VPC practice questions

Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

Why wrong: Requires manual configuration for each log type and account.

Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

Why wrong: Does not centralize log delivery; requires multiple buckets.

Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

Why wrong: Does not use customer-managed KMS key.

The member account must create an IAM role to assume for launching resources in the shared subnet.

Why wrong: No IAM role is needed; resources can be launched directly.

The member account must create a VPC and then associate the shared subnet.

Why wrong: The shared subnet is already associated with the member account's VPC.

The member account must accept the resource share invitation.

Why wrong: Resource shares within the organization are automatically accepted.

Use AWS Config rules to detect missing flow logs and send alerts to the security team.

Why wrong: Does not automatically enable flow logs.

Use an SCP to require that VPC flow logs be enabled.

Why wrong: SCPs cannot enable features; they only deny or allow actions.

Manually enable VPC flow logs in each account and region, and specify the central S3 bucket as the destination.

Why wrong: Does not scale to many accounts.

Disable public access to all S3 buckets and restrict cross-account access.

Why wrong: This is a part of data perimeter but not sufficient; exfiltration can still occur via authorized services like EC2 to external IPs.

Use VPC endpoints for all AWS services and ensure they are private.

Why wrong: VPC endpoints ensure traffic stays within the AWS network but do not prevent exfiltration to unauthorized accounts.

Use security groups to restrict outbound traffic to known IP addresses.

Why wrong: Security groups are stateful but cannot control data exfiltration via services like S3 that use public endpoints.

Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

Why wrong: Transit Gateway does not provide subnet-level sharing; it only routes traffic.

Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

Why wrong: VPC Peering does not allow subnet sharing; it connects VPCs at the network layer.

Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

Why wrong: SCPs cannot condition on subnet ownership across accounts; they apply to the entire account.

Amazon Simple Notification Service (SNS)

Why wrong: SNS is for notifications.

AWS Secrets Manager

Why wrong: Secrets Manager is for secrets, not outputs.

AWS Systems Manager Parameter Store

Why wrong: Not the native way; cross-stack references are better.

Use AWS Config rules to automatically delete non-compliant VPCs.

Why wrong: Config cannot prevent creation; it can only detect and remediate after.

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Why wrong: IAM policies are account-specific; SCPs are needed for organization-wide enforcement.

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Why wrong: Monitoring is not enforcement.

Use Amazon Kinesis Data Firehose to stream logs to the central bucket.

Why wrong: Adds unnecessary complexity.

Create a CloudWatch Logs subscription in the central account that receives logs from all accounts.

Why wrong: Cannot receive across accounts without subscription filter.

Create a CloudWatch Logs log group in each member account and use a subscription filter to forward to a central S3 bucket via Kinesis.

Why wrong: This option fails because VPC Flow Logs can be configured to publish directly to an S3 bucket, bypassing the need for an intermediary CloudWatch Logs log group and Kinesis. While CloudWatch Logs subscription filters can forward logs for real-time processing or to other destinations, introducing Kinesis adds unnecessary complexity and cost when the requirement is direct S3 archival. This method would be suitable if real-time analysis or transformation of the log data was needed before storage, or if the logs were destined for a different service like a custom analytics platform.

Use Amazon Cognito user pools for authentication.

Why wrong: Cognito is for external user identities, not Windows authentication.

Use AWS Identity and Access Management (IAM) roles to authenticate users.

Why wrong: IAM roles are for AWS service access, not application-level Windows auth.

Use AWS Security Token Service (STS) to issue tokens for authentication.

Why wrong: STS issues temporary credentials, not authentication tokens for Windows.

Establish VPC peering between the workload VPCs and the networking account VPC.

Why wrong: VPC peering is not needed for DNS forwarding when Transit Gateway is used.

Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.

Why wrong: Private hosted zone resolves domain names to AWS resources, not forwarding to on-premises.

Create a Route 53 Resolver inbound endpoint in the networking account.

