Courseiva

CCNA Network Security, Compliance and Governance Questions

75 of 397 questions · Page 5/6 · Network Security, Compliance and Governance · Answers revealed

Practice these questionsDomain overviewAll questions
301
MCQeasy

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which policy type should be used?

A.Configure a VPC endpoint policy
B.Configure a network ACL to block all traffic except from the VPC CIDR
C.Use an S3 access point with a network origin condition
D.Attach an S3 bucket policy with a condition for aws:SourceVpc
AnswerD

Bucket policies with aws:SourceVpc condition restrict access to traffic originating from the specified VPC.

Why this answer

S3 bucket policies support condition keys like `aws:SourceVpc` to restrict access to traffic originating from a specific VPC. Option D is correct because attaching a bucket policy with this condition directly limits access to the desired VPC. Option A is incorrect because a VPC endpoint policy controls actions allowed via the endpoint, but does not replace the need for a bucket policy.

Option B is incorrect because network ACLs operate at the subnet level and cannot enforce S3 access restrictions. Option C is incorrect because while S3 access points can have policies, they are not the primary method for restricting access by VPC; a bucket policy with the `aws:SourceVpc` condition is the appropriate approach.

Practice this question →
302
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket for backups. The company wants to minimize data transfer costs and avoid traversing the internet. Which solution should be used?

A.Create a VPC Gateway Endpoint for S3 and attach a bucket policy allowing access from the VPC
B.Set up a proxy server in the public subnet and configure the EC2 instance to use it
C.Create a VPC Interface Endpoint for S3 and associate it with the private subnet
D.Place the EC2 instance in a public subnet with a public IP and use a NAT gateway
AnswerA

Cost-effective and private.

Why this answer

A VPC Gateway Endpoint for S3 provides private connectivity to S3 from within the VPC without needing an internet gateway, NAT gateway, or VPN. This minimizes data transfer costs and avoids internet traversal. Option A (Gateway Endpoint) is the correct solution.

Option B (proxy server) introduces additional complexity and cost, and does not avoid internet traversal. Option C (Interface Endpoint) is more expensive and is not necessary because S3 supports Gateway Endpoints. Option D (public subnet with NAT) requires the instance to have a public IP and uses a NAT gateway, which incurs costs and uses the internet.

Practice this question →
303
Multi-Selectmedium

A company is using AWS Organizations and wants to centrally manage and enforce the use of VPC endpoints for S3 across all accounts. Which THREE services/tools can be combined to achieve this?

Select 3 answers
A.VPC Flow Logs
B.AWS Config rules
C.AWS CloudFormation StackSets
D.AWS Service Control Policies (SCPs)
E.AWS Transit Gateway
AnswersB, C, D

Config rules can evaluate whether VPC endpoints exist and trigger remediation.

Why this answer

To centrally manage and enforce the use of VPC endpoints for S3 across all accounts in AWS Organizations, you can combine AWS Service Control Policies (SCPs) to allow or deny VPC endpoint creation at the organizational level, AWS CloudFormation StackSets to deploy VPC endpoints consistently across multiple accounts, and AWS Config rules to detect non-compliant resources such as missing VPC endpoints. Option B (AWS Config rules) is correct because it can evaluate compliance and trigger remediation. Option C (AWS CloudFormation StackSets) is correct because it automates deployment of VPC endpoints in target accounts.

Option D (AWS SCPs) is correct because it enforces policies on endpoint creation. Option A (VPC Flow Logs) is wrong because it only logs traffic, not enforce policies. Option E (AWS Transit Gateway) is wrong because it provides network connectivity, not endpoint management.

Practice this question →
304
Multi-Selectmedium

A company is designing a security group configuration for a three-tier web application (web, application, database). The web tier is accessible from the internet. Which TWO rules should be applied to meet security best practices?

Select 2 answers
A.App tier security group: inbound from 0.0.0.0/0 on port 8080.
B.Database tier security group: inbound from the web tier security group on port 3306.
C.App tier security group: inbound from the web tier security group on port 8080.
D.Web tier security group: inbound from 0.0.0.0/0 on port 443.
E.Database tier security group: inbound from 0.0.0.0/0 on port 3306.
AnswersC, D

The app tier should only accept traffic from the web tier.

Why this answer

In a three-tier architecture, the web tier should be accessible from the internet, so the web tier security group should allow inbound traffic on port 443 (HTTPS) from 0.0.0.0/0 (option D). The application tier should be accessible only from the web tier, so its security group should allow inbound traffic on port 8080 from the web tier security group (option C). The database tier should be accessible only from the application tier, not directly from the web tier or internet.

Therefore, options C and D meet best practices.

Practice this question →
305
MCQmedium

A company uses AWS WAF to protect its web application from common exploits. The security team notices that a specific IP address is generating a high volume of requests and should be blocked immediately. Which action should be taken?

A.Update the AWS WAF IP set rule to block the IP address
B.Add a rule to the security group to deny traffic from that IP
C.Add a network ACL rule to deny traffic from that IP in the subnet
D.Use AWS CloudFront geo-restriction to block the IP
AnswerA

WAF can block specific IPs at the application layer.

Why this answer

AWS WAF allows creating IP set rules to block specific IP addresses. Therefore, the correct action is to update the IP set rule to include the problematic IP. Option A is correct.

Option B is wrong because security groups operate at the network layer and are not integrated with WAF. Option C is wrong because NACLs are stateless and not suitable for application-layer blocking. Option D is wrong because CloudFront geo-restriction blocks based on geographic location, not individual IPs.

Practice this question →
306
MCQeasy

A security group is configured as shown. An EC2 instance in the same VPC with IP 10.0.1.50 can connect to the instance on port 443. An on-premises client with IP 203.0.113.5 cannot connect. What is the most likely reason?

A.The security group's outbound rules block return traffic
B.The protocol is incorrect; HTTPS uses UDP
C.The security group only allows traffic from the 10.0.0.0/16 CIDR
D.The security group has a deny rule for the on-premises IP
AnswerC

On-premises IP is not in that range.

Why this answer

The security group inbound rule only allows traffic from the 10.0.0.0/16 CIDR block. The on-premises client IP (203.0.113.5) is outside that range, so the connection is implicitly denied. Option A is incorrect because security groups are stateful, so return traffic is allowed automatically.

Option B is incorrect because HTTPS uses TCP, not UDP. Option D is incorrect because security groups do not support explicit deny rules; they only have allow rules, and any traffic not matching an allow rule is implicitly denied.

Practice this question →
307
MCQmedium

A company uses AWS Transit Gateway to connect multiple VPCs. Security requirements mandate that traffic between VPCs must be inspected by a centralized firewall appliance in a dedicated inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?

A.Deploy AWS Network Firewall in each VPC and configure central logging
B.Use Transit Gateway multicast to replicate traffic to the inspection VPC
C.Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment
D.Create VPC peering connections between all VPCs and the inspection VPC, then configure route tables to send traffic through the peering connection
AnswerC

This is correct because using blackhole routes in Transit Gateway route tables blocks direct inter-VPC communication, and a default route to the inspection VPC attachment ensures all traffic between VPCs is sent through the inspection VPC for centralized inspection.

Why this answer

Configuring Transit Gateway route tables with blackhole routes for inter-VPC traffic forces that traffic to be dropped unless a more specific route exists. By adding a default route pointing to the inspection VPC attachment, all inter-VPC traffic is routed through the inspection VPC for centralized firewall inspection. This approach is efficient and scalable.

Option A is incorrect because deploying AWS Network Firewall in each VPC distributes inspection and does not centralize it. Option B is incorrect because Transit Gateway multicast is designed for one-to-many data replication, not for routing traffic through a central inspection point. Option D is incorrect because VPC peering connections do not provide centralized routing control and do not scale well as the number of VPCs increases.

Practice this question →
308
Multi-Selectmedium

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The security team needs to centrally manage and enforce network security policies across all accounts. Which TWO services or features can be used to centrally enforce network security controls? (Choose TWO.)

Select 2 answers
A.AWS Network Firewall
B.Network ACLs
C.AWS Firewall Manager
D.VPC Flow Logs
E.VPC security groups with cross-account references
AnswersA, C

Network Firewall can be centrally deployed and managed using Firewall Manager.

Why this answer

AWS Network Firewall is a managed, stateful firewall service that provides application-layer filtering and intrusion prevention for VPCs. AWS Firewall Manager offers a centralized dashboard to deploy and manage firewall rules across all accounts in an AWS Organization. Together, they enable consistent, centrally enforced network security policies.

In contrast, Network ACLs (option B) are stateless and must be configured per subnet per account—no central management. VPC Flow Logs (option D) capture traffic metadata but do not enforce any rules. Security groups with cross-account references (option E) allow referencing security groups from other accounts but require per-resource attachment and lack central policy enforcement.

Therefore, the two correct services are AWS Network Firewall (A) and AWS Firewall Manager (C).

Exam trap

AWS often tests the distinction between monitoring tools (like VPC Flow Logs) and enforcement tools (like AWS Network Firewall), leading candidates to mistakenly select VPC Flow Logs as a security control.

Practice this question →
309
Multi-Selecteasy

A company is using Amazon S3 to store sensitive data. They want to ensure that data is encrypted at rest and that access is logged. Which TWO services should they enable?

Select 2 answers
A.AWS Config
B.S3 Server Access Logs
C.VPC Flow Logs
D.AWS CloudTrail
E.S3 Server-Side Encryption
AnswersB, E

Logs requests to S3.

Why this answer

And E are correct: S3 Server-Side Encryption (SSE) encrypts data at rest, fulfilling the encryption requirement; S3 Server Access Logs log requests to the bucket, fulfilling the logging requirement. Option A (AWS Config) is incorrect because it monitors configuration changes, not data access. Option C (VPC Flow Logs) is incorrect because it captures network traffic, not S3 requests.

Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls but S3 Server Access Logs provide more granular object-level logging, and the question asks for access logging, not API call logging.

Practice this question →
310
MCQhard

A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?

A.The target group health checks are failing, so the NLB is not sending traffic to those targets
B.The target subnet network ACL blocks the client IP
C.The target instance security group does not allow traffic from the NLB
D.The NLB security group blocks the client IP
AnswerA

If health checks fail, the NLB marks the target as unhealthy and stops sending traffic.

