A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates, but the security team wants to ensure that no inbound traffic from the internet can reach the instance. What should the network engineer configure?

Use a VPC endpoint for the software update service.

Use a NAT gateway in the public subnet and configure the private subnet's route table to send internet traffic to the NAT gateway.

Use a security group on the instance to deny all inbound traffic from the internet.

Attach an internet gateway to the VPC and configure the private subnet's route table to send internet traffic to the internet gateway.

Which AWS service is used to centrally manage and rotate encryption keys that can be used to encrypt network traffic or other data?

AWS Identity and Access Management (IAM)

AWS Key Management Service (KMS)

What is the primary benefit of enabling automatic key rotation for a customer-managed key (CMK) in AWS KMS?

It ensures the key is never compromised

It allows the key to be used across multiple AWS regions

It reduces the cost of key storage

It automatically replaces the key with a new cryptographic material annually

AWSCertified Advanced Networking - Specialty

Domain 4Objective 3

Task 4.3: Implement and Maintain Confidentiality of Data and Communications of the Network ANS-C01 Practice Questions (Page 4)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

8concepts

24%of the exam

8 Concepts in This Objective

Encryption in Transit
Key Management for Network Encryption
VPN and Direct Connect Encryption
TLS Termination and Offloading
Network Access Control for Confidentiality
Data Loss Prevention (DLP) in Network
Monitoring and Auditing for Confidentiality
Compliance and Governance for Data Confidentiality

Questions 16–20

16foundation · easy
Which AWS service records API activity in your account, providing an audit log that can be used to detect unauthorized access or data exfiltration attempts?
Select an answer first
17application · medium
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates, but the security team wants to ensure that no inbound traffic from the internet can reach the instance. What should the network engineer configure?
Select an answer first
18foundation · easy
Which AWS service is used to centrally manage and rotate encryption keys that can be used to encrypt network traffic or other data?
Select an answer first
19foundation · easy
What is the primary benefit of enabling automatic key rotation for a customer-managed key (CMK) in AWS KMS?
Select an answer first
20foundation · easy
Which AWS service can be used to monitor and protect applications from web exploits that could lead to data exfiltration, such as SQL injection or cross-site scripting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 4.3: Implement and Maintain Confidentiality of Data and Communications of the Network ANS-C01 Practice Questions (Page 4)

Questions 16–20

Which AWS service records API activity in your account, providing an audit log that can be used to detect unauthorized access or data exfiltration attempts?

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access the internet for software updates, but the security team wants to ensure that no inbound traffic from the internet can reach the instance. What should the network engineer configure?

Which AWS service is used to centrally manage and rotate encryption keys that can be used to encrypt network traffic or other data?

What is the primary benefit of enabling automatic key rotation for a customer-managed key (CMK) in AWS KMS?

Which AWS service can be used to monitor and protect applications from web exploits that could lead to data exfiltration, such as SQL injection or cross-site scripting?

Keep studying — Content Domain 4: Network Security, Compliance, and Governance