Network Security, Compliance, and Governance — ANS-C01 Practice Quiz

Question 1

A financial services company runs a public-facing web application behind an internet-facing Application Load Balancer (ALB) with an HTTPS listener using an ACM certificate. A compliance audit requires that all TLS connections enforce forward secrecy and disallow any TLS versions below 1.2. The security team must ensure that the ALB rejects clients that cannot negotiate a cipher supporting forward secrecy, while minimizing operational overhead. What is the MOST appropriate action?

Accepted Answer

Apply a predefined ELB security policy on the HTTPS listener (for example, ELBSecurityPolicy-FS-1-2-Res-2020-10) that enforces TLS 1.2+ and forward-secrecy ciphers.

Answer

Attach an AWS WAF web ACL to the ALB with a rule that inspects the TLS handshake and blocks weak ciphers.

Answer

Import a stronger ACM certificate that only supports ECDHE cipher suites so weak clients are automatically rejected.

Answer

Place a Network Load Balancer in front of the ALB and terminate TLS on the NLB using a custom OpenSSL cipher configuration.

Question 2

A financial services company exposes a partner-facing REST API behind an Application Load Balancer (ALB) with an HTTPS listener. Security policy now requires that only partner client applications presenting a certificate issued by the company's own private certificate authority may connect, and any connection presenting an untrusted or expired client certificate must be rejected at the ALB before reaching the backend targets. The team wants a managed solution that minimizes custom code on the targets. Which approach meets these requirements?

Accepted Answer

Configure mutual TLS (mTLS) on the ALB HTTPS listener in verify mode, using a trust store in Amazon S3 that contains the private CA's certificate bundle, and let the ALB validate and reject untrusted client certificates.

Answer

Enable mTLS on the ALB in passthrough mode and have each backend target application parse the X-Amzn-Mtls-Clientcert header to validate the certificate chain and expiry.

Answer

Place an AWS WAF web ACL on the ALB with a rule that inspects the TLS client certificate and blocks requests when the issuer does not match the private CA.

Answer

Terminate TLS on a Network Load Balancer with a certificate from AWS Private CA, then forward to the ALB, relying on the NLB to authenticate client certificates.

Question 3

A financial services company must ensure that no network ACL in any of its 40 member accounts allows unrestricted inbound SSH (TCP port 22 from 0.0.0.0/0). The security team wants automatic detection of violations across all accounts and regions, plus automatic remediation that removes the offending rule whenever one appears. The solution must produce an auditable record of compliance status for regulators. Which approach best meets these requirements?

Accepted Answer

Deploy an AWS Config organization managed rule (via delegated administrator) that checks NACL rules for unrestricted port 22 access, and attach an SSM Automation remediation action that removes the non-compliant entry.

Answer

Enable VPC Flow Logs in every account and use a scheduled Lambda function to parse the logs for SSH traffic from the internet, then invoke an API call to delete the NACL rule.

Answer

Create an AWS WAF web ACL with a rule blocking port 22 and associate it with each VPC to prevent inbound SSH from the internet.

Answer

Use Amazon GuardDuty across the organization to detect SSH brute-force findings and trigger an EventBridge rule that modifies the security groups to deny port 22.

Question 4

A financial services company operates 40 AWS accounts under AWS Organizations, spread across three Regions. The security governance team must continuously evaluate whether any security group in any account permits unrestricted inbound SSH (0.0.0.0/0 on port 22), and they need a single consolidated view of all non-compliant resources across the entire organization without logging into each account. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Config with the restricted-ssh managed rule in every account and Region using a CloudFormation StackSet, then create an organization-wide AWS Config aggregator in a delegated administrator account to view aggregated compliance results.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect SSH traffic sourced from 0.0.0.0/0.

Answer

Create a single AWS Config rule in the management account and rely on cross-account IAM roles so the rule evaluates security groups in all member accounts and Regions.

Answer

Use AWS Security Hub in one account with the CIS benchmark enabled and manually export findings from each member account into a spreadsheet weekly.

Question 5

A financial services company operates 40 AWS accounts under AWS Organizations. The security governance team must continuously detect and report on security groups that allow unrestricted inbound access (0.0.0.0/0) to ports other than 80 and 443 across all accounts and Regions, and produce a single compliance dashboard for auditors. Which approach best meets these governance requirements with the least operational overhead?