Why this answer

If target group health checks fail, the NLB stops sending traffic to the unhealthy targets, even though the client IP is logged by the NLB. The traffic is dropped because NLB does not forward to unhealthy targets. Options B and C are incorrect because network ACLs or security groups would only affect traffic after NLB sends it, but health check failure prevents traffic from being sent at all.

Option D is incorrect because NLB does not have security groups.

Practice this question →
311
MCQhard

A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The network team wants to ensure that only encrypted traffic is sent over the internet between the two sites. The VPC has a virtual private gateway attached. When testing, they discover that some traffic is going over the internet without encryption. Which configuration change should be made to enforce encryption?

A.Add a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway.
B.Disable route propagation on the VPC route table to remove any dynamic routes from the VPN.
C.Enable IPsec acceleration on the VPN tunnel to ensure all traffic is encrypted.
D.Replace the virtual private gateway with a transit gateway and attach the VPN connection.
AnswerA

A static route forces traffic destined for on-premises through the VPN tunnel, ensuring encryption.

Why this answer

Adding a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway ensures that all traffic destined for the on-premises network is routed through the VPN tunnel, enforcing encryption. Without this static route, traffic might be sent via an internet gateway if a more specific route exists or if route propagation is not properly configured. Option B is incorrect because disabling route propagation would remove dynamic routes from the VPN, but traffic could still go over the internet if there is a route to an internet gateway.

Option C is incorrect because IPsec acceleration is about improving performance, not ensuring all traffic uses encryption; the tunnel already uses IPsec. Option D is incorrect because replacing the virtual private gateway with a transit gateway is not necessary; the issue is routing, not the gateway type.

Practice this question →
312
MCQhard

A company needs to securely connect an on-premises data center to AWS using multiple VPN tunnels. The security team requires that all traffic between the VPC and on-premises be encrypted and that the tunnels use a second authentication mechanism beyond pre-shared keys. Which solution meets these requirements?

A.Use AWS Client VPN with mutual authentication
B.Use AWS Transit Gateway with VPN attachments and configure pre-shared keys
C.Use AWS VPN CloudHub with multiple VPN connections and configure certificate-based authentication for each tunnel
D.Use AWS Direct Connect with a public VIF and establish an IPsec VPN over the Direct Connect connection
AnswerC

CloudHub supports multiple tunnels and certificate-based authentication for enhanced security.

Why this answer

AWS VPN CloudHub allows multiple VPN connections with BGP routing and supports certificate-based authentication (mutual TLS) for each tunnel, providing a second authentication mechanism beyond pre-shared keys. Option A is incorrect because AWS Client VPN is designed for individual remote users, not for site-to-site connectivity between an on-premises data center and a VPC. Option B is incorrect because AWS Transit Gateway with VPN attachments uses pre-shared keys by default and does not support certificate-based authentication for the VPN tunnels.

Option D is incorrect because while AWS Direct Connect with a public VIF and an IPsec VPN over it can provide encrypted traffic, the VPN itself typically relies on pre-shared keys, not a second authentication factor.

Practice this question →
313
MCQmedium

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to implement a centralized inspection architecture where all traffic between VPCs must be inspected by a security appliance (e.g., firewall) deployed in a dedicated inspection VPC. Currently, traffic flows directly between VPCs using the Transit Gateway. Which architecture change would enforce that all inter-VPC traffic passes through the inspection VPC?

A.Create VPC peering connections between each VPC and the inspection VPC, and remove the Transit Gateway attachments.
B.Configure the Transit Gateway to use separate route tables for each VPC attachment, with a default route pointing to the inspection VPC's attachment. Then, in the inspection VPC, route traffic back to the Transit Gateway for final delivery.
C.Use AWS Direct Connect Gateway to route traffic through the inspection VPC.
D.Deploy a Network Load Balancer in each VPC and configure it to forward traffic to the inspection VPC.
AnswerB

This design forces all inter-VPC traffic to traverse the inspection VPC for firewall inspection.

Why this answer

By using Transit Gateway route tables, you can create separate route tables for each VPC attachment and propagate only a default route pointing to the inspection VPC. This forces all traffic to go through the inspection VPC. Option A is incorrect because VPC peering does not integrate with Transit Gateway.

Option C is incorrect because Direct Connect Gateway is for on-premises connectivity, not for inter-VPC routing. Option D is incorrect because Network Load Balancer does not provide routing control.

Practice this question →
314
MCQmedium

A company uses AWS Organizations with SCPs to restrict access. The security team wants to ensure that no IAM user or role can disable AWS Shield Advanced protections. Which SCP effect should be used?

A.Deny in the IAM policy
B.Deny
C.Allow
D.Block
AnswerB

Deny in an SCP explicitly prohibits the specified actions.

Why this answer

(Deny) is correct because the Deny effect in an SCP explicitly prohibits specified actions, overriding any Allow statements in IAM policies. Option A (Deny in IAM policy) is not an SCP effect; SCPs are separate from IAM policies. Option C (Allow) permits actions but does not restrict, so it cannot be used to enforce prohibitions.

Option D (Block) is invalid; AWS SCPs use Deny, not Block.

Practice this question →
315
Multi-Selecteasy

A company is deploying a web application that must be accessible over HTTPS only. They are using an Application Load Balancer (ALB) with an SSL certificate from AWS Certificate Manager (ACM). Which TWO configurations are necessary to ensure that only HTTPS traffic reaches the application?

Select 2 answers
A.Configure the security group for the ALB to allow inbound traffic on port 80 from 0.0.0.0/0.
B.Configure the ALB listener to accept traffic on port 80.
C.Configure the security group for the ALB to allow inbound traffic on port 443 from 0.0.0.0/0.
D.Configure the ALB to redirect HTTP traffic to HTTPS.
E.Configure the ALB listener to accept traffic on port 443 using the SSL certificate.
AnswersC, E

This allows HTTPS traffic from the internet.

Why this answer

To ensure only HTTPS traffic reaches the application, the security group for the ALB should allow inbound traffic on port 443 from anywhere (option C), and the ALB listener must be configured to accept traffic on port 443 using the SSL certificate from ACM (option E). Option A is incorrect because allowing port 80 would permit HTTP traffic. Option B is incorrect because an HTTP listener would accept unencrypted traffic.

Option D is incorrect because redirecting HTTP to HTTPS still allows HTTP traffic to reach the ALB initially; the proper approach is to not accept HTTP at all.

Practice this question →
316
MCQeasy

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3. Which control mechanism should they use?

A.Assign an IAM policy to all users that requires SSE-S3.
B.Configure a bucket policy on each bucket to deny writes without SSE-S3.
C.Create a service control policy (SCP) that denies PutBucketEncryption if the encryption is not SSE-S3.
D.Use AWS CloudTrail to monitor and alert on non-compliant bucket creations.
AnswerC

SCPs can enforce policies across all accounts in the organization.

Why this answer

A service control policy (SCP) in AWS Organizations can deny PutBucketEncryption unless SSE-S3 is specified, enforcing encryption across all accounts. Option A is wrong because IAM policies are account-level and cannot enforce across all accounts in an organization. Option B is wrong because bucket policies are per-bucket and would require manual configuration on each bucket.

Option D is wrong because CloudTrail is a logging service that does not enforce compliance; it only provides monitoring after the fact.

Practice this question →
317
MCQmedium

A company wants to enforce that all outbound traffic from its VPC flows through a centralized inspection VPC for security monitoring. The VPCs are connected via Transit Gateway. Which set of actions should a network engineer take to ensure that traffic from application VPCs is routed to the inspection VPC before reaching the internet?

A.Create VPC peering connections between each application VPC and the inspection VPC, and add routes pointing to the peering connection.
B.Attach an internet gateway to each application VPC and add a default route pointing to the inspection VPC's NAT gateway.
C.Attach an internet gateway to each application VPC and add default route pointing to it.
D.Create a TGW route table with a blackhole route for 0.0.0.0/0 and associate it with application VPC attachments; attach the inspection VPC to a different TGW route table that has a route to the internet via an egress VPC.
AnswerD

This enforces traffic flow through inspection VPC.

Why this answer

It uses separate Transit Gateway route tables to enforce traffic isolation: the application VPC attachments use a route table with a blackhole for 0.0.0.0/0, preventing direct internet access, while the inspection VPC uses a different route table with a route to an egress VPC that has an internet gateway. This ensures all outbound traffic from application VPCs must first traverse the inspection VPC for security monitoring before reaching the internet.

Exam trap

The trap here is that candidates often assume VPC peering or direct internet gateway attachments can be combined with Transit Gateway for centralized inspection, but they fail to recognize that Transit Gateway route tables are required to enforce traffic isolation and prevent direct internet access from application VPCs.

How to eliminate wrong answers

Option A is wrong because VPC peering does not support transitive routing; each peering connection is a one-to-one link, so traffic from one application VPC cannot be routed through the inspection VPC to another VPC or the internet without additional complex routing. Option B is wrong because an internet gateway attached to an application VPC would allow direct outbound traffic, bypassing the inspection VPC; the default route pointing to the inspection VPC's NAT gateway is invalid because a NAT gateway cannot be reached across a Transit Gateway without proper routing and the NAT gateway itself is not a routing target for a VPC's default route. Option C is wrong because attaching an internet gateway to each application VPC and adding a default route pointing to it directly sends traffic to the internet, completely bypassing the centralized inspection VPC.

Practice this question →
318
MCQeasy

A company wants to securely store and manage secrets such as database passwords and API keys. They need to automatically rotate secrets every 30 days and ensure that only specific IAM roles can access them. Which AWS service should they use?

