How should I use these Network Security, Compliance and Governance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

ANS-C01 · topic practice

Network Security, Compliance and Governance practice questions

Q: Can I practise just Network Security, Compliance and Governance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Security, Compliance and Governance domain.

Practise AWS Certified Advanced Networking Specialty ANS-C01 Network Security, Compliance and Governance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Security, Compliance and Governance

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Security, Compliance and Governance

Network Security, Compliance and Governance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Network Security, Compliance and Governance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Network Security, Compliance and Governance questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full VPN explanation →

A company has a hybrid network with an AWS Direct Connect connection to a VPC. They also have a site-to-site VPN connection as a backup. The VPC routing tables are configured with a route to the on-premises CIDR via the virtual private gateway. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect connection even when it is healthy. What is the most likely cause?

Trap 1: The VPN connection is down

If the VPN is down, traffic would be routed via Direct Connect if the route exists.

Trap 2: The VPN connection is attached to a Customer Gateway

The AWS Site-to-Site VPN connection uses a virtual private gateway or transit gateway, not a Customer Gateway as the target.

Trap 3: The Direct Connect virtual interface is in the 'Down' state

The Direct Connect virtual interface must be in the 'Available' state to pass traffic.

Study all Network Security, Compliance and Governance common traps →

A
The VPC route table has a more specific route pointing to the VPN connection
If the VPN BGP route is more specific (e.g., /24 vs /16), it will take precedence over the static route to Direct Connect.
B
The VPN connection is down
Why wrong: If the VPN is down, traffic would be routed via Direct Connect if the route exists.
C
The VPN connection is attached to a Customer Gateway
Why wrong: The AWS Site-to-Site VPN connection uses a virtual private gateway or transit gateway, not a Customer Gateway as the target.
D
The Direct Connect virtual interface is in the 'Down' state
Why wrong: The Direct Connect virtual interface must be in the 'Available' state to pass traffic.

Network Security, Compliance and Governance practice questions

What to know about Network Security, Compliance and Governance

Common Network Security, Compliance and Governance exam traps

Network Security, Compliance and Governance questions

A company uses AWS Shield Advanced for DDoS protection. During an attack, the security team notices that legitimate traffic is being throttled. They want to allow certain known IP addresses to bypass Shield Advanced rate-based rules. What should they do?

Refer to the exhibit. A network engineer is troubleshooting connectivity issues from an EC2 instance in subnet-11111111. The instance can send traffic outbound, but cannot receive inbound HTTPS traffic from the internet. What is the likely cause?

A company is designing a network security architecture for a multi-tier application. The web tier must be accessible from the internet, while the application and database tiers must be isolated. The security team wants to minimize the attack surface. Which design should they choose?

A company wants to secure data at rest in an Amazon S3 bucket. Which TWO of the following can be used to achieve this? (Choose two.)

A security engineer created the S3 bucket policy shown. After applying it, users from the 10.0.0.0/16 network (VPC CIDR) are able to access objects, but external users from 203.0.113.0/24 receive 'Access Denied' even though they are using HTTPS. What is the likely cause?

Exhibit

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet that needs to access an S3 bucket in the same region. Which approach provides the most secure and cost-effective access?

A network security engineer is reviewing the NACL configuration. An EC2 instance in the subnet associated with this NACL is not receiving SSH connections from the internet. What is the issue?

A company has a requirement to encrypt all data in transit between its on-premises network and AWS over a VPN connection. Which solution provides encryption in transit?

A network engineer needs to block traffic from a specific IP address to an EC2 instance. Which component should be modified?

A company wants to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy element should be used?

A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should they use?

A company is deploying a web application that must be accessible over the internet from specific IP addresses only. The application runs behind an Application Load Balancer (ALB) in a VPC. Which AWS service should be used to restrict access to the ALB based on source IP addresses?

Which TWO actions can be used to improve the security of an Amazon S3 bucket that contains sensitive data? (Choose two.)

A company wants to restrict access to an EC2 instance such that only traffic from a specific security group (sg-12345678) can reach it. The instance is in a VPC with default network ACLs. What should the security group rule for the instance be?

A company has a VPC with a public subnet containing a NAT gateway and a private subnet with EC2 instances. The EC2 instances need to access an S3 bucket. The security team wants to log all S3 API calls made by the instances. Which approach should be used?

A company needs to audit all changes to security groups in their AWS account. Which AWS service should they use?

A company has a VPC with an internet-facing Application Load Balancer (ALB) that routes traffic to EC2 instances in private subnets. The security team wants to block traffic from specific geographic regions. Which AWS service should they use?

Track your progress over time

Start a Network Security, Compliance and Governance only practice session

Related ANS-C01 topic practice pages

Network Management and Operations practice questions

Network Security, Compliance and Governance practice questions

Network Design practice questions

Network Implementation practice questions

ANS-C01 fundamentals practice questions

ANS-C01 scenario practice questions

ANS-C01 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid