Courseiva

CCNA Network Security, Compliance and Governance Questions

22 of 397 questions · Page 6/6 · Network Security, Compliance and Governance · Answers revealed

Practice these questionsDomain overviewAll questions
376
MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. They want to restrict the use of certain instance types across all accounts. Which approach should they use to enforce this policy?

A.Create an IAM policy that denies the ec2:RunInstances action for noncompliant instance types and attach it to each IAM user.
B.Create a service control policy (SCP) that denies the ec2:RunInstances action for noncompliant instance types and attach it to the root organizational unit.
C.Set up AWS Config rules to detect noncompliant instances and trigger an AWS Lambda function to terminate them.
D.Use AWS CloudTrail to monitor ec2:RunInstances events and send alerts.
AnswerB

SCPs can be applied to organizational units to restrict actions across accounts.

Why this answer

Service control policies (SCPs) in AWS Organizations can be used to restrict the use of specific instance types across all member accounts from a central location. Option B is correct. IAM policies are account-specific and cannot be applied across all accounts from a central location.

AWS Config can detect noncompliant instances but cannot prevent them from being launched. AWS CloudTrail is for auditing, not enforcement.

Practice this question →
377
MCQeasy

A security engineer is configuring AWS CloudTrail to log all management events across all regions. The logs must be stored in an S3 bucket that is encrypted with an AWS KMS key. Which bucket policy element is required to allow CloudTrail to write logs?

A.kms:Encrypt
B.kms:GenerateDataKey
C.kms:CreateKey
D.kms:Decrypt
AnswerB

kms:GenerateDataKey is required for CloudTrail to encrypt the logs.

Why this answer

CloudTrail requires kms:GenerateDataKey and kms:Decrypt permissions in the KMS key policy to deliver logs to an encrypted S3 bucket. kms:GenerateDataKey generates a data key for encrypting the log files, while kms:Decrypt validates the key. For this question, kms:GenerateDataKey is the required element for writing logs, as it enables the encryption process.

Practice this question →
378
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centrally enforce that no Amazon S3 buckets are publicly accessible across all accounts. Which solution meets this requirement with the least operational overhead?

A.Use AWS Trusted Advisor to check for public buckets and send alerts.
B.Apply a service control policy (SCP) in AWS Organizations that denies the s3:PutBucketPublicAccessBlock action or enforces a bucket policy condition.
C.Create an IAM role in each account with a policy to deny public bucket access, and require users to assume that role.
D.Configure security group rules to block public internet access to the S3 endpoints.
AnswerB

SCPs centrally enforce rules across all accounts.

Why this answer

A service control policy (SCP) can be applied at the root organizational unit to deny the s3:PutBucketPublicAccessBlock action and enforce that no S3 buckets are publicly accessible across all accounts. Option A is incorrect because Trusted Advisor provides recommendations, not enforcement. Option C is incorrect because IAM roles are per-account and cannot centrally enforce across all accounts without additional overhead.

Option D is incorrect because security groups apply to EC2 instances, not S3 buckets.

Practice this question →
379
MCQmedium

A company has a VPC with public and private subnets. An application running in a private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that traffic to S3 does not traverse the internet. Which solution should the team implement?

A.Establish a VPN connection to AWS and route S3 traffic through the VPN.
B.Configure a NAT gateway in the public subnet and update the private subnet route table with a default route pointing to the NAT gateway.
C.Create a gateway VPC endpoint for S3 and add a route to the endpoint in the private subnet route table.
D.Attach an internet gateway to the VPC and add a route to the S3 prefix list in the private subnet route table.
AnswerC

Gateway endpoints provide private access to S3 without traversing the internet.

Why this answer

A gateway VPC endpoint for S3 allows instances in a private subnet to access S3 privately using AWS's internal network, without traversing the internet. By adding a route to the endpoint's prefix list in the private subnet route table, traffic destined for S3 is directed through the endpoint, which uses AWS PrivateLink to provide highly available, redundant connectivity.

Exam trap

AWS often tests the misconception that a NAT gateway is required for private subnet outbound traffic, but for AWS services like S3, a gateway VPC endpoint provides private connectivity without internet egress.