Accepted Answer

Deploy an AWS Config conformance pack containing the restricted-common-ports and vpc-sg-open-only-to-authorized-ports managed rules using an organization-level deployment via the delegated administrator account, aggregating results with a Config aggregator.

Answer

Enable VPC Flow Logs in every account, stream them to a centralized S3 bucket, and run scheduled Athena queries to identify traffic arriving on unauthorized ports from any source.

Answer

Write a Lambda function in each account triggered by EventBridge on a daily schedule that calls DescribeSecurityGroups and publishes non-compliant findings to a central SNS topic.

Answer

Configure AWS Network Firewall in a centralized inspection VPC with stateful rules that block inbound traffic to ports other than 80 and 443, and review the firewall logs for compliance reporting.

Question 6

A security team manages a centralized audit account and needs to continuously verify that no VPC across 40 member accounts (in an AWS Organization) has an internet gateway attached to subnets tagged 'PCI-Restricted'. The team wants a scalable, near-real-time governance solution that produces findings in the audit account without deploying custom Lambda in each member account. Which approach best meets this requirement?

Accepted Answer

Deploy an AWS Config organization custom rule (using a Config-managed Lambda in the delegated administrator account) that evaluates route table associations for PCI-Restricted subnets, and aggregate results in the audit account via an organization aggregator.

Answer

Enable VPC Flow Logs in every member account, stream them to a centralized S3 bucket, and run scheduled Athena queries to detect traffic to 0.0.0.0/0 through an internet gateway.

Answer

Create an IAM role in each member account trusted by the audit account and run a scheduled script that calls DescribeRouteTables in every account to check for igw- routes.

Answer

Use AWS Network Firewall in a centralized inspection VPC with a stateful rule that drops traffic from PCI-Restricted subnets destined to internet gateways, and review the alert logs.

Question 7

A financial services company must inspect all north-south traffic leaving its production VPC with a fleet of third-party stateful firewall appliances. Security requires that the appliances see the true 5-tuple of every flow and that traffic is transparently forwarded without the appliances needing to perform source NAT. The networking team wants a solution that scales horizontally, preserves flow symmetry, and integrates with Auto Scaling for the appliance fleet. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Deploy the appliances behind a Gateway Load Balancer, and route VPC egress traffic through Gateway Load Balancer endpoints; the GENEVE encapsulation preserves the original packet for transparent inspection.

Answer

Deploy the appliances behind a Network Load Balancer with TLS passthrough, and use NLB target groups to distribute flows across the appliance fleet.

Answer

Deploy the appliances behind an Application Load Balancer using IP target groups, relying on the X-Forwarded-For header to preserve the client source IP for the appliances.

Answer

Configure each appliance as a next hop in the VPC route table using individual static routes, and use a Lambda function to rewrite routes when Auto Scaling adds or removes an instance.

Question 8

A financial services company must inspect all outbound TLS traffic from a centralized inspection VPC using third-party firewall appliances behind a Gateway Load Balancer. A compliance mandate requires that the private keys used for TLS decryption never be exportable in plaintext and that all cryptographic operations be performed on FIPS 140-2 Level 3 validated hardware under the company's sole control. The security team wants to minimize custom key-handling code on the appliances. Which approach BEST satisfies these requirements?

Accepted Answer

Configure the firewall appliances to use keys stored in an AWS CloudHSM cluster, integrating via the PKCS#11 library so private key operations occur inside the FIPS 140-2 Level 3 HSMs

Answer

Store the TLS private keys as encrypted secrets in AWS Secrets Manager and have each appliance decrypt them at boot using an AWS KMS customer managed key

Answer

Use AWS Certificate Manager to issue the decryption certificates and attach them directly to the Gateway Load Balancer for inline TLS termination

Answer

Enable AWS Network Firewall TLS inspection with a KMS customer managed key and route the inspection VPC traffic through it instead of the appliances

Question 9

A financial services company runs a centralized inspection VPC using AWS Network Firewall to inspect all egress traffic from workload VPCs attached to a Transit Gateway. Auditors require that the security team be able to prove, on demand, exactly which domains each workload attempted to reach over the past 90 days, including connections that were ultimately blocked, without dropping any legitimate traffic during the initial rollout. The security team wants to introduce a new set of stateful rules but is concerned about accidentally blocking business-critical traffic before the rules are validated. Which approach best satisfies both the audit-evidence and safe-rollout requirements?