A.AWS Systems Manager Parameter Store
B.AWS Key Management Service (KMS)
C.AWS Secrets Manager
D.AWS CloudHSM
AnswerC

Secrets Manager is designed for storing secrets with built-in rotation capability and fine-grained access control using IAM policies.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating secrets such as database passwords and API keys. It supports native rotation with AWS Lambda, enforces fine-grained access control via IAM roles, and can rotate secrets on a schedule (e.g., every 30 days) without custom scripting.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets securely but lacks native rotation) with AWS Secrets Manager, leading them to choose Parameter Store when automatic rotation is explicitly required.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions (e.g., Lambda) to rotate values and lacks native secret rotation scheduling. Option B is wrong because AWS Key Management Service (KMS) is a key management service for encryption keys, not a secret store; it does not store secrets or provide rotation capabilities for passwords or API keys. Option D is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) for cryptographic operations and key storage, but it does not store or manage application secrets like database passwords or API keys, nor does it offer automatic rotation.

Practice this question →
319
MCQeasy

A company uses AWS Direct Connect to connect its on-premises network to a VPC. The security team wants to ensure that traffic between the on-premises network and the VPC is encrypted using IPSec. Which solution meets this requirement?

A.Establish an IPSec VPN connection over the Direct Connect public virtual interface using a customer gateway and a virtual private gateway.
B.Use a private virtual interface (VIF) on the Direct Connect connection and enable encryption at the physical layer.
C.Use VPC endpoints (Gateway Endpoints) for all traffic between on-premises and the VPC.
D.Attach the Direct Connect virtual interface to a Transit Gateway and enable multicast.
AnswerA

This combination provides encrypted IPSec tunnels over the Direct Connect connection.

Why this answer

It establishes an IPSec VPN tunnel over a Direct Connect public virtual interface (VIF), which encrypts traffic between the on-premises network and the VPC. The customer gateway and virtual private gateway create a site-to-site VPN connection that uses IPSec to secure all data traversing the Direct Connect link, meeting the encryption requirement without relying on physical-layer security.

Exam trap

The trap here is that candidates assume a private virtual interface inherently provides encryption, but Direct Connect private VIFs are unencrypted by default, and IPSec must be explicitly layered over a public VIF or via a VPN appliance.

How to eliminate wrong answers

Option B is wrong because private virtual interfaces do not support encryption at the physical layer; Direct Connect operates at Layer 2 and does not provide native encryption, and enabling encryption at the physical layer (e.g., MACsec) is not supported on Direct Connect private VIFs. Option C is wrong because VPC Gateway Endpoints (e.g., for S3 or DynamoDB) only provide private connectivity to specific AWS services, not general IPSec encryption for all traffic between on-premises and the VPC. Option D is wrong because attaching a Direct Connect virtual interface to a Transit Gateway and enabling multicast does not provide IPSec encryption; multicast is a separate feature for one-to-many communication, not for securing traffic.

Practice this question →
320
MCQhard

A security engineer is configuring Network Access Control Lists (NACLs) for a VPC with multiple subnets. The engineer wants to block SSH access (port 22) from a specific IP range 10.0.0.0/8 to the entire VPC CIDR (172.16.0.0/16). What is the most effective approach?

A.Add inbound and outbound NACL rules denying SSH from 10.0.0.0/8
B.Add a security group rule to deny inbound SSH from 10.0.0.0/8
C.Add an inbound NACL rule denying SSH from 10.0.0.0/8
D.Add an outbound security group rule denying SSH to 10.0.0.0/8
AnswerA

Correct. NACLs are stateless, so to block SSH traffic from 10.0.0.0/8 to the VPC CIDR, you must add both an inbound rule denying SSH from that source and an outbound rule denying SSH to that source as return traffic will be seen as a new flow.

Why this answer

NACLs are stateless, so to block SSH from 10.0.0.0/8 to the entire VPC, both inbound and outbound rules are needed. Option A correctly adds both rules. Option B is incorrect because security groups are stateful and only allow traffic; they cannot deny.

Option C is incorrect because an inbound rule alone does not block return traffic. Option D is incorrect because security groups cannot block outbound traffic based on destination IP effectively.

Practice this question →
321
MCQeasy

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC are allowed. The bucket policy should deny requests that do not originate from the VPC. Which condition key should be used in the bucket policy?

A.aws:SourceVpc
B.aws:VpcSourceIp
C.aws:Referer
D.aws:SourceIp
AnswerA

This condition key restricts access to a specific VPC.

Why this answer

The correct condition key is `aws:SourceVpc`, which allows you to restrict access to an S3 bucket based on the VPC from which the request originates. When used in a bucket policy with a Deny effect, it ensures that only requests coming from the specified VPC ID are allowed, and all other requests are denied. This key is specifically designed for VPC-based access control in S3 bucket policies.

Exam trap

AWS often tests the distinction between `aws:SourceVpc` and `aws:SourceIp` — the trap here is that candidates mistakenly choose `aws:SourceIp` thinking they can restrict by VPC by using the VPC's CIDR range, but this fails because requests from within the VPC may have different source IPs (e.g., private IPs or NAT public IPs) and cannot reliably identify the VPC.

How to eliminate wrong answers

Option B (`aws:VpcSourceIp`) is wrong because this condition key does not exist in AWS IAM; the correct key for VPC-based IP restrictions is `aws:VpcSourceIp` is not a valid condition key, and AWS uses `aws:SourceIp` for IP address-based restrictions, not VPC-level control. Option C (`aws:Referer`) is wrong because it is used to restrict access based on the HTTP Referer header, typically for preventing hotlinking from unauthorized websites, not for VPC-based access control. Option D (`aws:SourceIp`) is wrong because it restricts access based on the source IP address of the requester, which is not VPC-specific and cannot enforce that the request originates from a particular VPC, especially when traffic may come through NAT gateways or VPNs.

Practice this question →
322
MCQmedium

A company is using AWS Direct Connect to connect its on-premises network to VPCs in multiple AWS accounts. The company wants to ensure that traffic from the on-premises network can only access specific VPCs based on the source IP address. Which AWS service should be used to enforce this segmentation?

A.VPC Peering
B.AWS Transit Gateway
C.AWS PrivateLink
D.Security Groups
AnswerB

Transit Gateway with route tables can enforce segmentation based on source IP.

Why this answer

The correct answer because AWS Transit Gateway provides the connectivity hub between Direct Connect and multiple VPCs, and its route tables can be used to isolate traffic based on the Direct Connect virtual interface. However, Transit Gateway route tables are destination-based, not source-based. To enforce segmentation based on source IP address, you must combine Transit Gateway with a firewall service such as AWS Network Firewall or a third-party firewall appliance.

The other options are incorrect: VPC Peering does not support source IP filtering and does not scale to many VPCs; AWS PrivateLink is for accessing services within a VPC; and Security Groups apply at the instance level, not to traffic from Direct Connect.

Practice this question →
323
MCQmedium

A company is using Amazon VPC with a public subnet and a private subnet. The public subnet has a NAT gateway. The private subnet has an Amazon RDS for MySQL database. The security team wants to ensure that the database is not accessible from the internet, but they need to allow a specific on-premises network (IP range 203.0.113.0/24) to connect to the database for maintenance. The company also wants to restrict outbound traffic from the database to only necessary AWS services (e.g., S3 for backups) and deny all other outbound traffic. Which configuration should the security team implement?

A.Create a security group for the database that allows inbound from the on-premises network using a prefix list for 203.0.113.0/24. Create a VPC endpoint for S3 and allow outbound traffic to the endpoint. Keep the private subnet's network ACL default (allow all outbound).
B.Set up a Site-to-Site VPN between the on-premises network and the VPC. Modify the route tables to route 203.0.113.0/24 through the VPN. Place the database in a private subnet and allow inbound from the VPN CIDR. Use an internet gateway for outbound traffic to S3.
C.Modify the database security group to allow inbound TCP 3306 from 203.0.113.0/24. Create a VPC endpoint for S3. Update the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list.
D.Place the database in a public subnet and use a security group that allows inbound from 203.0.113.0/24. Use the NAT gateway for outbound traffic to S3. Configure the public subnet's network ACL to deny all outbound traffic except to S3.
AnswerC

This directly permits the required on-premises access and restricts outbound traffic to only S3 via VPC endpoint, which is secure and efficient.

Why this answer

This configuration allows inbound access from the specific on-premises CIDR (203.0.113.0/24) directly via the database security group, which is secure and avoids the complexity of a VPN. Creating a VPC endpoint for S3 enables private connectivity to S3 without traversing the internet. Updating the private subnet's network ACL to deny all outbound traffic except to the S3 VPC endpoint prefix list restricts outbound traffic as required.

Option A is incorrect because a security group cannot reference a prefix list for on-premises IPs; prefix lists are used for AWS services or specific VPC resources. Option B is incorrect because a Site-to-Site VPN adds unnecessary complexity for a single on-premises CIDR, and using an internet gateway for outbound traffic to S3 bypasses the requirement to restrict outbound traffic. Option D is incorrect because placing the database in a public subnet would expose it to the internet, and using a NAT gateway for outbound traffic to S3 is not as secure as a VPC endpoint.

Exam trap

The trap is to assume that a VPN is required for on-premises access, but a direct security group rule with the on-premises CIDR is simpler and sufficient. Also, confusing network ACLs with security groups: security groups are stateful and allow return traffic automatically, while network ACLs are stateless and require explicit rules for return traffic.

Practice this question →
324
Multi-Selectmedium

A company is designing a network security solution for a VPC that hosts a multi-tier web application. The web servers are in a public subnet, and the application servers are in a private subnet. The company wants to ensure that the web servers can only be accessed on port 443 from the internet, and the application servers can only be accessed from the web servers on port 3306. Which THREE components should be configured?

Select 3 answers
A.Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0
B.Network ACL on the public subnet allowing inbound 443 from 0.0.0.0/0 and outbound ephemeral ports
C.Network ACL on the private subnet allowing inbound 3306 from the public subnet CIDR
D.Security group for application servers allowing inbound 3306 from the web server security group
E.Security group for web servers allowing inbound 443 from 0.0.0.0/0
AnswersB, D, E

NACL on public subnet provides stateless filtering for inbound HTTPS and outbound responses.

Why this answer

The correct components are: a security group for web servers allowing inbound 443 from 0.0.0.0/0 (E), a security group for application servers allowing inbound 3306 from the web server security group (D), and a network ACL on the public subnet allowing inbound 443 and outbound ephemeral ports (B) to add a stateless filtering layer. Option A is incorrect because the NACL rule lacks an outbound rule for return traffic, making it incomplete. Option C is unnecessary because the access control for the private subnet is best achieved with security groups, and a NACL is not required for this purpose.