How to eliminate wrong answers

Option A is wrong because establishing a VPN connection would route traffic over an encrypted tunnel that still traverses the internet or a third-party network, and it does not provide direct private connectivity to S3 without internet egress. Option B is wrong because a NAT gateway in a public subnet enables outbound internet access, but traffic to S3 would still traverse the internet, violating the requirement to avoid internet transit. Option D is wrong because attaching an internet gateway and adding a route to the S3 prefix list would direct traffic to the internet gateway, forcing S3 traffic over the internet, which does not meet the security requirement.

Practice this question →
380
MCQmedium

Refer to the exhibit. A network engineer examines the network ACL for a subnet. Which statement best describes the effect of this network ACL?

A.Both inbound and outbound TCP traffic are allowed
B.Inbound TCP traffic is allowed, but all outbound traffic is denied
C.All inbound traffic is allowed
D.All outbound traffic is allowed
AnswerB

Inbound TCP rule allows TCP; outbound default deny blocks all.

Why this answer

The inbound rule explicitly allows TCP traffic (protocol 6) from any source (0.0.0.0/0). However, the outbound rules consist only of a default deny rule, which blocks all outbound traffic. Therefore, inbound TCP traffic is allowed, but all outbound traffic is denied.

Option A is incorrect because outbound traffic is denied, not allowed. Option C is incorrect because only inbound TCP is allowed, not all inbound traffic. Option D is incorrect because outbound traffic is denied.

Practice this question →
381
MCQhard

A company has a VPC with multiple subnets. They deploy a Network Firewall to inspect traffic. The firewall is configured with a stateful rule that allows outbound HTTP traffic to any destination. However, traffic from an EC2 instance in a private subnet to an external web server fails. The route table for the private subnet has a default route pointing to the firewall endpoint. What is the likely issue?

A.The stateful rule order is incorrect; a default deny rule is blocking traffic.
B.The EC2 instance security group does not allow outbound HTTP.
C.The firewall endpoint is in a different Availability Zone than the instance.
D.The subnet does not have a route to a NAT gateway.
AnswerC

Traffic must be sent to the firewall endpoint in the same AZ; otherwise routing may fail.

Why this answer

The firewall endpoint must be in the same Availability Zone as the subnet's route table target. If the endpoint is in a different AZ, traffic is not properly routed to it. The stateful rule allows HTTP, so A is incorrect.

Security groups do not affect outbound traffic unless explicitly blocked, and default outbound is allow, so B is incorrect. A NAT gateway is not needed when using a firewall, so D is incorrect.

Practice this question →
382
MCQhard

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?

A.Configure a NAT gateway in each VPC
B.Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC
C.Use security group references to allow traffic between the instances
D.Create a Transit Gateway and attach both VPCs
AnswerB

PrivateLink allows connectivity without IP routing, avoiding CIDR overlap issues.

Why this answer

With overlapping CIDRs (both VPCs use 10.0.0.0/16), VPC Peering cannot route traffic correctly due to identical IP ranges. AWS PrivateLink (VPC endpoint services) allows instances in one VPC (service consumer) to access a service hosted in the other VPC (service provider) via private IP addresses, creating a logical connection that bypasses the routing conflict. The service is fronted by a Network Load Balancer, and consumer instances access it through a VPC endpoint.

This works without modifying CIDRs. Option A is incorrect because NAT gateways are used for outbound internet access and do not resolve overlapping CIDR routing. Option C is incorrect because security group references allow traffic based on security group IDs but still rely on IP routing, which fails with overlapping CIDRs.

Option D is incorrect because a Transit Gateway does not resolve overlapping CIDRs; overlapping routes would cause routing conflicts unless additional measures like NAT are used, which the question precludes.

Practice this question →
383
MCQmedium

A company uses AWS Shield Advanced to protect against DDoS attacks. They notice that some legitimate traffic is being throttled during a DDoS event. The security team wants to ensure that legitimate traffic from specific business partners is not affected. Which action should they take?

A.Disable the rate-based rule in AWS WAF during the DDoS event.
B.Increase the global rate limit in AWS Shield Advanced.
C.Add the partners' IP addresses to the AWS Shield Advanced whitelist.
D.Create a rate-based rule in AWS WAF with an IP set that includes the partners' IPs and set the rate limit high for that rule.
AnswerD

Correct. A rate-based rule with an IP set for the partners' IPs and a high rate limit ensures their traffic is not throttled while still protecting against DDoS.