Accepted Answer

Configure the new stateful rule group with rule actions set to 'alert' and enable both alert and flow logging to an S3 bucket with a 90-day lifecycle, then switch selected rules to 'drop' after validation.

Answer

Deploy the rules directly with 'drop' actions but enable flow logs only, relying on the flow logs to capture blocked connection metadata for the auditors.

Answer

Use a stateless rule group with a 'forward to stateful' default action and rely on Transit Gateway Flow Logs sent to CloudWatch Logs to record domain-level attempts.

Answer

Enable TLS inspection with a drop action on all rules and send only alert logs to Kinesis Data Firehose so the auditors can query blocked domains in real time.

Question 10

A financial services company operates a multi-account AWS Organization with a centralized inspection VPC that hosts AWS Network Firewall. The security governance team must guarantee that every stateful rule group deployed across all firewall policies in every member account enforces a mandatory drop rule for known malicious domains, and they must be automatically alerted whenever a firewall policy is created or modified in a way that removes this baseline protection. The team wants a scalable, organization-wide approach that centralizes rule management while continuously auditing compliance. Which combination BEST meets these requirements?

Accepted Answer

Use AWS Firewall Manager with a Network Firewall policy to centrally deploy and enforce the baseline stateful rule group across all accounts, and rely on Firewall Manager's non-compliance reporting plus AWS Config rules to detect and alert on drift.

Answer

Deploy the stateful rule group manually in each member account's firewall policy and use Amazon GuardDuty to detect when the malicious-domain drop rule is removed.

Answer

Create a CloudFormation StackSet that provisions identical Network Firewall policies in every account and enable termination protection to prevent any modification of the rule groups.

Answer

Share a single centralized Network Firewall rule group via AWS RAM to all accounts and use VPC Flow Logs to confirm that malicious-domain traffic is being dropped.

Question 11

A company runs a public-facing application behind an Application Load Balancer in a production account. During a recent volumetric DDoS event, on-call engineers struggled to respond and wanted AWS to proactively engage on their behalf. The security team also wants cost protection against DDoS-related scaling charges and the ability to have AWS experts apply mitigations to their ALB and Route 53 resources during future attacks. Which combination of actions BEST meets these requirements?

Accepted Answer

Subscribe to AWS Shield Advanced, associate the protected resources, and configure the Shield Response Team (SRT) with an IAM role and engagement so they can act during attacks; enable cost protection through Shield Advanced.

Answer

Rely on AWS Shield Standard, which is automatically enabled, and open a support case with the SRT when an attack occurs to receive cost credits and mitigation assistance.

Answer

Deploy AWS Network Firewall in front of the ALB with a stateful rule group that rate-limits inbound connections, and enable AWS Config to alert on rule changes.

Answer

Enable AWS WAF rate-based rules on the ALB and create an Amazon GuardDuty threat list so that GuardDuty automatically blocks attacking IPs at the edge.

Question 12

A company runs a public-facing web application in a VPC. Internet traffic enters through an Internet Gateway to an Application Load Balancer in public subnets, and the ALB forwards to application instances in private subnets. Security requires that ALL inbound traffic from the Internet be inspected by AWS Network Firewall before reaching the ALB. The team deploys a Network Firewall with firewall endpoints in dedicated firewall subnets. Which route table configuration correctly forces inbound Internet traffic through the firewall endpoint before reaching the public (ALB) subnets?

Accepted Answer

On the Internet Gateway ingress route table, add a route for the public subnet CIDRs pointing to the firewall VPC endpoint; on the public subnet route table, keep the default route (0.0.0.0/0) pointing to the Internet Gateway.

Answer

On the public subnet route table, add a 0.0.0.0/0 route pointing to the firewall VPC endpoint; leave the Internet Gateway with no edge association.

Answer

On the firewall subnet route table, add a route for the public subnet CIDRs pointing to the Internet Gateway; leave the public subnet route table default.

Answer

Attach a security group to the Internet Gateway that redirects all inbound traffic to the firewall endpoint before it reaches the ALB subnets.