Practice this question →
325
Multi-Selectmedium

A network engineer is troubleshooting connectivity issues between an EC2 instance and an RDS database in the same VPC. The EC2 instance can connect to the database, but the connection is slow. Which TWO actions should the engineer take to diagnose the issue? (Choose TWO.)

Select 2 answers
A.Verify the route table for the database subnet to ensure there is a default route to the internet.
B.Check the network ACL for the database subnet to ensure it is stateful.
C.Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.
D.Check VPC Flow Logs to analyze traffic patterns and identify drops or latency.
E.Check the route propagation settings on the VPC.
AnswersC, D

Security group misconfigurations can cause slow connections.

Why this answer

Options C and D are correct. Checking security group rules (C) ensures proper allow rules for communication between the EC2 instance and RDS database. Reviewing VPC Flow Logs (D) can reveal dropped packets or latency issues.

Option A is wrong because the default route to the internet is not relevant to internal VPC traffic. Option B is wrong because network ACLs are stateless and require explicit rules for both inbound and outbound traffic, but statefulness is not the issue here. Option E is wrong because route propagation is for VPN/Direct Connect, not for this connectivity.

Practice this question →
326
Multi-Selecteasy

A company wants to protect its web application running on Amazon EC2 behind an Application Load Balancer (ALB) from common web exploits like SQL injection and cross-site scripting (XSS). Which THREE AWS services should be used together to provide comprehensive protection?

Select 3 answers
A.AWS WAF
B.Amazon Route 53
C.AWS Shield
D.Amazon CloudFront
E.Application Load Balancer (ALB)
AnswersA, C, E

WAF helps protect against SQL injection, XSS, and other web exploits.

Why this answer

AWS WAF (Option A) protects against web exploits like SQL injection and XSS. AWS Shield (Option C) provides DDoS protection. The Application Load Balancer (Option E) is the target for the web application and can be integrated with WAF and Shield for comprehensive protection.

Amazon Route 53 (Option B) is a DNS service and does not directly provide security against web exploits. Amazon CloudFront (Option D) is a CDN that can be used with WAF, but it is not required since the ALB is already in place; the question asks for three services that together provide comprehensive protection, and the combination of WAF, Shield, and ALB covers web application firewall, DDoS protection, and traffic distribution.

Practice this question →
327
MCQmedium

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download patches from the internet. The company wants to ensure that all outbound traffic is logged and that only specific destinations are allowed. Which solution meets these requirements?

A.Deploy a NAT gateway in a public subnet and enable VPC Flow Logs
B.Deploy a proxy server in a public subnet and configure the EC2 instance to use it
C.Deploy a NAT instance in a public subnet and enable VPC Flow Logs
D.Attach an internet gateway to the VPC and assign a public IP to the EC2 instance
AnswerA

NAT gateway provides outbound internet access and VPC Flow Logs capture traffic metadata for logging.

Why this answer

A NAT gateway in a public subnet allows outbound internet access from private instances, and VPC Flow Logs can capture traffic metadata. Option B is wrong because a proxy server in a public subnet requires additional configuration and is not the default AWS solution. Option C is wrong because a NAT instance can also work but requires manual management and does not inherently provide logging; Flow Logs still need to be enabled.

Option D is wrong because an internet gateway alone does not provide private subnet access.

Practice this question →
328
MCQeasy

A company wants to block inbound traffic from a specific IP address range (203.0.113.0/24) at the VPC level using AWS WAF. Which resource should the AWS WAF web ACL be associated with?

A.Application Load Balancer
B.Network Load Balancer
C.VPC peering connection
D.Security group
AnswerA

AWS WAF can be associated with ALB to filter web traffic.

Why this answer

AWS WAF can be associated with an Application Load Balancer to filter HTTP/HTTPS traffic. Option B is wrong because NLB does not support AWS WAF. Option C is wrong because VPC peering does not have a web ACL.

Option D is wrong because a security group is used for stateful filtering, but AWS WAF is a separate service for web traffic.

Practice this question →
329
MCQhard

A company is designing a hub-and-spoke network in AWS. The security team requires that all traffic between VPCs in different spokes must be inspected by a third-party firewall deployed in the hub VPC. Which architecture meets this requirement with minimal complexity?

A.Create VPC peering connections between each spoke VPC and configure security groups to enforce inspection.
B.Use AWS PrivateLink to connect all spoke VPCs to a central service in the hub.
C.Use a Transit Gateway with separate route tables for each spoke VPC, and configure the spoke route tables to route all inter-spoke traffic through the hub VPC firewall.
D.Set up AWS Direct Connect between all VPCs and route through a central firewall.
AnswerC

This forces traffic through the inspection firewall.

Why this answer

Transit Gateway with separate route tables allows you to configure routes so that traffic between spoke VPCs is directed through the hub VPC firewall for inspection. Option A is incorrect because VPC peering does not centralize traffic inspection; it creates direct connectivity without forcing traffic through the hub. Option B is incorrect because AWS PrivateLink is designed for accessing services privately, not for routing inter-VPC traffic.

Option D is incorrect because AWS Direct Connect is used for on-premises connectivity, not for inter-VPC routing within AWS.

Practice this question →
330
Multi-Selectmedium

A company is implementing a network security solution for a VPC that contains a web application. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets. The company wants to protect against common web exploits and also filter outbound traffic from the instances. Which TWO services should be used together?

Select 2 answers
A.AWS Shield Advanced
B.AWS WAF
C.AWS Network Firewall
D.Network ACLs
E.Amazon GuardDuty
AnswersB, C

WAF can be associated with the ALB to filter web requests.

Why this answer

To protect against common web exploits, AWS WAF (Option B) should be used with the ALB to filter incoming HTTP/HTTPS requests. For filtering outbound traffic from the EC2 instances, AWS Network Firewall (Option C) provides stateful inspection of both inbound and outbound traffic. Option A (AWS Shield Advanced) is a DDoS protection service, not for web exploit filtering.

Option D (Network ACLs) are stateless and cannot perform content-based filtering. Option E (Amazon GuardDuty) is a threat detection service, not a firewall.

Practice this question →
331
MCQhard

A company uses AWS Shield Advanced for DDoS protection. During an attack, they notice that legitimate traffic is being throttled. Which configuration change should be made to reduce false positives while maintaining protection?

A.Reduce the rate limit in the Shield Advanced configuration.
B.Increase the rate limit threshold in the associated AWS WAF rate-based rule.
C.Disable the AWS WAF rate-based rule for the duration of the attack.
D.Increase the sensitivity of the AWS WAF web ACL.
AnswerB

A higher threshold allows more legitimate traffic before throttling.

Why this answer

Increasing the rate limit threshold in the associated AWS WAF rate-based rule can reduce false positives by allowing more legitimate traffic while still providing protection. Option A is incorrect because reducing the rate limit would increase false positives. Option C is incorrect because disabling the rule removes protection.

Option D is incorrect because increasing sensitivity of the web ACL is not a direct setting; rate limits are set per rule.

Practice this question →
332
MCQmedium

A company is designing a VPC with public and private subnets. They need to allow instances in the private subnet to access the internet for software updates while preventing inbound internet traffic. Which AWS service should they use?

A.NAT Gateway
B.AWS Direct Connect
C.VPC Peering
D.Internet Gateway
AnswerA

NAT Gateway enables outbound traffic to the internet from private subnets.

Why this answer

(NAT Gateway) is correct because a NAT Gateway allows instances in a private subnet to initiate outbound internet traffic (e.g., for software updates) while preventing any inbound traffic from the internet. Option B (AWS Direct Connect) is a dedicated private connection between on-premises and AWS, not for internet access. Option C (VPC Peering) connects VPCs privately, not providing internet access.

Option D (Internet Gateway) allows both inbound and outbound traffic, which would expose private instances to inbound internet traffic, violating the requirement.

Practice this question →
333
MCQeasy

A company is using AWS WAF to protect a web application behind an Application Load Balancer. They want to block requests from a specific IP address range. Which component should they use?

A.Security group associated with the ALB
B.IP set match condition in AWS WAF
C.AWS Shield Advanced
D.Network ACL on the ALB's subnets
AnswerB

AWS WAF uses IP sets to match IP addresses and can block them.

Why this answer

AWS WAF includes IP set match conditions that allow you to specify IP addresses to block or allow, which directly addresses the requirement to block requests from a specific IP address range. Option A is wrong because security groups are stateful firewalls for EC2 instances and cannot be directly associated with an ALB to filter web requests. Option C is wrong because AWS Shield Advanced provides DDoS protection but does not offer granular IP-based blocking.

Option D is wrong because network ACLs operate at the subnet level and are not integrated with ALB for web request filtering.

Practice this question →
334
MCQeasy

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC endpoint are allowed. Which type of policy should they use?

A.S3 bucket policy with aws:SourceVpce condition
B.S3 bucket policy with aws:SourceIp condition
C.IAM policy
D.VPC endpoint policy
AnswerA

Bucket policies can restrict access based on VPC endpoint ID.

Why this answer

S3 bucket policies can use the aws:SourceVpce condition key to restrict access to requests originating from a specific VPC endpoint. Option B is incorrect because aws:SourceIp condition is not effective for traffic coming through a VPC endpoint, as the source IP is the endpoint's private IP, not the client's IP. Option C is incorrect because IAM policies control user and role permissions, not network-level access control.

Option D is incorrect because VPC endpoint policies control what actions can be performed via the endpoint, but they do not replace bucket policies for restricting access to the S3 bucket itself.

Practice this question →
335
MCQeasy

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application stores files in an S3 bucket. The security team wants to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. They have created an IAM role for the EC2 instances with a policy that grants s3:PutObject and s3:GetObject on the specific bucket. They have also attached a VPC endpoint for S3 to the VPC and added a bucket policy that allows access only from the VPC endpoint. Despite this, the EC2 instances can still access other S3 buckets. What is the most likely reason?