Why this answer

AWS WAF allows you to create rate-based rules that can include an IP set with the partners' IPs and set a high rate limit for that specific rule, thereby excluding legitimate traffic from rate limiting while maintaining protection against DDoS. Option A is wrong because disabling rate-based rules removes protection against DDoS. Option B is wrong because increasing the global rate limit may still throttle legitimate traffic and is not a precise solution.

Option C is wrong because AWS Shield Advanced does not have a whitelist for individual IPs at the application layer; IP whitelisting is done via AWS WAF.

Exam trap

Candidates often confuse AWS Shield Advanced and AWS WAF capabilities. Shield Advanced provides global DDoS protection but does not have application-layer rate limiting; that is handled by WAF.

Practice this question →
384
Multi-Selecthard

A company wants to secure network traffic between on-premises data centers and AWS using AWS Site-to-Site VPN. Which TWO components are required to establish a VPN connection?

Select 2 answers
A.Transit Gateway
B.Customer Gateway (CGW)
C.VPN Connection
D.Direct Connect connection
E.Virtual Private Gateway (VGW)
AnswersB, E

CGW represents the on-premises device.

Why this answer

AWS Site-to-Site VPN requires a Virtual Private Gateway (VGW) on the AWS side and a Customer Gateway (CGW) representing the on-premises VPN device. Option A (Transit Gateway) is not required; it's optional for complex routing. Option C (VPN Connection) is not a component; it's the logical connection object that ties VGW and CGW together.

Option D (Direct Connect connection) is a different service.

Practice this question →
385
MCQmedium

A network engineer is designing a security group for a web application that must allow inbound HTTPS traffic from the internet and outbound traffic to an RDS MySQL database. The web servers are in a public subnet and the RDS database is in a private subnet. What is the most secure way to configure the security groups?

A.Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from Web SG.
B.Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from Web SG.
C.Web SG: inbound HTTPS from 0.0.0.0/0; outbound MySQL to DB SG. DB SG: inbound MySQL from 0.0.0.0/0.
D.Web SG: inbound HTTPS from 0.0.0.0/0; outbound 0.0.0.0/0. DB SG: inbound MySQL from 0.0.0.0/0.
AnswerA

Least privilege: web outbound only to DB, DB inbound only from web.

Why this answer

The most secure configuration. The web server security group allows inbound HTTPS from the internet (0.0.0.0/0) and outbound MySQL traffic specifically to the database security group. The database security group allows inbound MySQL only from the web server security group.

This ensures that only the web servers can communicate with the database, minimizing exposure. Option B is less secure because the web server security group allows outbound traffic to 0.0.0.0/0, which is overly permissive. Option C is incorrect because the database security group allows inbound MySQL from 0.0.0.0/0, exposing the database to the internet.

Option D combines both overly permissive outbound and inbound rules, making it the least secure.

Practice this question →
386
MCQhard

A security engineer is designing a network architecture for a multi-account AWS environment using AWS Organizations. The company requires that all inter-VPC traffic be inspected by a centralized firewall appliance. Which solution provides the most scalable and maintainable inspection architecture?

A.Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall
B.Create VPC peering connections between all VPCs and route traffic through a security VPC with a firewall
C.Use Network ACLs in each VPC to filter traffic between subnets
D.Use a Transit Gateway and attach all VPCs to a centralized inspection VPC that hosts a third-party firewall
AnswerA

This provides scalable, centralized traffic inspection with managed firewall service.

Why this answer

Using a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall provides a scalable and maintainable architecture. Transit Gateway allows all VPCs to connect through a central hub, and AWS Network Firewall provides managed, scalable deep packet inspection. Option B is incorrect because VPC peering does not scale well and requires complex routing.

Option C is incorrect because Network ACLs are stateless and cannot perform deep packet inspection. Option D is incorrect because third-party firewall appliances in a single VPC can become a bottleneck and are less scalable than the managed AWS Network Firewall solution.

Practice this question →
387
MCQhard

A company is designing a network security architecture for a multi-account AWS environment using AWS Organizations. They need to centrally manage and enforce VPC security group rules across all accounts. Which service should they use?

