does not enforce encryption; it only restricts traffic to that port. Option D is incorrect because placing both resources in the same subnet does not enforce encryption, and a network ACL is stateless and cannot enforce encryption.

VPC Flow Logs capture IP traffic information for network interfaces and can be published to Amazon CloudWatch Logs or Amazon S3. This allows logging of all traffic between EC2 instances in different subnets. Option B is incorrect because AWS CloudTrail logs API calls and actions taken on AWS resources, not network traffic.

Option C is incorrect because VPC Traffic Mirroring copies traffic for deep packet inspection and analysis, but it is not a logging service; it is used for traffic monitoring and security analysis. Option D is incorrect because AWS Config tracks resource configuration changes and evaluates compliance, not network traffic.

AWS Transit Gateway enables transitive routing between VPCs. By creating a route table in the Transit Gateway with a default route (0.0.0.0/0) pointing to the firewall VPC attachment, all internet-bound traffic from the source VPC is forwarded to the firewall for inspection before reaching the internet. Option B (VPC Gateway Endpoint) is incorrect because Gateway Endpoints are used for privately accessing AWS services (like S3 or DynamoDB) from a VPC, not for routing traffic to a third-party firewall.

Option C (AWS PrivateLink) is incorrect because PrivateLink allows you to access services hosted in other VPCs via Network Load Balancers and ENIs, but it does not provide transitive routing for internet-bound traffic. Option D (VPC Peering) is incorrect because VPC peering connections do not support transitive routing; you cannot route traffic from one VPC through a peered VPC to another destination.

To restrict traffic from a specific on-premises subnet to a specific VPC subnet using AWS Direct Connect, you need two components. First, a private virtual interface (VIF) is required because it provides connectivity to VPCs (as opposed to public or transit VIFs). Second, route tables with specific routes must be configured on both the on-premises router and the VPC route tables to ensure that traffic is directed to the correct destination subnet.

Option B (Route tables with specific routes) and Option D (Private virtual interface) are correct. Option A (VPN connection) is not needed because Direct Connect itself provides the private connectivity. Option C (Public virtual interface) is incorrect as it is used for accessing public AWS endpoints, not VPC subnets.

Option E (Transit virtual interface) is used for connecting to multiple VPCs via a transit gateway, not for a single VPC subnet.

To ensure the EC2 instances only accept traffic from the ALB, the security group should reference the ALB's security group as the source. This is a best practice because the ALB acts as a proxy, and using its security group dynamically allows traffic from any ALB instance, even if the ALB's IP addresses change. Option A is insecure as it allows traffic from any source (0.0.0.0/0).

Option C is not recommended because the ALB's private IP addresses can change (e.g., during scaling or replacement), making static IP rules difficult to maintain. Option D is too broad, as it would allow traffic from any resource within the VPC CIDR, not just the ALB.

Transit Gateway with appliance mode and a dedicated inspection VPC is the correct architecture because it enables symmetric routing, forcing traffic through the inspection VPC for centralized inspection. Option A (AWS PrivateLink) is incorrect; PrivateLink provides private connectivity to services, not traffic inspection between VPCs. Option B (AWS Network Firewall in each VPC) is incorrect because deploying a firewall in each VPC is distributed, not centralized, and does not leverage Transit Gateway.

Option C (VPC peering) is incorrect because VPC peering does not support transitive routing; peering each VPC to an inspection VPC would be complex and does not take advantage of Transit Gateway's centralized routing capabilities.

AWS Shield Advanced integrates with Amazon CloudWatch to publish metrics and events. These events can be routed via Amazon EventBridge to trigger an Amazon SNS topic, which then sends notifications (e.g., email, SMS) to the security team. Option A (AWS Lambda) is a compute service, not a notification service.

Option B (AWS Config) is used for configuration auditing and compliance, not notifications. Option C (Amazon SQS) is a message queue service; although it can receive events, it is not the service used to send direct notifications to subscribers. Only Amazon SNS (Option D) provides push-based notifications to endpoints like email, SMS, and mobile devices.

A NAT Gateway in the public subnet allows the EC2 instance in the private subnet to initiate outbound connections to the internet for patching while preventing unsolicited inbound traffic, thus minimizing the attack surface. Option A is incorrect because a proxy server adds unnecessary complexity and overhead compared to a managed NAT Gateway, and it still requires careful configuration to minimize attack surface. Option B is incorrect because an Internet Gateway cannot be attached directly to a private subnet; it is attached to the VPC and requires a public subnet for route propagation.

Option D is incorrect because a VPN connection is designed for hybrid connectivity to on-premises networks, not for general internet access from a VPC.

Referencing the ALB security group by ID in the target security group inbound rule allows traffic only from that specific security group, ensuring that only the ALB can reach the targets. This is a best practice for securing traffic between an ALB and its targets. Option A is incorrect because allowing HTTP from 0.0.0.0/0 would permit traffic from any source, not just the ALB.

Option C is incorrect because the ALB's traffic originates from its elastic network interfaces (ENIs), which are associated with the ALB security group, not a fixed public IP. Option D is incorrect because allowing traffic from the entire VPC CIDR would permit any resource in the VPC to reach the targets, not just the ALB.