CCNA Network Security Governance Questions

The NAT Gateway is in the public subnet 10.0.1.0/24. For the NAT Gateway to reach the internet, the route table associated with that public subnet must have a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, the NAT Gateway cannot forward traffic from private subnets to the internet.

Since both private subnets have the same route table configuration pointing to the NAT Gateway, the issue is isolated to the NAT Gateway's inability to reach the internet due to the missing route in the public subnet's route table. Options B, C, and D are incorrect: security groups and network ACLs are configured to allow traffic, and the private subnet route tables are correctly set to route to the NAT Gateway.

AWS Network Firewall's stateful rules are only evaluated for traffic that is routed through the firewall endpoint. If the subnet's route table does not include a route directing traffic to the firewall endpoint, the traffic bypasses the firewall entirely, allowing the outbound connection even though the firewall policy denies it. Option A is incorrect because VPC Flow Logs capture all accepted and rejected traffic after security group and NACL evaluation.

Option C is incorrect because the network ACL allows outbound traffic on ephemeral ports, so inbound return traffic is permitted by the default ephemeral port rule. Option D is incorrect because the security group explicitly allows outbound HTTPS (TCP 443) to 0.0.0.0/0, which is permissive.

To secure data in transit between a VPC and an on-premises network over the internet, the valid methods are AWS Direct Connect with a VPN (B), AWS Client VPN (C), and AWS Site-to-Site VPN (E).

S3:x-amz-server-side-encryption-aws-kms-key-id. This condition key in an S3 bucket policy allows you to enforce that objects must be encrypted with a specific AWS KMS key when the SSE-KMS header is used. Option A (kms:ViaService) is a condition key used in KMS key policies, not in S3 bucket policies; it controls which AWS services can use the KMS key.

Option B (s3:x-amz-server-side-encryption) checks the encryption header but cannot enforce a specific KMS key ID—it only checks for the value 'aws:kms' or 'AES256', but not the key ID. Option C (aws:SourceVpce) is used to restrict access to a specific VPC endpoint, not encryption settings. Therefore, only D provides the granularity to require a specific KMS key ID for SSE-KMS.

To allow an EC2 instance to assume an IAM role, two conditions must be met: 1) The role's trust policy must allow the EC2 service principal (ec2.amazonaws.com) to assume the role, 2) The EC2 instance must be launched with an instance profile that includes that role. This is correctly described in option B. Option A is incorrect because the trust policy specifies the service principal, not an IP address.

Option C is incorrect because the permissions policy defines what the role can do, not who can assume it; the trust policy controls who can assume the role. Option D is incorrect because the EC2 instance can access the IAM endpoint via private IP as long as it has network connectivity (e.g., through a VPC endpoint or NAT), and a public IP is not required.

(AWS Network Firewall) is correct because it is a managed service that can inspect traffic between subnets and within a subnet in a VPC, providing stateful and stateless rules for deep packet inspection. Option A (Security Groups) is wrong because they are stateful but cannot inspect traffic within the same subnet; they only allow or deny traffic based on rules. Option B (VPC Flow Logs) is wrong because they capture metadata about traffic but do not inspect packets.

Option D (AWS WAF) is wrong because it is designed for web application layer 7 inspection, not for general network traffic inspection.

And B are correct: AWS WAF protects against common web exploits like SQL injection and cross-site scripting, and AWS Shield Advanced provides enhanced DDoS protection for web applications. Option C (Amazon Inspector) is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not inline protection. Option D (AWS Network Firewall) is a managed network firewall for filtering traffic at the VPC level, not specifically for web exploits.

Option E (Amazon GuardDuty) is a threat detection service that continuously monitors for malicious activity, but it does not provide inline prevention.

The bastion host, located in the public subnet, should allow inbound SSH from the specified IP address range (e.g., corporate network) because users initiate the connection from that range to the bastion. The private instance should only allow inbound SSH from the bastion host's security group, not directly from the IP range, to ensure that all access is mediated through the bastion. Option A is incorrect because the bastion should not allow SSH from the private instance; it's the other way around.

Option B is incorrect because the bastion should allow SSH from the IP range, not from the private instance. Option C is incorrect because the private instance should not allow SSH directly from the IP range, as it violates the principle of using a bastion.

Shield Advanced provides DDoS cost protection (option B) and 24/7 access to the AWS DDoS Response Team (option D). Option A is incorrect because automatic web application firewall rule updates are not a feature of Shield Advanced; AWS WAF can be integrated but rules are not automatically updated. Option C is incorrect because detailed DDoS logs are not a distinct feature of Shield Advanced; both Standard and Advanced provide access to AWS Shield logs.