A.The VPC endpoint does not have a route table associated with the private subnets.
B.The security group on the VPC endpoint is allowing all traffic.
C.The VPC endpoint policy does not restrict access to the specific S3 bucket.
D.The IAM role does not have a trust policy that allows EC2 to assume it.
AnswerC

Without a restrictive endpoint policy, the VPC endpoint allows access to any S3 bucket, and if the instances have any other IAM policies (even default), they could access other buckets.

Why this answer

The most likely reason is that the VPC endpoint policy is not restricting access to the specific S3 bucket (Option C). Even though the IAM role only grants permissions on the specific bucket, the VPC endpoint policy defaults to allowing access to all S3 resources. Without a restrictive endpoint policy, the EC2 instances can access other S3 buckets if they have any IAM permissions that allow it (e.g., from another attached policy).

Option A is incorrect because the VPC endpoint does not require a route table association to function; rather, the route table must have a route pointing to the endpoint for traffic to use it. Option B is incorrect because the security group on the endpoint controls network traffic, not access to S3 buckets. Option D is incorrect because the IAM role must have a trust policy allowing EC2 to assume it, but that is a prerequisite and would not cause the described issue by itself.

Practice this question →
336
Multi-Selecthard

A company is designing a network security architecture for a multi-account environment using AWS Organizations. They need to centrally manage and enforce security policies across all accounts. Which THREE services should they consider?

Select 3 answers
A.AWS Direct Connect
B.AWS Firewall Manager
C.AWS Security Hub
D.Amazon Route 53 Resolver DNS Firewall
E.AWS CloudTrail
AnswersB, C, E

Central management of firewall rules.

Why this answer

Options B, C, and E are correct: AWS Firewall Manager centrally manages firewall rules across accounts; AWS Security Hub provides a unified view of security alerts and compliance checks; AWS CloudTrail logs API calls across accounts for auditing and monitoring. Option A is wrong because AWS Direct Connect is a dedicated network connection service, not a policy enforcement service. Option D is wrong because Amazon Route 53 Resolver DNS Firewall is a DNS-layer filtering service, but the question asks for central policy enforcement and management across accounts, which is not its primary function.

Practice this question →
337
MCQmedium

Refer to the exhibit. A security engineer applies this SCP to an AWS account. What is the effect of this policy?

A.All API calls over HTTPS will be allowed
B.Only S3 API calls will be affected
C.The policy requires multi-factor authentication
D.All API calls that are not made over HTTPS will be denied
AnswerD

The condition aws:SecureTransport false triggers a Deny on all actions.

Why this answer

The SCP uses a Deny effect with a condition that blocks all API calls when the request is not made over HTTPS (i.e., aws:SecureTransport is false). This effectively denies any API call that uses HTTP instead of HTTPS. Option A is incorrect because the policy denies non-HTTPS calls, not allows them.

Option B is incorrect because the policy applies to all AWS services, not just S3. Option C is incorrect because the condition checks for transport security, not multi-factor authentication. Option D correctly states that all API calls not made over HTTPS will be denied.

Practice this question →
338
MCQhard

A network engineer is designing a VPC with private subnets for workloads that must not have direct internet access. However, the workloads need to download patches from a specific third-party vendor's IP range. Which solution minimizes the attack surface?

A.Create a managed prefix list for the vendor's IPs and add a route in the private subnet route table to a NAT gateway, with the prefix list as destination
B.Configure a VPC endpoint for the vendor's service
C.Deploy a proxy server in a public subnet and configure the workloads to use it for all internet traffic
D.Establish a VPN connection to the vendor's network and route all traffic to the vendor through the VPN
AnswerA

Restricts egress to only vendor IPs.

Why this answer

Using a managed prefix list for the vendor's IPs and adding a route to a NAT gateway in the private subnet route table allows traffic only to those specific IPs, minimizing attack surface by avoiding direct internet access. Option B (VPC endpoint) is for AWS services only, not third-party. Option C (proxy server) would allow all internet traffic, not just to the vendor, increasing exposure.

Option D (VPN) introduces complexity and potential trust issues, and still might allow other traffic if not carefully restricted.

Practice this question →
339
MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all Amazon S3 buckets in the organization are encrypted at rest. Which policy should be attached to the root organizational unit to enforce this requirement?

A.Configure AWS Config rules to mark non-compliant buckets and trigger a Lambda function to add encryption.
B.Create an IAM role in each account that requires encryption for any S3 operation.
C.Use an S3 bucket policy on every existing and future bucket to deny unencrypted uploads.
D.Attach a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.
AnswerD

SCPs can enforce encryption at the organizational level.

Why this answer

A service control policy (SCP) attached to the root OU can deny the s3:CreateBucket action unless the bucket is configured with default encryption, thereby enforcing encryption at rest across all accounts in the organization. Option D is correct. Option A is incorrect because AWS Config rules can detect non-compliance but cannot enforce policies in real time; they are detective, not preventive.

Option B is incorrect because IAM roles are account-specific and cannot enforce encryption across all accounts centrally. Option C is incorrect because S3 bucket policies apply only to individual buckets and cannot be applied to future buckets or across accounts without manual configuration.

Practice this question →
340
MCQmedium

An application running on EC2 instances needs to access a DynamoDB table. The security team requires that traffic does not traverse the internet. Which solution should be used?

A.Create a VPC Gateway Endpoint for DynamoDB.
B.Create a VPC Interface Endpoint for DynamoDB.
C.Attach an Internet Gateway to the VPC.
D.Deploy a NAT gateway and update the route table.
AnswerA

Correct. A VPC Gateway Endpoint for DynamoDB allows private access to DynamoDB from within the VPC without going over the internet.

Why this answer

A VPC Gateway Endpoint for DynamoDB provides private connectivity without traversing the internet. Option B is incorrect because VPC Interface Endpoints are typically used for services like API Gateway, but DynamoDB does not support Interface Endpoints in the same way; DynamoDB uses Gateway Endpoints. Option C is incorrect because an Internet Gateway provides internet access, which violates the security requirement.

Option D is incorrect because a NAT Gateway also enables internet outbound traffic, not private access to DynamoDB.

Practice this question →
341
MCQhard

A company is deploying an AWS Network Firewall in a centralized inspection VPC and needs to send traffic from multiple VPCs through it. The VPCs are attached to a Transit Gateway. What configuration is required to route traffic to the firewall?

A.Create a Transit Gateway route table with a route to the Network Firewall endpoint and attach the VPCs to it.
B.Create a VPC Gateway Endpoint for the firewall service.
C.Add a route in each VPC's subnet routing table pointing to the firewall's elastic network interface.
D.Configure a NAT gateway in each VPC and route traffic through it.
AnswerA

This ensures traffic is routed through the firewall.

Why this answer

The Transit Gateway route table must have a route pointing to the Network Firewall endpoint, and the VPCs attached to that route table will have their traffic inspected by the firewall. Options B, C, and D are incorrect: VPC Gateway Endpoints are for accessing AWS services, not for routing traffic through a firewall; adding routes directly to the firewall's ENI in each VPC subnet is not supported without an endpoint; and NAT gateways are used for outbound internet traffic, not for routing to a firewall.

Practice this question →
342
MCQeasy

A network engineer runs the above command and sees that VPC Flow Logs are configured for a VPC. The engineer wants to analyze rejected traffic to troubleshoot a connectivity issue. Which field in the flow log records should they examine?

A.protocol
B.action
C.srcaddr
D.dstport
AnswerB

Shows whether traffic was accepted or rejected.

Why this answer

The 'action' field in VPC Flow Logs indicates ACCEPT or REJECT. Option A is wrong because 'srcaddr' is source IP. Option C is wrong because 'dstport' is destination port.

Option D is wrong because 'protocol' is the protocol number.

Practice this question →
343
MCQmedium

A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?

A.Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket
B.Remove the bucket policy that denies all principals
C.Attach an internet gateway to the VPC and a public IP to the Lambda function
D.Create a VPC endpoint for S3 and attach it to the Lambda function's VPC
AnswerA

The Lambda execution role must have the necessary S3 permissions to access the bucket.

Why this answer

The Lambda execution role needs an IAM policy that allows s3:GetObject (or appropriate actions) on the S3 bucket. In this scenario, the bucket policy denies all principals except those explicitly allowed. Since the Lambda function is supposed to access the bucket, the bucket policy already explicitly allows the Lambda role.

Therefore, only the IAM permission is missing. Adding the IAM policy (Option A) resolves the issue. Option B is wrong because removing the bucket policy would allow all principals, violating the security intent.

Option C is wrong because Lambda functions in a VPC do not require internet gateways or public IPs to reach S3, and it does not address permissions. Option D is wrong because a VPC endpoint provides network connectivity but does not grant IAM permissions; the Lambda execution role still needs the IAM policy.

Practice this question →
344
Multi-Selecteasy

A security engineer needs to capture and analyze network traffic between two EC2 instances in the same VPC for troubleshooting. The engineer wants to capture full packets and store them for later analysis. Which TWO AWS services can be used together to accomplish this? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.AWS Config
C.VPC Flow Logs
D.Traffic Mirroring
E.Amazon CloudWatch Logs
AnswersA, D

Can store the mirrored traffic for analysis.

Why this answer

Options A (Amazon S3) and D (Traffic Mirroring) are correct. Traffic Mirroring captures full packets and sends them to a target, such as a Network Load Balancer or an EC2 instance, which can then store the captured traffic in Amazon S3. Option B (AWS Config) is incorrect because it tracks configuration changes, not network traffic.

Option C (VPC Flow Logs) is incorrect because it captures only metadata (IP headers, ports, etc.), not full packets. Option E (Amazon CloudWatch Logs) is incorrect because it is designed for log storage and monitoring, not for storing full packet captures.

Practice this question →
345
MCQmedium

A company wants to restrict access to its S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition should be used?

A.s3:x-amz-server-side-encryption-aws-kms-key-id
B.s3:x-amz-server-side-encryption
C.kms:ViaService
D.kms:EncryptionContext
AnswerA

This condition key allows you to enforce that a specific KMS key is used for encryption.

Why this answer

The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to require that objects uploaded to the bucket are encrypted with a specific KMS key, thus enforcing SSE-KMS. Option B (s3:x-amz-server-side-encryption) only checks for any server-side encryption, not a specific key. Option C (kms:ViaService) is a condition key for KMS key policies, not S3 bucket policies.

Option D (kms:EncryptionContext) is used in KMS policies to restrict encryption contexts, not applicable to S3 bucket policies.

Practice this question →
346
MCQmedium

A company uses AWS Organizations with SCPs to restrict access. The security team needs to prevent users in the 'Developers' OU from disabling AWS Config or modifying its rules. Which SCP effect should be used?

A.Block
B.Deny
C.Allow
D.NotAction
AnswerB

Deny explicitly prohibits specified actions.

Why this answer

A Deny effect explicitly blocks the action, overriding any Allow. Option A is wrong because Allow would not prevent the action. Option C is wrong because SCPs don't have a Block effect.

Option D is wrong because NotAction is a condition element, not an effect.

Practice this question →
347
MCQhard

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team notices that the BGP session between the on-premises router and the AWS virtual private gateway (VGW) is flapping. The on-premises router is configured to advertise a specific prefix. Which configuration change is MOST likely to stabilize the BGP session?

A.Add ASN prepending to the advertised prefix.
B.Adjust BGP timers (keepalive and hold time) to match between the on-premises router and the VGW.
C.Enable BGP MD5 authentication on both sides.
D.Apply a route-map on the VGW to filter the prefix.
AnswerB

Mismatched timers can cause flapping.

Why this answer

BGP timers mismatch (keepalive and hold time) can cause frequent session resets (flapping). Adjusting them to match between the on-premises router and the VGW stabilizes the session. Option A is incorrect because ASN prepending influences route preference, not session stability.

Option C is incorrect because MD5 authentication is for security, not flapping. Option D is incorrect because VGW does not support route-maps for filtering prefixes (route filtering can be done via allowed prefixes but not route-maps).

Practice this question →
348
MCQeasy

A company hosts a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The security team wants to block a list of known malicious IP addresses from accessing the application. They have already created an AWS WAF web ACL and associated it with the ALB. What is the MOST efficient way to block the IP addresses?

A.Place a CloudFront distribution in front of the ALB and use CloudFront's geo-restriction feature.
B.Add an AWS WAF rule to the web ACL that uses the 'IP reputation lists' managed rule group to block malicious IPs.
C.Configure a network ACL on the ALB's subnet to deny inbound traffic from each malicious IP.
D.Add each IP address as an inbound deny rule in the security group of the ALB.
AnswerB

Correct: Managed rule group automatically blocks known malicious IPs.

Why this answer

AWS WAF's managed rule group 'IP reputation lists' automatically blocks known malicious IPs from threat intelligence feeds, providing efficient protection without manual updates. Option A is wrong: CloudFront geo-restriction blocks traffic by geographic location, not specific IP addresses, and adds unnecessary complexity. Option C is wrong: Network ACLs are stateless and operate at the subnet level, not the application layer; managing a large IP list in NACL rules is not scalable.

Option D is wrong: Security groups are stateful but are not designed for large IP blocklists, and ALB does not use security group rules for incoming traffic at the application layer.

Practice this question →
349
Multi-Selecthard

Which THREE of the following are best practices for securing a VPC? (Choose three.)

Select 3 answers
A.Enable AWS Shield Advanced for DDoS protection.
B.Use security groups to control inbound and outbound traffic at the instance level.
C.Use network ACLs as a stateless layer of defense for subnets.
D.Allow all outbound traffic from the VPC to the internet.
E.Assign a default security group that allows all traffic.
AnswersA, B, C

AWS Shield Advanced provides enhanced DDoS protection for VPC resources.

Why this answer

Options A, B, and C are correct. Enabling AWS Shield Advanced provides DDoS protection for VPC resources with public endpoints. Security groups act as a virtual firewall at the instance level, controlling inbound and outbound traffic.

Network ACLs provide a stateless layer of defense at the subnet level, complementing security groups. Option D is incorrect because allowing all outbound traffic is not a security best practice; outbound traffic should be restricted to only necessary destinations. Option E is incorrect because the default security group should be restrictive, not allowing all traffic.

Practice this question →
350
MCQeasy

A company is using AWS Secrets Manager to store database credentials. They want to ensure that the credentials are automatically rotated every 30 days. Which configuration is required?

A.Enable automatic rotation in the secret configuration and provide a Lambda rotation function.
B.Store the secret in AWS Systems Manager Parameter Store and configure a rotation schedule.
C.Store the secret in AWS CloudHSM and use a scheduled Lambda to rotate.
D.Use IAM Access Analyzer to rotate the credentials periodically.
AnswerA

Secrets Manager supports automatic rotation using Lambda functions.

Why this answer

AWS Secrets Manager provides built-in automatic rotation using a Lambda function. Option B is incorrect because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it is designed for configuration management. Option C is incorrect because AWS CloudHSM is a hardware security module for storing cryptographic keys, not for automating credential rotation.

Option D is incorrect because IAM Access Analyzer analyzes resource policies to identify unintended access, not to rotate credentials.

Practice this question →
351
MCQmedium

A company has a VPC with a public subnet and a private subnet. They have a web server in the public subnet and a database in the private subnet. The web server needs to communicate with the database on port 3306. Security groups are configured as follows: Web server SG allows inbound HTTP/HTTPS from 0.0.0.0/0 and outbound to database SG on port 3306. Database SG allows inbound from web server SG on port 3306. However, the web server cannot connect. Network ACLs are default. What is the issue?

A.The network ACL on the private subnet denies inbound traffic on port 3306.
B.Security groups are stateful, so no outbound rule is needed; the issue is something else.
C.The web server security group does not allow outbound traffic to the database.
D.The database security group inbound rule is not correctly referencing the web server security group ID.
AnswerD

Correct: The rule must reference the security group ID, not the instance ID.

Why this answer

The web server can initiate outbound traffic because the web server's security group has an outbound rule allowing traffic to the database security group on port 3306. Security groups are stateful, so the response traffic is automatically allowed. The issue is that the database security group's inbound rule must reference the web server security group ID correctly.

If the rule references a misconfigured or incorrect security group ID, the database will not accept the connection. Network ACLs are default allow, so they are not blocking traffic. Therefore, the correct answer is D.

Practice this question →
352
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize data transfer costs and avoid exposing the private instance to inbound traffic from the internet. Which solution meets these requirements?

A.Create a VPC Gateway Endpoint for Amazon S3 and ensure the patches are hosted in S3. Route private subnet traffic to the endpoint.
B.Attach an internet gateway to the VPC and route the private subnet's default route to a NAT gateway in the public subnet.
C.Launch a NAT instance in the public subnet and route the private subnet's default route to it.
D.Attach an internet gateway to the VPC and assign a public IP to the EC2 instance.
AnswerA

No NAT cost, no inbound exposure, and uses AWS private network.

Why this answer

A VPC Gateway Endpoint for Amazon S3 provides private connectivity to S3 without traversing the internet, eliminating data transfer costs and avoiding exposure to inbound traffic. Option D is incorrect because assigning a public IP and using an internet gateway would expose the instance to inbound traffic. Option B (NAT gateway) and Option C (NAT instance) incur data transfer costs and are not required when the patches are in S3 and can be accessed via a gateway endpoint.

Practice this question →
353
MCQeasy

A company has deployed a VPC with public and private subnets. They have an Internet Gateway attached to the VPC and a NAT Gateway in the public subnet. The private subnet instances need to download patches from the internet. Which configuration ensures that the private instances can reach the internet while preventing inbound traffic from the internet?

A.Add a VPC Gateway Endpoint for Amazon S3 to the private subnet route table.
B.Add a route in the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.
C.Add a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway.
D.Create a VPC Peering connection to a public VPC and route traffic through it.
AnswerC

NAT Gateway allows outbound traffic to the internet and blocks unsolicited inbound traffic.

Why this answer

Adding a route in the private subnet route table pointing 0.0.0.0/0 to the NAT Gateway allows private instances to initiate outbound traffic to the internet while preventing inbound connections from the internet. Option A is incorrect because a VPC Gateway Endpoint only provides access to specific AWS services (e.g., S3, DynamoDB), not general internet traffic. Option B is incorrect because routing 0.0.0.0/0 to the Internet Gateway would expose the private instances to inbound traffic from the internet (assuming the route is in the private subnet route table, it would still allow inbound traffic if the instances have public IPs, but more importantly, it bypasses the NAT Gateway's security).

Option D is incorrect because VPC Peering does not provide internet access; it only connects two VPCs.

Practice this question →
354
Multi-Selectmedium

A security engineer notices that an EC2 instance in a public subnet is receiving inbound SSH traffic from a range of IP addresses that should be blocked. Which two actions should the engineer take to troubleshoot? (Choose two.)

Select 2 answers
A.Check the instance metadata for IP restrictions
B.Check the route table associated with the subnet
C.Review the Security Group rules attached to the instance
D.Check the Network ACL associated with the subnet
E.Check VPC Flow Logs to identify the source IP addresses
AnswersC, E

Security groups control inbound traffic to the instance.

Why this answer

Options C and E are correct. Reviewing Security Group rules helps determine if the security group is allowing SSH traffic from the unwanted IPs. Checking VPC Flow Logs can reveal the actual source IP addresses of the traffic.

Option A is incorrect because instance metadata does not contain network access rules. Option B is incorrect because the route table determines routing, not access control. Option D is incorrect because while Network ACLs can block traffic, they are stateless and affect the entire subnet; the first check should be the security group attached to the instance.

Practice this question →
355
Multi-Selecthard

Which THREE components are required to enable AWS Shield Advanced automatic application layer DDoS mitigation for an Application Load Balancer? (Choose three.)

Select 3 answers
A.AWS Shield Advanced subscription
B.Amazon CloudFront distribution in front of the ALB
C.Amazon Route53 DNS configuration
D.An AWS WAF rate-based rule
E.AWS WAF web ACL associated with the ALB
AnswersA, D, E

Required for Advanced features.

Why this answer

Options A, D, and E are correct. AWS Shield Advanced requires an active subscription (A) to enable automatic application layer DDoS mitigation. It integrates with AWS WAF, so a web ACL (E) must be associated with the ALB, and a rate-based rule (D) is needed to trigger automatic mitigation.