A.AWS CloudFormation StackSets
B.AWS Config
C.AWS Firewall Manager
D.AWS Service Catalog
AnswerC

Firewall Manager provides centralized management and enforcement of security groups and firewall rules across accounts.

Why this answer

AWS Firewall Manager allows centralized management of security groups and AWS WAF rules across accounts in AWS Organizations. Option A is wrong because AWS CloudFormation StackSets deploy resources but do not centrally enforce security group rules. Option B is wrong because AWS Config is for compliance and configuration tracking, not enforcement.

Option D is wrong because AWS Service Catalog is for provisioning approved resources, not managing security groups.

Practice this question →
388
Multi-Selecthard

A company wants to monitor and log all changes to security group rules in their AWS account for compliance purposes. Which TWO services can be used together to achieve this?

Select 2 answers
A.AWS Trusted Advisor
B.VPC Flow Logs
C.Amazon EventBridge
D.AWS Config
E.AWS CloudTrail
AnswersC, E

EventBridge can match CloudTrail events and trigger actions for compliance monitoring.

Why this answer

(Amazon EventBridge) can capture AWS CloudTrail events and trigger notifications. Option E (AWS CloudTrail) logs API calls, including changes to security group rules. Together, they provide monitoring and logging of security group changes.

Option A is wrong because AWS Trusted Advisor provides best-practice checks, not change logging. Option B is wrong because VPC Flow Logs capture traffic, not configuration changes. Option D is wrong because AWS Config records resource state but does not log API calls.

Practice this question →
389
MCQhard

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to ensure that traffic between the on-premises network and AWS is encrypted. Which solution meets this requirement?

A.Establish an IPSec VPN tunnel over the Direct Connect connection using a public VIF or transit VIF.
B.Establish a VPC peering connection between the on-premises network and the VPC.
C.Use a private virtual interface (VIF) over Direct Connect.
D.Use an IPSec VPN connection over the internet.
AnswerA

This encrypts traffic while using Direct Connect's low latency.

Why this answer

Direct Connect does not provide encryption by default. To encrypt traffic between on-premises and AWS over a Direct Connect connection, you can establish an IPSec VPN tunnel over a public VIF or transit VIF. This encrypts the traffic while still using the Direct Connect link.

Option A is correct. Option B (VPC peering) is not applicable to on-premises networks. Option C (private VIF) does not provide encryption.

Option D (IPSec VPN over the internet) does not use Direct Connect and does not meet the requirement to use Direct Connect.

Practice this question →
390
MCQmedium

A company is using AWS CloudFormation to deploy a stack that includes an S3 bucket with a bucket policy that restricts access to a specific VPC endpoint. The stack fails to create, and the error indicates that the bucket policy contains an invalid principal. Which condition key should be used to restrict access to a VPC endpoint in the bucket policy?

A.The condition key aws:SourceVpce
B.The VPC ID
C.The ARN of the VPC endpoint
D.The VPC endpoint service
AnswerA

Correct. `aws:SourceVpce` is a condition key, not a principal, but it is the standard way to restrict access to a specific VPC endpoint in an S3 bucket policy. The question's phrasing is technically imprecise; the correct method uses this condition key in the Condition element.

Why this answer

To restrict access to a specific VPC endpoint in an S3 bucket policy, you must use the `aws:SourceVpce` condition key in the `Condition` element, not a principal. VPC endpoints cannot be specified as principals in policies. Option A correctly identifies the condition key.

Option B (VPC ID) is incorrect because you need the VPC endpoint ID, not the VPC ID. Option C (ARN of the VPC endpoint) is incorrect because ARNs are not used in condition keys for this purpose. Option D (VPC endpoint service) is incorrect because the endpoint service is not used in this condition.

Exam trap

A common mistake is attempting to use a VPC endpoint ARN or ID as a principal in the policy. However, VPC endpoints are not valid principals. The correct method uses the `aws:SourceVpce` condition key.

Practice this question →
391
MCQeasy

A company wants to block inbound SSH traffic to all EC2 instances in a VPC while allowing all other traffic. Which security group rule should be configured?

