A company handles credit card data and must comply with PCI DSS. They use AWS and have a VPC with several subnets. The security team wants to monitor and prevent unauthorized transmission of cardholder data over the network. Which AWS service should they use to inspect network traffic for sensitive data?

AWS Network Firewall with a stateful rule group that uses Suricata-compatible rules to detect and block sensitive data patterns.

AWS WAF with a rule to block requests containing credit card numbers.

Amazon Macie with automated discovery of sensitive data in S3, and use VPC Flow Logs to monitor network traffic.

Amazon GuardDuty with anomaly detection to identify unusual data transfers.

AWSCertified Advanced Networking - Specialty

Domain 4Objective 3

Task 4.3: Implement and Maintain Confidentiality of Data and Communications of the Network ANS-C01 Practice Questions (Page 1)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

8concepts

24%of the exam

8 Concepts in This Objective

Encryption in Transit
Key Management for Network Encryption
VPN and Direct Connect Encryption
TLS Termination and Offloading
Network Access Control for Confidentiality
Data Loss Prevention (DLP) in Network
Monitoring and Auditing for Confidentiality
Compliance and Governance for Data Confidentiality

Questions 1–5

1foundation · easy
Which AWS service provides pre-built compliance templates and reports to help you meet regulatory requirements like PCI DSS, HIPAA, and GDPR?
Select an answer first
2application · medium
A company wants to audit all network traffic in its VPC for compliance purposes. They need to capture information about IP addresses, ports, and protocols for all traffic. Which AWS service should they use?
Select an answer first
3foundation · easy
Which AWS service can be used to filter traffic at the VPC level, including domain-based filtering to block communication with known malicious domains?
Select an answer first
4application · medium
A company handles credit card data and must comply with PCI DSS. They use AWS and have a VPC with several subnets. The security team wants to monitor and prevent unauthorized transmission of cardholder data over the network. Which AWS service should they use to inspect network traffic for sensitive data?
Select an answer first
5foundation · easy
Which encryption protocol is commonly used to secure traffic at the data link layer (Layer 2) of the OSI model?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 4.3: Implement and Maintain Confidentiality of Data and Communications of the Network ANS-C01 Practice Questions (Page 1)

Questions 1–5

Which AWS service provides pre-built compliance templates and reports to help you meet regulatory requirements like PCI DSS, HIPAA, and GDPR?

A company wants to audit all network traffic in its VPC for compliance purposes. They need to capture information about IP addresses, ports, and protocols for all traffic. Which AWS service should they use?

Which AWS service can be used to filter traffic at the VPC level, including domain-based filtering to block communication with known malicious domains?

Which encryption protocol is commonly used to secure traffic at the data link layer (Layer 2) of the OSI model?

Keep studying — Content Domain 4: Network Security, Compliance, and Governance