Option E is incorrect because network-layer DDoS protection (e.g., SYN flood, UDP flood) is provided by both Shield Standard and Shield Advanced; Advanced adds application-layer protection and other benefits.

AWS WAF web ACL attached to the ALB can filter traffic based on IP addresses. Option B is correct because WAF is deployed at the edge (ALB or CloudFront) and can block IP sets. Option A is wrong because security groups are stateful but work at the instance level, not at the edge.

Option C is wrong because NACLs are applied at the subnet level, but ALB is in a subnet, so traffic reaches the ALB first; NACL is stateless and less suitable for layer 7 filtering. Option D is wrong because CloudFront with WAF is also edge, but the question says 'before traffic reaches the ALB' and ALB is already in place; adding CloudFront changes the architecture.

Gateway Load Balancer endpoints in the application VPC allow traffic to be sent to a third-party firewall appliance deployed in a separate inspection VPC across multiple Availability Zones, providing high availability and traffic inspection. Option A is incorrect because Proxy Protocol v2, while used for preserving client IP, does not enable traffic inspection by a firewall. Option B is incorrect because AWS Direct Connect is a dedicated network connection to on-premises, not a mechanism for traffic inspection.

Option C is incorrect because AWS Network Firewall is a managed service that can inspect traffic, but it cannot be used to route traffic to a third-party firewall appliance in a separate VPC; it is itself the firewall.

An AWS Site-to-Site VPN connection establishes a secure, encrypted tunnel between the on-premises network and the Amazon VPC, allowing resources like RDS databases to be accessed privately without traversing the public internet. Option A is incorrect because a NAT gateway enables outbound internet traffic from a private subnet, not inbound private access from on-premises. Option B is incorrect because while Amazon RDS supports interface VPC endpoints, these endpoints are only accessible from within the VPC and do not provide connectivity from an on-premises network; a VPC endpoint alone does not meet the requirement.

Option C is incorrect because VPC Peering connects two VPCs within AWS, not an on-premises network to a VPC.

Creating static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and removing any routes that point directly to other attachments, ensures that all traffic is sent to the inspection VPC. Without static routes, propagated routes from the inspection VPC attachment create routes to the inspection VPC, but other attachments may also propagate routes that allow direct communication, bypassing inspection. Option A is incorrect because enabling route propagation alone does not force traffic through the inspection VPC; it only adds routes automatically, but other routes (e.g., from Direct Connect or VPN attachments) can still allow direct paths.

Option C is incorrect because network ACLs in the inspection VPC control traffic to and from its subnets but do not influence routing decisions in the transit gateway; they cannot prevent traffic from bypassing the inspection VPC. Option D is incorrect because VPC peering connections bypass the transit gateway entirely, so traffic would not be inspected by the Network Firewall in the inspection VPC.

AWS Transit Gateway with a Network Load Balancer (NLB) in front of multiple firewall appliances enables bidirectional traffic inspection and automatic failover. The NLB performs health checks and distributes traffic to healthy firewall instances, ensuring high availability. Option B is wrong because VPC Peering does not support a central inspection point; traffic flows directly between VPCs without passing through a firewall.

Option C is wrong because a single firewall instance is a single point of failure, lacking automatic failover. Option D is wrong because AWS PrivateLink uses VPC Endpoints for connectivity, which does not allow traffic inspection by a third-party firewall in the consumer VPC; it only allows one-way initiated connections.

The policy allows any principal (Principal: '*') to perform the s3:GetObject action under the condition that the request comes from the specified IP range. However, this condition only checks the IP address; it does not require authentication. If the bucket is publicly accessible (no bucket policy or ACL denying anonymous access), then unauthenticated requests from the allowed IP range would be allowed, which is a security issue.

Option A is wrong because the condition belongs on the Action element, not the Principal. Option B is wrong because the Resource ARN includes the bucket name correctly (arn:aws:s3:::example-bucket/*). Option D is wrong because the IP range is specific and appropriate for the requirement.

Direct Connect does not inherently encrypt traffic. To encrypt all traffic between on-premises and the VPC, you can establish an IPsec VPN tunnel over the Direct Connect link. This encrypts traffic at the network layer.

Option A is incorrect: MACsec provides physical-layer encryption but is not supported on all Direct Connect connections and does not encrypt all traffic end-to-end. Option C is incorrect: Direct Connect virtual interfaces do not provide encryption. Option D is incorrect: TLS is an application-layer protocol; it would require individual applications to support it and does not encrypt all traffic at the network layer.