A.Add an inbound rule to deny TCP port 22
B.Remove any inbound rule that allows TCP port 22
C.Add an inbound deny rule for TCP port 22 to the network ACL
D.Add an outbound rule to deny TCP port 22
AnswerB

Correct. Removing the inbound allow rule for TCP port 22 implicitly blocks SSH traffic because security groups have an implicit deny for any traffic not explicitly allowed.

Why this answer

Security groups are stateful and act as a virtual firewall. By default, all inbound traffic is denied unless explicitly allowed. Therefore, to block SSH traffic, you simply remove any inbound rule that permits TCP port 22.

This is option B. Option A is incorrect because security groups do not support 'deny' rules; they only support allow rules. Option C is incorrect because the question specifically asks about security group configuration, not network ACLs.

Option D is incorrect because outbound rules do not affect inbound traffic, and security groups are stateful, so blocking outbound SSH would not block incoming SSH connections.

Practice this question →
392
MCQmedium

A company wants to audit all changes to security groups in their AWS account. They need to be notified whenever a security group rule is added, modified, or removed. They also want to see who made the change. Which solution should they implement?

A.Use AWS Trusted Advisor to check for security group changes and send email alerts.
B.Use AWS Config to monitor security group changes and trigger a Lambda function to send notifications.
C.Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on EC2 SecurityGroup events, sending notifications via SNS.
D.Enable VPC Flow Logs and analyze logs for changes to security group rules.
AnswerC

CloudTrail logs API calls to create, modify, and delete security group rules. CloudWatch Events can filter on these events and send to SNS for notification.

Why this answer

AWS CloudTrail captures all API calls, including EC2 SecurityGroup-related actions (AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, etc.), recording the identity of the caller. A CloudWatch Events rule can filter for these specific events and trigger an SNS notification, providing both the change details and the IAM user or role that made the change. This meets the audit and notification requirements precisely.

Exam trap

The trap here is that candidates confuse AWS Config's configuration tracking (which detects drift but not per-event user identity) with CloudTrail's API-level audit trail, or they mistakenly think VPC Flow Logs can capture security group changes when they only capture traffic metadata.

How to eliminate wrong answers

Option A is wrong because AWS Trusted Advisor provides best-practice checks and alerts for security group configurations (e.g., overly permissive rules), but it does not log or notify on every individual rule change event, nor does it identify who made the change. Option B is wrong because AWS Config evaluates resource configurations and can detect drift, but it does not natively trigger real-time notifications on every security group rule change; it evaluates on a schedule or on configuration changes, and while it can invoke a Lambda function, it is not the direct, event-driven approach for per-change notifications and does not inherently capture the identity of the user making the change. Option D is wrong because VPC Flow Logs capture network traffic metadata (source/destination IP, ports, protocol) and do not log API-level changes to security group rules; they are used for traffic analysis, not for auditing configuration changes.

Practice this question →
393
MCQeasy

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that only authorized users can access them. Which combination of actions should they take?

A.Use SSE-KMS with a customer managed key and allow CloudTrail to use the key.
B.Disable public access to the S3 bucket and enable versioning.
C.Enable default encryption (SSE-S3) on the S3 bucket and attach a bucket policy that restricts access to authorized IAM principals.
D.Enable SSE-C on the S3 bucket and provide the encryption key in each API call.
AnswerC

SSE-S3 encrypts logs at rest, and bucket policy controls access.

Why this answer

Enabling default encryption (SSE-S3) on the S3 bucket ensures logs are encrypted at rest. Attaching a bucket policy that restricts access to authorized IAM principals ensures only authorized users can access them. This combination fully satisfies both requirements.

Option A (SSE-KMS with a customer managed key) encrypts the logs at rest, but it does not include the access controls needed to ensure only authorized users can access the logs—additional measures would be required. Option B (disable public access and enable versioning) does not encrypt the logs. Option D (SSE-C) is impractical for CloudTrail logs because it requires you to supply encryption keys with every API call and does not inherently restrict access.

Therefore, option C is the correct combination.

Practice this question →
394
Multi-Selectmedium

Which TWO actions improve the security of an AWS account's root user? (Choose two.)