Option B (CloudFront) is not required because Shield Advanced can directly protect ALBs without a CDN. Option C (Route53) is also not required for this specific feature.

Practice this question →
356
MCQmedium

A security engineer reviews the NACL entries above for a subnet. Which statement about incoming SSH traffic (port 22) is correct?

A.SSH traffic is allowed only from the 10.0.0.0/8 range.
B.SSH traffic is allowed from all IP addresses.
C.SSH traffic is allowed from 10.0.0.0/8 and denied from all others.
D.SSH traffic is denied from all IP addresses.
AnswerB

Rule 100 allows all SSH traffic; subsequent rules are not evaluated.

Why this answer

NACLs are stateless and rules are evaluated in order by rule number. Rule 100 allows SSH from all IPs. Rule 200 denies SSH from all IPs, but it is not evaluated because rule 100 already allowed.

Rule 300 allows SSH from 10.0.0.0/8 but is not reached. Since rule 100 allows all, SSH is allowed from all IPs. Therefore, option B is correct.

Practice this question →
357
MCQeasy

A company needs to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. Which policy element should be used in an IAM policy to deny access if MFA is not present?

A.Resource
B.Condition
C.Action
D.Effect
AnswerB

Condition can check aws:MultiFactorAuthPresent.

Why this answer

The Condition element in an IAM policy allows you to specify conditions for when a policy is in effect. To deny access if MFA is not present, you use the `aws:MultiFactorAuthPresent` condition key with a Boolean value of `false`. This ensures that only requests authenticated with MFA are allowed, enforcing the security requirement.

Exam trap

The trap here is that candidates often confuse the Condition element with the Resource or Action elements, thinking MFA enforcement is tied to specific resources or actions, rather than understanding it is a contextual check applied via a condition key.

How to eliminate wrong answers

Option A is wrong because the Resource element specifies the AWS resources (e.g., ARNs) the policy applies to, not the authentication context like MFA presence. Option C is wrong because the Action element defines the specific API actions (e.g., ec2:DescribeInstances) that are allowed or denied, not the conditions under which they are evaluated. Option D is wrong because the Effect element only sets whether the policy allows or denies access (e.g., Allow or Deny), but it cannot enforce MFA requirements on its own without a Condition.

Practice this question →
358
MCQmedium

A company has deployed a web application on an EC2 instance that needs to access an S3 bucket and a DynamoDB table. The instance is in a private subnet. Which approach meets the security best practice of avoiding long-lived credentials on the instance?

A.Store IAM user access keys in the application configuration file.
B.Configure security group rules to allow outbound traffic to S3 and DynamoDB endpoints.
C.Use AWS Systems Manager Parameter Store to store credentials and retrieve them at runtime using the instance's IAM role.
D.Create an IAM role with policies granting access to S3 and DynamoDB, and attach the role to the EC2 instance profile.
AnswerD

The instance can obtain temporary credentials from the instance metadata service, eliminating the need for long-lived credentials.

Why this answer

The best practice is to attach an IAM role with the necessary permissions to the EC2 instance. The instance automatically obtains temporary credentials via the instance metadata service, avoiding long-lived credentials. Option D is correct.

Option A (IAM user access keys) is not recommended as they are long-lived. Option B (security group rules) controls network traffic but does not grant access to S3 or DynamoDB. Option C (AWS Systems Manager Parameter Store) still requires credentials to access the parameters, which would not eliminate long-lived credentials.

Practice this question →
359
MCQhard

A CloudFormation stack created a VPC Gateway Endpoint for S3 with the above policy. An EC2 instance in the VPC is unable to download objects from the S3 bucket using the AWS CLI. The instance has an IAM role with s3:GetObject permission. What is the most likely cause?

A.The security group associated with the VPC Endpoint blocks traffic.
B.The VPC Endpoint policy does not allow s3:GetObject.
C.The VPC Endpoint policy does not allow s3:ListBucket, which is needed for the CLI to list objects.
D.The route table for the private subnet does not have a route to the VPC Endpoint.
AnswerC

The CLI often lists objects first, requiring ListBucket permission.

Why this answer

The VPC Endpoint policy shown in the CloudFormation stack (typically allows only s3:GetObject) does not include s3:ListBucket, which is required by the AWS CLI to list objects in a bucket before downloading them. Even though the IAM role has s3:GetObject, the endpoint policy is an additional layer that must also allow the action. Option A is incorrect because Gateway Endpoints do not use security groups.

Option B is incorrect because the endpoint policy does allow s3:GetObject, but the issue is missing ListBucket. Option D is incorrect because the route table must have a route to the endpoint, but the question implies the endpoint is created and associated; the problem is the policy.

Practice this question →
360
Multi-Selecthard

A company is designing a network security architecture for a VPC that hosts a multi-tier application. The security team requires that the web tier can only be accessed from the internet, the application tier can only be accessed from the web tier, and the database tier can only be accessed from the application tier. Additionally, the team needs to ensure that no traffic can bypass these controls. Which THREE actions should the team take?

Select 3 answers
A.Use security group rules that reference other security groups as sources.
B.Configure security groups to allow only necessary traffic between tiers.
C.Configure network ACLs (NACLs) to allow only necessary traffic between subnets as a defense-in-depth measure.
D.Enable VPC Flow Logs on all subnets and send logs to Amazon S3.
E.Attach an internet gateway to the VPC and add a default route to the internet gateway in the web tier subnet's route table.
AnswersA, B, C

This allows allowing traffic from instances in another security group, enforcing tier-to-tier access.

Why this answer

Security group rules can reference other security groups as sources, which allows the web tier security group to permit traffic only from the application tier security group, and the application tier security group to permit traffic only from the database tier security group. This creates a logical, stateful firewall that enforces the required traffic flow between tiers without relying on IP addresses, ensuring that no traffic can bypass the controls even if subnet configurations change.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (a monitoring tool) with a security control, or they mistakenly think that adding an internet gateway alone enforces the tier-to-tier access rules, when in fact the correct actions must directly restrict traffic flow between tiers using security group references, security group rules, and NACLs.

Practice this question →
361
MCQmedium

Refer to the exhibit. A security engineer applies this S3 bucket policy. What is the result of this policy?

A.All objects must be encrypted with SSE-S3 or SSE-KMS.
B.All PutObject requests must use SSE-KMS encryption.
C.All objects must be encrypted with a specific KMS key.
D.All PutObject requests are allowed regardless of encryption.
AnswerB

The policy denies if encryption is not aws:kms.

Why this answer

The S3 bucket policy denies s3:PutObject unless the request uses SSE-KMS encryption (condition StringNotEquals 'aws:kms'). This forces all PutObject requests to use SSE-KMS. Option A is incorrect because the policy does not allow SSE-S3; only SSE-KMS is permitted.

Option C is incorrect because the policy does not require a specific KMS key; it only checks that encryption is SSE-KMS. Option D is incorrect because the policy explicitly denies requests without SSE-KMS, not allows all.

Practice this question →
362
MCQeasy

A company wants to encrypt all data in transit between its on-premises data center and AWS. They are using AWS Direct Connect for connectivity. Which additional configuration is required to ensure encryption?

A.Use MACsec to encrypt the Direct Connect connection
B.Configure TLS on all applications
C.No additional configuration is needed; Direct Connect encrypts traffic automatically
D.Set up an IPsec VPN over the Direct Connect connection
AnswerD

IPsec provides encryption for the entire traffic.

Why this answer

Direct Connect does not provide encryption by default. To encrypt data in transit over Direct Connect, you need to set up an IPsec VPN over the Direct Connect connection. Option A is incorrect because MACsec encrypts at Layer 2, but it is not available on all Direct Connect connections and is different from IPsec.

Option B is incorrect because TLS is for application-level encryption, which may not cover all traffic. Option C is incorrect because Direct Connect does not encrypt traffic automatically. Therefore, option D is correct.

Practice this question →
363
MCQhard

A company is migrating a legacy application to AWS. The application requires that all traffic between the web and application tiers be encrypted, but the application does not support TLS. What should a network engineer do to meet this requirement without modifying the application?

A.Establish a VPN connection between the web and application instances.
B.Use a Network Load Balancer (NLB) with TLS termination and target groups with TCP, then enable encryption on the NLB.
C.Use an Application Load Balancer (ALB) with TLS termination between the tiers.
D.Use a Classic Load Balancer with TCP listeners.
AnswerA

Correct. A VPN connection between instances encrypts all traffic at the network layer, so the application does not need to support TLS. This meets the requirement without modifying the application.

Why this answer

Establishing a VPN connection between the web and application instances encrypts all traffic at the network layer, making encryption transparent to the application. This meets the requirement without modifying the application. Option B is incorrect because a Network Load Balancer with TLS termination only encrypts traffic between clients and the NLB; traffic from the NLB to targets is sent in cleartext, so targets must support TLS for end-to-end encryption.

Since the application does not support TLS, this does not satisfy the requirement. Option C is incorrect because an Application Load Balancer terminates TLS but forwards HTTP traffic to targets in cleartext. Option D is incorrect because a Classic Load Balancer with TCP listeners does not provide any encryption.

Practice this question →
364
MCQhard

A security engineer is designing a network security architecture for a multi-account AWS environment using AWS Organizations. The company requires that all VPC flow logs be delivered to a central S3 bucket in the security account. The security engineer has created a bucket policy that grants the necessary permissions. However, flow logs from member accounts are failing to be delivered. What is the most likely cause?

A.The member accounts have not created an IAM role with permissions to write to the central bucket.
B.The bucket policy does not include a condition that restricts access to the flow log delivery service using aws:SourceArn or aws:SourceAccount.
C.The bucket policy does not grant write access to the member accounts' root user.
D.The central S3 bucket has not been configured with ACLs enabled.
AnswerB

This condition is essential to prevent the confused deputy problem.

Why this answer

The VPC Flow Logs delivery service uses a service-linked role to write to the destination S3 bucket. Without a condition in the bucket policy that restricts access using `aws:SourceArn` or `aws:SourceAccount`, the policy is vulnerable to the confused deputy problem, where a different AWS service or account could potentially write to the bucket. The missing condition causes the delivery to fail because the service cannot verify that the request originated from the expected source.