A security group on the RDS instance that allows inbound MySQL traffic from the security group of the EC2 instances restricts access to only those instances that are members of that security group. Option A is incorrect because network ACLs are stateless and operate at the subnet level, requiring explicit inbound and outbound rules; they cannot reference security groups. Option B is incorrect because a VPN connection is used for connectivity to external networks, not for communication within the same VPC.

Option D is incorrect because IAM database authentication controls user authentication to the database, not network-level access from EC2 instances.

AWS WAF (Option B) is the correct service because it integrates with Application Load Balancers to filter HTTP/HTTPS requests and can block common web exploits such as SQL injection and cross-site scripting. AWS Shield Advanced (Option A) provides enhanced DDoS protection, which does not mitigate web application layer attacks like SQL injection or XSS. AWS Network Firewall (Option C) operates at the network layer and is not designed for application-layer threats.

Amazon GuardDuty (Option D) is a threat detection service, not a prevention tool. AWS Firewall Manager (Option E) centralizes firewall rule management but does not directly protect against web exploits. Therefore, only Option B is correct for this requirement.

SCPs can be applied to the root OU to deny s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption unless the bucket meets encryption and public access requirements, thus enforcing the policy organization-wide. Option C is correct because AWS Config conformance packs can include managed rules to detect buckets without encryption or with public access, and automatic remediation actions can be configured to fix non-compliant buckets. Option B is incorrect because an S3 bucket policy only applies to a single bucket and cannot enforce requirements across all buckets in all accounts; it also cannot prevent creation of buckets that don't meet the policy.

Option D is incorrect because CloudTrail only provides logging and alerting; it does not enforce or remediate. Option E is incorrect because an IAM role with MFA requirement does not enforce encryption or public access settings on buckets; it only controls who can create buckets.

Gateway Load Balancer (GWLB) with Gateway Load Balancer endpoints (GWLBe) allows you to insert third-party appliances inline for traffic inspection without changing the instances' private IP addresses. The GWLB acts as a transparent layer between the VPC and the appliance, inspecting all traffic. Option A is incorrect because a Transit Gateway with a site-to-site VPN does not provide inline inspection without modifying the routing and IP addresses.

Option C is incorrect because VPC Peering does not inherently provide traffic inspection; you would still need to route traffic through an appliance. Option D is incorrect because a Network Load Balancer is designed for load balancing, not for inline inspection of all traffic.

AWS Direct Connect with a private VIF does not inherently encrypt traffic; a VPN overlay would be required, and a single Direct Connect connection is not highly available. Option B is incorrect because a single VPN tunnel provides encryption but not high availability; if the tunnel fails, connectivity is lost. Option C is correct because a VPN connection with two tunnels to the same virtual private gateway provides redundancy for the tunnels, and the virtual private gateway is a highly available service within a region.

Option D is incorrect because an AWS VPC can only have one virtual private gateway; you cannot attach two virtual private gateways to the same VPC. The recommended design for high availability is to use a single VPN connection with two tunnels (Option C) or multiple VPN connections to different VPCs.

To encrypt data in transit between an Application Load Balancer (ALB) and its target EC2 instances, only the target group protocol needs to be configured to use HTTPS (Option B). The ALB listener protocol (HTTPS) encrypts traffic between the client and the ALB, not between the ALB and targets, so Option D is not required for this specific goal. Option A is incorrect because Client Certificate Authentication is for mutual TLS between client and ALB.

Option C is incorrect because adding a listener rule based on path affects traffic routing, not encryption. Option E is incorrect because security group rules control access but do not encrypt traffic.

Creating a rate-based rule can limit the request rate from the specific IP range, allowing legitimate traffic while still blocking excessive requests that may be part of a SQL injection attempt. This maintains security by not outright allowing the IP range or disabling protections. Option A is wrong because disabling the SQL injection rule for the IP range removes protection against actual SQL injection attacks from that range.

Option B is wrong because increasing the rate limit for the entire WAF is not granular and may affect other traffic. Option C is wrong because adding the IP range to the allow list completely bypasses security, leaving the application vulnerable.

The correct components are B, C, and E. Option B (AWS Network Firewall in an inspection VPC) provides the central firewall to inspect inter-VPC traffic. Option C (Virtual Private Gateway (VGW) attachment to the inspection VPC) enables on-premises Direct Connect traffic to be routed through the inspection VPC and firewall.