Why wrong: Inbound endpoint is for on-premises to resolve AWS resources, not the other way.

The internet gateway is not attached to the VPC

Why wrong: The exhibit implies it is attached.

The subnet needs a NAT gateway for internet access

Why wrong: A NAT gateway is needed for private subnets, but this subnet can be public if it assigns public IPs.

The subnet's route table does not have a route to the internet gateway

Why wrong: The exhibit states the route exists.

Configure the Transit Gateway to propagate routes directly between VPCs.

Why wrong: Would bypass the firewall inspection.

Use a single route table in the Transit Gateway for all VPC attachments.

Why wrong: Does not allow asymmetric routing through firewall; need separate route tables.

Remove the SCP from the root.

Why wrong: This would remove security controls entirely.

Modify the bucket policy to allow s3:PutObject without tags.

Why wrong: The SCP denies at the organization level, overriding the bucket policy.

Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.

Why wrong: This is a temporary workaround and does not address the root cause; also requires reconfiguring all accounts.

The route table does not have a default route (0.0.0.0/0).

Why wrong: The route table shows a 0.0.0.0/0 route.

The VPC does not have a local route.

Why wrong: The local route is present.

The route table is not associated with the subnet.

Why wrong: The association shows the route table is associated with subnet-11111.

The instance does not have a public IP address.

Why wrong: While an instance without a public IP cannot be reached from the internet, the question implies SSH from the internet is allowed by the security group, so the missing public IP is a possible cause but less common than a network ACL misconfiguration.

The instance is failing system status checks.

Why wrong: System status checks monitor the health of the underlying hardware; a failing check would cause the instance to stop or be impaired, but it wouldn't specifically block SSH traffic.

The security group is not attached to the instance.

Why wrong: Security groups are attached at launch; if the security group were not attached, SSH would still be blocked even if the rule exists, but the question states the security group allows SSH.

Amazon Inspector.

Why wrong: Security vulnerability assessment.

AWS CloudTrail.

Why wrong: Records API activity, not network traffic.

AWS Config.

Why wrong: Monitors resource configuration changes.

VPC Flow Logs

Why wrong: VPC Flow Logs capture metadata about IP traffic reaching elastic network interfaces, not the data-plane API calls made to S3 objects. They cannot log which IAM principal performed a GetObject request or whether the request was decrypted with a KMS key, so they fail to meet the audit requirement for object-level access. This option is tempting because Flow Logs are a standard tool for network-traffic auditing, and they would be the correct choice if the company needed to monitor allowed or denied connections to an EC2 instance’s network interface rather than S3 API operations.

Amazon CloudWatch Logs

Why wrong: CloudWatch Logs can store logs but doesn't generate them from S3 access.

AWS Config

Why wrong: Config records configuration changes, not access.

Use CloudFormation StackSets to deploy Route 53 private hosted zones in each account

Why wrong: This does not centralize DNS management.

Create a VPC peering connection between each VPC and the central account's VPC

Why wrong: VPC peering does not automatically resolve private hosted zones across accounts.

Use AWS PrivateLink to connect VPCs to a central DNS service

Why wrong: PrivateLink is for accessing services via NLB, not for DNS resolution.

IPAM must be used only from the management account and cannot be delegated

Why wrong: IPAM supports delegated administrators.

IPAM is not supported in the AWS Region where the delegated administrator account operates

Why wrong: IPAM is supported in most commercial regions.

An SCP in the organization denies IPAM actions for all accounts

Why wrong: If SCP denied IPAM, the management account would also be affected.

Use AWS Lambda to proxy database requests from member accounts.

Why wrong: Adds latency and complexity.

Make the RDS instance publicly accessible and use IAM authentication.

Why wrong: Security risk; prefer private connectivity.

Create a VPC peering connection between each member VPC and the shared services VPC.

Why wrong: VPC peering is not transitive; a Transit Gateway is better for many VPCs.