Exam trap

AWS often tests the confused deputy problem in cross-account service delivery scenarios, and the trap here is that candidates mistakenly focus on IAM roles or root user permissions instead of recognizing that the bucket policy must include a source condition to prevent unauthorized access.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs use a service-linked role (AWSServiceRoleForVPCFlowLogs) that is automatically created in each member account; the engineer does not need to manually create an IAM role for writing to the central bucket. Option C is wrong because granting write access to the member accounts' root user is unnecessary and overly permissive; the bucket policy should grant permissions to the VPC Flow Logs service principal (delivery.logs.amazonaws.com) with the appropriate source condition. Option D is wrong because S3 ACLs are not required for this use case; bucket policies alone can grant cross-account access, and disabling ACLs (the default in modern AWS) does not prevent flow log delivery.

Practice this question →
365
MCQmedium

Refer to the exhibit. A network engineer has configured VPC Flow Logs for a VPC and is verifying the logs. The flow logs are being delivered to CloudWatch Logs, but the engineer notices that the logs do not contain the 'srcaddr' and 'dstaddr' fields. What is the most likely cause?

A.The flow log is configured with TrafficType set to 'REJECT' only
B.The IAM role FlowLogRole does not have permission to write to CloudWatch Logs
C.The flow log is configured with a MaxAggregationInterval of 60 seconds, which causes fields to be omitted
D.The flow log is using the default log format, which does not include source and destination addresses
AnswerD

The default format does not include srcaddr and dstaddr; a custom format is required.

Why this answer

The default log format for VPC Flow Logs does not include source and destination addresses. To include those fields, you must specify a custom format with `${srcaddr}` and `${dstaddr}`. Since the logs are missing these fields, the flow log is likely using the default format rather than a custom one.

Practice this question →
366
MCQeasy

A company is designing a network security architecture for a multi-account AWS environment. They need to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which AWS service should they use to route traffic through the inspection VPC?

A.VPC Peering
B.AWS Direct Connect
C.AWS Transit Gateway
D.VPC Endpoints
AnswerC

Supports hub-and-spoke architecture with inspection VPC.

Why this answer

AWS Transit Gateway allows centralized routing and can forward traffic to a central inspection VPC for firewall inspection. Option A is wrong because VPC Peering does not support transitive routing and is not centralized. Option B is wrong because AWS Direct Connect is for on-premises connectivity, not inter-VPC routing.

Option D is wrong because VPC Endpoints are for private access to AWS services, not for routing inter-VPC traffic.

Practice this question →
367
Drag & Dropmedium

Order the steps to troubleshoot an AWS Direct Connect virtual interface that is in the 'down' state:

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Start with the connection status, then verify virtual interface configuration, check on-premises BGP, test connectivity, and escalate if unresolved.

Practice this question →
368
MCQeasy

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can manage the encryption keys if the company wants to use server-side encryption with AWS KMS?

A.AWS Certificate Manager (ACM)
B.AWS CloudHSM
C.AWS Secrets Manager
D.AWS Key Management Service (KMS)
AnswerD

KMS creates and manages encryption keys used for server-side encryption in S3.

Why this answer

AWS Key Management Service (KMS) is the service that manages encryption keys for server-side encryption (SSE-KMS). Option D is correct. AWS Certificate Manager (ACM) manages SSL/TLS certificates.

AWS CloudHSM provides dedicated hardware security modules but is not required for SSE-KMS. AWS Secrets Manager manages secrets like database credentials.

Practice this question →
369
Multi-Selecteasy

A company needs to encrypt data in transit between an Application Load Balancer and EC2 instances. Which TWO actions should they take?

Select 2 answers
A.Create a TCP listener on the ALB.
B.Place Amazon CloudFront in front of the ALB.
C.Upload a certificate to AWS Certificate Manager (ACM).
D.Configure the ALB target group to use HTTPS protocol.
E.Use a self-signed certificate on the EC2 instances.
AnswersC, D

ACM provides SSL/TLS certificates that can be used by the ALB for HTTPS.

Why this answer

To encrypt traffic between the ALB and EC2 instances, you need to upload a certificate to AWS Certificate Manager (ACM) for the backend HTTPS listener (Option C) and configure the ALB target group to use HTTPS protocol (Option D). Option A (TCP listener) does not support encryption. Option B (CloudFront) is a CDN and not required for backend encryption.

Option E (self-signed certificate) is not recommended for production environments.

Practice this question →
370
Multi-Selecthard

Which THREE services can be used to detect and protect against DDoS attacks? (Choose THREE.)

Select 3 answers
A.AWS Firewall Manager
B.AWS Config
C.AWS Shield Advanced
D.AWS WAF
E.VPC Flow Logs
AnswersA, C, D

AWS Firewall Manager centrally manages AWS WAF rules across accounts and resources, helping to protect against DDoS attacks by enabling consistent web ACLs.

Why this answer

Options A, C, and D are correct. AWS Shield Advanced provides DDoS protection, AWS WAF filters web traffic, and AWS Firewall Manager centrally manages rules. Option B is wrong because AWS Config tracks configuration changes, not DDoS detection.

Option E is wrong because VPC Flow Logs only log traffic.

Practice this question →
371
MCQeasy

A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?

A.AWS WAF
B.Network ACL
C.Security group with outbound rules
D.AWS Network Firewall
AnswerD

Can filter outbound traffic by domain name.

Why this answer

AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A (AWS WAF) is wrong because it works at the application layer for inbound web traffic and does not block outbound traffic at the instance level. Option B (Network ACL) is wrong because NACLs are stateless and work at the subnet level.

Option C (Security group with outbound rules) is wrong because security groups do not support allowlisting based on domain names.

Practice this question →
372
Multi-Selecthard

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across the organization are encrypted with SSE-S3 or SSE-KMS. Which THREE steps should they take to implement this policy?

Select 3 answers
A.Apply a bucket policy in each account that denies PutObject without encryption.
B.Attach the SCP to the root organizational unit (OU) to apply to all accounts.
C.Use a VPC endpoint policy to enforce encryption for all S3 access from the VPC.
D.Use AWS Config rules to check for unencrypted S3 buckets and trigger automatic remediation.
E.Create a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock and s3:CreateBucket without encryption settings.
AnswersB, D, E

Attaching SCP to root OU ensures enforcement across all accounts.

Why this answer

Service control policies (SCPs) can be applied at the root organizational unit (OU) to deny actions that create or modify S3 buckets without encryption (SSE-S3 or SSE-KMS), as in options B and E. AWS Config rules can detect unencrypted buckets and trigger automated remediation, such as enabling default encryption, which addresses existing buckets (option D). Option A is incorrect because bucket policies are account-specific and cannot enforce organization-wide policies.

Option C is incorrect because VPC endpoint policies control network access, not encryption enforcement.

Practice this question →
373
MCQeasy

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted at rest. Which S3 bucket property should be enabled?

A.Versioning
B.MFA Delete
C.Server access logging
D.Default encryption
AnswerD

Default encryption enforces encryption on all objects stored in the bucket.

Why this answer

S3 bucket default encryption ensures that all objects uploaded to the bucket are encrypted at rest. Option A (Versioning) is for preserving object versions, not encryption. Option B (MFA Delete) adds multi-factor authentication for delete operations, not encryption.

Option C (Server access logging) logs access requests, not encryption. Therefore, enabling Default encryption is the correct property to enforce encryption at rest.

Practice this question →
374
MCQhard

A company has a hybrid network architecture with an AWS Direct Connect connection between its on-premises data center and an Amazon VPC. The VPC has a single private subnet with Amazon EC2 instances running a critical application. The on-premises network uses BGP to advertise a route for the VPC's CIDR (10.0.0.0/16) to the on-premises routers. Recently, the company added a new application in a second VPC (VPC-B) with CIDR 10.1.0.0/16 and peered it with the original VPC (VPC-A). After the peering, users on-premises can still reach resources in VPC-A, but cannot reach resources in VPC-B. The VPC-A route table has a route for VPC-B's CIDR pointing to the peering connection. The VPC-B route table has a route for VPC-A's CIDR pointing to the peering connection. The on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface. What is the most likely cause of the issue?

A.The VPC peering connection is not properly configured.
B.The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.
C.The security group on VPC-B instances is blocking inbound traffic from on-premises IP ranges.
D.The virtual private gateway does not have route propagation enabled for VPC-B.
AnswerB

VPC-B needs a route to on-premises CIDR pointing to the virtual private gateway, but that route must be propagated via BGP or added manually.

Why this answer

The on-premises network is not advertising VPC-B's CIDR via BGP over Direct Connect. While the on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface, this only directs traffic from on-premises to VPC-B. For return traffic from VPC-B to on-premises, VPC-B needs a route to the on-premises network.

Normally, this route would be learned via BGP over Direct Connect if the on-premises network advertised the VPC-B CIDR to the VPC. Without that advertisement, VPC-B does not have a route back to on-premises, causing the connectivity failure. Option A is incorrect because the VPC peering connection is working: VPC-A and VPC-B can communicate, as the issue is only with on-premises reachability.

Option C is incorrect because security groups are stateful; if traffic from on-premises reached VPC-B, the return traffic would be automatically allowed. The issue is routing, not security. Option D is incorrect because route propagation for the virtual private gateway only affects VPC-A (if it is attached to the VGW), not VPC-B, which is connected via peering.

Practice this question →
375
MCQeasy

A security engineer needs to centrally manage and enforce rules for network traffic between VPCs in a large AWS environment. Which AWS service provides this capability?

A.VPC peering
B.Security groups
C.Network ACLs
D.AWS Network Firewall
AnswerD

AWS Network Firewall provides centralized firewall management across VPCs.

Why this answer

AWS Network Firewall provides centralized management of firewall rules across multiple VPCs, allowing security engineers to enforce consistent network traffic controls. Option A (VPC peering) is just a connectivity mechanism, not a filtering service. Option B (Security groups) operate at the ENI level and are not centrally managed across VPCs.

Option C (Network ACLs) are stateless and applied per subnet, not centrally. Therefore, D is correct.

Practice this question →
← PreviousPage 5 of 6 · 397 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Network Security, Compliance and Governance questions.

Start 20-question session