Option E (AWS Transit Gateway with multiple route tables) allows segmentation of traffic and ensures that inter-VPC traffic and traffic to/from on-premises is routed through the inspection VPC. Option A (VPC peering connections between all VPCs) is not needed because Transit Gateway provides the connectivity. Option D (NAT gateways in each VPC) is not required because internet egress is centralized through an egress VPC, not through individual NAT gateways.

To access an S3 bucket in another region from a VPC while keeping traffic on the AWS network, you can route traffic through a Direct Connect public virtual interface (VIF). A NAT gateway in the VPC can be used to route traffic from private subnets to the public VIF, which then connects to the S3 public endpoint across the AWS global backbone. This ensures traffic does not traverse the public internet.

Option A is incorrect because VPC Gateway Endpoints are regional and can only be used for S3 buckets in the same region. Option B is incorrect because VPC Interface Endpoints for S3 are region-specific and cannot be used to access S3 buckets in another region. Option D is incorrect because VPN connections cannot be established directly to S3 buckets.

The route table for the private subnet likely has a default route pointing to a NAT gateway or internet gateway, causing traffic to bypass the proxy server. Even though security groups are configured correctly, routing decisions are made first. Traffic from the private instance to the proxy server would be directed to the default gateway (NAT/internet gateway) instead of the proxy's IP address.

Option A is incorrect: the security group for the private instance does allow outbound HTTP/HTTPS to the proxy. Option B is incorrect: network ACLs are stateless and must allow both inbound and outbound; but if they blocked inbound from the proxy, that would affect return traffic, not the initial connection. Option D is incorrect: the proxy's security group is configured to allow inbound from the private instance.

Security groups can reference security groups from peered VPCs across accounts when the VPC peering connection is active, allowing fine-grained control over specific TCP ports at the instance level. Option A is incorrect because modifying network ACLs is possible but they are stateless and apply at the subnet level, not instance level; also, network ACLs cannot reference security groups from peered VPCs. Option B is incorrect because network ACLs are stateless, not stateful; security groups are stateful.

Option D is incorrect because route tables control the path of traffic, not port-level filtering; they cannot deny traffic based on ports.

A service control policy (SCP) can deny the s3:PutBucketPublicAccessBlock action or enforce the block public access settings across all accounts in the organization. Option A (CloudTrail) is incorrect because CloudTrail only logs API calls for auditing, it does not enforce compliance. Option B (AWS Config) is incorrect because although AWS Config can detect noncompliant buckets, it requires additional automation for remediation and is not a direct enforcement mechanism like an SCP.

Option D (IAM role) is incorrect because IAM roles grant permissions to principals and cannot enforce bucket-level settings across accounts; SCPs are the appropriate tool for organization-wide policy enforcement.

To access S3 from a private subnet using a VPC endpoint, two configurations are required. First, an endpoint policy must be created (Option B is correct) to control which S3 buckets and actions are allowed. Second, a route must be added in the private subnet's route table pointing to the gateway endpoint (Option D is correct) to direct S3 traffic through the endpoint.

Option A is incorrect because assigning a public IP to the EC2 instance is not needed; the endpoint provides private connectivity. Option C is incorrect because a NAT gateway is not required when using a VPC endpoint. Option E is incorrect because gateway endpoints do not use security groups; they use endpoint policies for access control.

To restrict S3 bucket access based on the requester's network, you can use an S3 bucket policy with the aws:SourceIp condition to allow only requests from specified on-premises IP ranges (option E). However, if requests originate from within a VPC, they might appear to come from the VPC's public IPs (e.g., through a NAT gateway) rather than the on-premises IPs. To handle this, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket (option B).

This ensures traffic from the VPC to S3 goes through the endpoint and can be controlled separately. Option A is incorrect because using Elastic IPs does not reliably restrict access; the bucket policy would need to allow specific Elastic IPs, but this does not account for on-premises IPs. Option C is incorrect because AWS WAF is for web application traffic, not S3 bucket access.

Option D is incorrect because S3 Block Public Access prevents public access but does not restrict based on the requester's network.

The correct answers are D and E. D: AWS Transit Gateway enables transitive routing between VPCs. By configuring appropriate route tables, traffic from source VPCs can be directed to the inspection VPC for centralized inspection.

E: After the inspection appliance processes the traffic, it must be forwarded to its final destination. This requires proper routing in the inspection VPC to send the inspected traffic out to the internet or to another VPC. Option A is incorrect because VPC endpoints only provide private access to AWS services, not general internet traffic routing.

Option B is incorrect because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing between VPCs. Option C is incorrect because VPC peering does not support transitive routing; it only allows direct communication between two VPCs, not through a third VPC.