Question 13

A financial services company hosts a public-facing web application behind an internet-facing Application Load Balancer in a public subnet. The security team requires that all inbound HTTPS traffic from the internet be deep-packet inspected by AWS Network Firewall for exploit signatures BEFORE it reaches the ALB, while preserving the original client source IP for the application's audit logs. The VPC uses an Internet Gateway. Which routing configuration correctly forces inbound internet traffic through the Network Firewall endpoint?

Accepted Answer

Add a route on the Internet Gateway route table (edge association) that sends traffic destined for the public subnet CIDR to the Network Firewall endpoint, and route return traffic from the firewall subnet back through the IGW.

Answer

Attach the Network Firewall endpoint as a target of the ALB and configure the listener to forward decrypted traffic to the firewall before the target group.

Answer

Modify the public subnet's NACL to redirect all inbound port 443 traffic to the Network Firewall endpoint ENI, then allow it onward to the ALB.

Answer

Place the Network Firewall endpoint in the same subnet as the ALB and add a security group rule referencing the firewall endpoint as the source for the ALB.

Question 14

A financial services company runs a centralized inspection VPC using AWS Network Firewall to enforce egress controls for all workload accounts. The compliance team requires that (1) all flow and alert logs from the firewall be retained immutably for 7 years, (2) logs be encrypted with a customer-managed key that the security team fully controls, and (3) the security team be able to prove during audits that logging was never disabled. Which combination of configurations BEST meets these requirements?

Accepted Answer

Configure Network Firewall logging to an S3 bucket with Object Lock in compliance mode, encrypt the bucket with an SSE-KMS customer-managed key, and use AWS Config with a managed rule to detect and alert when firewall logging configuration changes.

Answer

Configure Network Firewall logging to a CloudWatch Logs group with a 7-year retention setting, encrypt the log group with an AWS-managed key, and enable CloudTrail data events on the log group.

Answer

Configure Network Firewall logging to Kinesis Data Firehose delivering to S3 with versioning enabled, encrypt with SSE-S3, and rely on S3 lifecycle policies to prevent deletion for 7 years.

Answer

Configure Network Firewall logging to an S3 bucket with a bucket policy denying deletes, encrypt with an SSE-KMS customer-managed key, and enable GuardDuty to monitor for logging changes.

Question 15

A company routes all outbound internet traffic from a production VPC through AWS Network Firewall for stateful inspection. The VPC spans three Availability Zones with workloads in private subnets in each AZ. During a recent AZ impairment, all outbound traffic from the two healthy AZs also failed, causing a full application outage. The security team confirms the firewall policy and rules were correct. What is the MOST likely cause and the correct design to prevent recurrence?

Accepted Answer

A single firewall endpoint was deployed in one AZ and all private subnet route tables pointed to it; deploy a firewall endpoint subnet in each AZ and point each AZ's route table to its local endpoint

Answer

Network Firewall does not support multi-AZ deployments; replace it with a fleet of self-managed inspection appliances behind a Gateway Load Balancer

Answer

The stateful engine lost session state during the impairment; enable strict rule ordering and increase the flow timeout to preserve sessions across AZs

Answer

The firewall policy was attached to only one subnet's NACL; attach the same NACL to all subnets in every AZ

Question 16

A financial services company runs application servers in private subnets across three Availability Zones in a single VPC. Compliance requires that all outbound HTTPS traffic to the internet be restricted so that only a specific approved list of external SaaS domains (e.g., api.partner-a.com, api.partner-b.com) can be reached, and all other outbound connections must be dropped and logged. The team already uses a centralized egress design with a NAT gateway. Which solution meets the requirement with the least operational overhead?

Accepted Answer

Deploy AWS Network Firewall with a stateful rule group using domain list rules to allow the approved server-name-indication (SNI) values, set the default action to drop other traffic, enable alert logging, and route outbound traffic through the firewall endpoints before the NAT gateway.

Answer

Configure security groups on the application servers referencing the resolved IP addresses of the approved domains and attach a deny-all outbound rule for everything else.

Answer

Create network ACLs on the private subnets that allow outbound TCP 443 only to the CIDR ranges published by the SaaS providers and deny all other egress.

Answer

Attach AWS WAF with a custom rule group to the NAT gateway that inspects the Host header of outbound HTTPS requests and blocks any domain not on the allow list.

