A financial company must comply with PCI DSS and requires that all cardholder data be encrypted in transit. They have a VPC with an Application Load Balancer (ALB) that terminates TLS and forwards traffic to EC2 instances. The security team wants to ensure that traffic between the ALB and the instances is also encrypted. They are considering using a Network Load Balancer (NLB) in front of the ALB to provide end-to-end encryption. What should the network engineer do?

Use an NLB with a TLS listener and forward traffic to the instances directly, bypassing the ALB.

Configure the ALB to use a certificate from ACM and enable encryption between the ALB and the instances by using HTTPS listeners on the instances.

Use AWS PrivateLink to connect the ALB to the instances.

Use an NLB with a TLS listener and forward traffic to the ALB, which then terminates TLS and forwards to the instances over HTTP.

AWSCertified Advanced Networking - Specialty

Domain 4Objective 3

Task 4.3: Implement and Maintain Confidentiality of Data and Communications of the Network ANS-C01 Practice Questions (Page 3)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

8concepts

24%of the exam

8 Concepts in This Objective

Encryption in Transit
Key Management for Network Encryption
VPN and Direct Connect Encryption
TLS Termination and Offloading
Network Access Control for Confidentiality
Data Loss Prevention (DLP) in Network
Monitoring and Auditing for Confidentiality
Compliance and Governance for Data Confidentiality

Questions 11–15

11foundation · easy
Which AWS service can be used to continuously monitor and evaluate your AWS resource configurations against desired policies, such as ensuring encryption is enabled for data storage?
Select an answer first
12foundation · easy
Which AWS service provides a centralized view of security alerts and compliance status across AWS accounts, helping to detect potential confidentiality breaches?
Select an answer first
13foundation · easy
Which AWS VPC component acts as a stateless firewall that controls traffic at the subnet level?
Select an answer first
14expert · hard
A financial company must comply with PCI DSS and requires that all cardholder data be encrypted in transit. They have a VPC with an Application Load Balancer (ALB) that terminates TLS and forwards traffic to EC2 instances. The security team wants to ensure that traffic between the ALB and the instances is also encrypted. They are considering using a Network Load Balancer (NLB) in front of the ALB to provide end-to-end encryption. What should the network engineer do?
Select an answer first
15foundation · easy
Which protocol is specifically designed to secure IP communications by authenticating and encrypting each IP packet in a network session?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 4.3: Implement and Maintain Confidentiality of Data and Communications of the Network ANS-C01 Practice Questions (Page 3)

Questions 11–15

Which AWS service can be used to continuously monitor and evaluate your AWS resource configurations against desired policies, such as ensuring encryption is enabled for data storage?

Which AWS service provides a centralized view of security alerts and compliance status across AWS accounts, helping to detect potential confidentiality breaches?

Which AWS VPC component acts as a stateless firewall that controls traffic at the subnet level?

Which protocol is specifically designed to secure IP communications by authenticating and encrypting each IP packet in a network session?

Keep studying — Content Domain 4: Network Security, Compliance, and Governance