Select 2 answers
A.Create an IAM user with administrative privileges and use it for daily tasks.
B.Enable multi-factor authentication (MFA) on the root user.
C.Share the root user password with the security team.
D.Set a strong password for the root user.
E.Generate an Access Key for the root user and use it for programmatic access.
AnswersA, B

This follows the principle of least privilege and reduces root user usage.

Why this answer

Options A and B are correct. Enabling MFA on the root user is a critical security best practice that adds an extra layer of protection. Creating an IAM user with administrative privileges and using it for daily tasks reduces the need to use the root user, which should be reserved for only a few account and service management tasks.

Option D is incorrect because while a strong password is important, it is not sufficient on its own; MFA provides additional security. Option C is incorrect because sharing the root password violates security best practices. Option E is incorrect because generating an Access Key for the root user is not recommended and increases risk.

Practice this question →
395
MCQhard

A company is using AWS Client VPN for remote access. They want to ensure that only clients with a valid client certificate can connect, and that traffic is routed through a centralized inspection VPC. The VPN endpoint is configured with mutual authentication using server and client certificates. The route table in the VPN VPC has a default route pointing to an AWS Network Firewall endpoint in the inspection VPC. Users report that they can connect to the VPN but cannot access any internal resources. The network engineer checks the Client VPN endpoint configuration and confirms that the authorization rules allow access to the internal CIDR (10.0.0.0/8). What is the most likely cause?

A.The route table in the VPN VPC has a default route (0.0.0.0/0) pointing to the Network Firewall, but the Network Firewall's route table needs a route back to the VPN VPC for the client CIDR, which is missing.
B.The client certificate is not associated with the same CA as the server certificate, causing TLS handshake failure.
C.The subnet route table in the VPN VPC does not have a route for the client CIDR (assigned by the VPN) pointing to the VPN endpoint's network interface.
D.The AWS Network Firewall in the inspection VPC is blocking traffic from the VPN client CIDR because it does not have a rule allowing it.
AnswerA

For traffic to flow, the inspection VPC must have a route back to the VPN VPC for the client CIDR. If the Network Firewall's route table (or the inspection VPC's route table) does not have a route for the client CIDR pointing to the VPN VPC's attachment (e.g., Transit Gateway), return traffic is dropped.

Practice this question →
396
Multi-Selecthard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)

Select 3 answers
A.Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.
B.Set up VPC peering between the inspection VPC and each spoke VPC.
C.Create Transit Gateway route tables that propagate routes from the inspection VPC and associate them with the other VPC attachments.
D.Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.
E.Attach the inspection VPC to the Transit Gateway.
AnswersA, C, E

Correct: Firewall must inspect and forward traffic.

Why this answer

The firewall appliance must be configured for stateful inspection and to route traffic back to the Transit Gateway. Option C is correct because separate Transit Gateway route tables must be created to propagate routes from the inspection VPC and associate them with the spoke VPC attachments, ensuring traffic is directed to the inspection VPC. Option E is correct because the inspection VPC must be attached to the Transit Gateway to receive and forward traffic.

Option B is incorrect because Transit Gateway replaces VPC peering; peering is not used. Option D is incorrect because Direct Connect is not required; the existing VPN connection handles on-premises connectivity.

Practice this question →
397
Multi-Selecthard

Which THREE components are required to establish a site-to-site VPN connection between an on-premises network and AWS? (Choose 3)

Select 3 answers
A.A VPN tunnel between the customer gateway and the virtual private gateway
B.A VPC endpoint for the VPN service
C.An AWS Direct Connect dedicated line
D.A virtual private gateway (VGW) or transit gateway
E.A customer gateway device
AnswersA, D, E

The encrypted connection.

Why this answer

Options A, D, E are correct. A site-to-site VPN requires a VPN tunnel between the on-premises customer gateway and the AWS virtual private gateway (or transit gateway). The customer gateway device (hardware or software) is deployed on-premises to terminate the VPN tunnel.

Option B is incorrect because VPC endpoints are used for private access to AWS services, not for VPN connections. Option C is incorrect because AWS Direct Connect is a dedicated physical connection, not a requirement for a VPN connection.

Practice this question →
← PreviousPage 6 of 6 · 397 questions total

Ready to test yourself?

Try a timed practice session using only Network Security, Compliance and Governance questions.

Start 20-question session