Question 17

A financial services company routes all outbound internet traffic from its VPCs through a centralized inspection VPC that uses AWS Network Firewall. Compliance requires that the firewall block access to any HTTPS destination outside an approved list of fully qualified domain names (FQDNs). Currently the firewall's stateful rules match on the TLS Server Name Indication (SNI), but security auditors report that some clients bypass the controls by sending a benign SNI while connecting to a disallowed domain. Which change most directly closes this gap while keeping the approved-domain allow-list model?

Accepted Answer

Enable TLS inspection configuration on the Network Firewall so it decrypts the session and enforces rules against the actual certificate and HTTP Host header rather than the SNI alone

Answer

Replace the stateful domain rules with stateless rules that filter on destination IP address ranges resolved from the approved FQDNs

Answer

Add a Route 53 Resolver DNS Firewall rule group that blocks all domains not on the approved list and attach it to the inspection VPC

Answer

Configure the firewall to drop any packet where the TLS SNI extension is absent and rely on strict SNI matching for the rest

Question 18

A financial services company runs a centralized inspection VPC with AWS Network Firewall for all outbound internet traffic from workloads across multiple accounts via a Transit Gateway. The security team must ensure that all data leaving the environment toward on-premises data centers over the Site-to-Site VPN is encrypted in transit, and that any workload attempting to establish an unencrypted (plaintext) connection to an external partner API endpoint is blocked. Traffic to the partner endpoint uses HTTPS on port 443, but the team suspects some legacy applications fall back to HTTP on port 80. Which approach BEST enforces encryption-in-transit requirements for the outbound partner traffic while minimizing operational overhead?

Accepted Answer

Configure a Network Firewall stateful rule group that drops any TCP traffic destined to the partner endpoint on port 80, and rely on the Site-to-Site VPN's IPsec encryption for the on-premises path.

Answer

Enable TLS inspection on the VPN tunnel and configure a stateless rule to reject all traffic on port 80 across the inspection VPC.

Answer

Attach a security group to the Transit Gateway attachment that denies outbound port 80 and require IPsec transport mode on all partner connections.

Answer

Deploy AWS WAF on the Network Firewall endpoint to block HTTP requests and enable MACsec on the Site-to-Site VPN for encryption in transit.

Question 19

A financial services company runs a centralized inspection VPC using AWS Network Firewall to filter east-west traffic between multiple spoke VPCs attached to a Transit Gateway. The security team must prove to auditors that no spoke-to-spoke traffic can bypass the firewall and reach another spoke directly. During a compliance review, an auditor asks how to programmatically and continuously verify that the Transit Gateway route tables associated with spoke attachments always route inter-spoke traffic through the inspection VPC attachment. Which approach best satisfies this continuous governance requirement?

Accepted Answer

Use an AWS Config custom rule (or conformance pack) that evaluates Transit Gateway route table associations and propagations, flagging any spoke route table whose inter-spoke routes do not point to the inspection VPC attachment.

Answer

Enable VPC Flow Logs on every spoke VPC and manually review the logs weekly to confirm no direct spoke-to-spoke flows appear.

Answer

Configure Reachability Analyzer to run once during the audit to confirm the current path between two spoke VPCs traverses the inspection VPC.

Answer

Attach a restrictive network ACL to the inspection VPC subnets to block any traffic not originating from the Transit Gateway.

Question 20

A financial services company runs a multi-tier application in a single VPC. The security team requires that all outbound traffic from application subnets be inspected against a continuously updated list of known malicious IP addresses and that stateful connection tracking be applied so that return traffic is automatically allowed without opening broad ephemeral port ranges. They also need centralized, human-readable logging of allowed and denied flows for compliance audits. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Network Firewall with a stateful rule group referencing a managed threat-intelligence domain/IP feed, route subnet egress through firewall endpoints, and enable alert and flow logging.

Answer

Attach a network ACL to the application subnets with deny rules for the malicious IP list and rely on the NACL's connection tracking for return traffic.

Answer

Configure security groups on the application instances with outbound deny rules for each malicious IP and enable VPC Flow Logs for auditing.

Answer

Deploy a fleet of self-managed proxy EC2 instances behind a Gateway Load Balancer and maintain the malicious IP list manually in iptables.

More ANS-C01 practice