Task 4.1: Implement and Maintain Network Features to Meet Security and Compliance Needs and Requirements ANS-C01 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When securing a VPC peering connection, which control is used to restrict which instances can communicate over the peering link?

   • AVPC endpoint policies
   • BAWS Site-to-Site VPN
   • CSecurity groups and network ACLs
   • DAWS PrivateLink
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement correctly describes a difference between security groups and network ACLs in a VPC?

   • ASecurity groups are stateless, while network ACLs are stateful
   • BSecurity groups support allow rules only, while network ACLs support both allow and deny rules
   • CSecurity groups operate at the subnet level, while network ACLs operate at the instance level
   • DSecurity groups evaluate rules in numerical order, while network ACLs evaluate all rules before deciding
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which design strategy isolates different application tiers into separate subnets and uses security groups to limit traffic between them?

   • ANetwork address translation (NAT)
   • BNetwork segmentation
   • CLoad balancing
   • DDNS resolution
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company uses AWS CloudFormation to deploy its VPC. They want to ensure that all security groups created by the stack have a specific tag and that no security group allows inbound SSH from 0.0.0.0/0. What should they do?

   • AUse AWS Service Catalog to enforce the tag and use AWS Trusted Advisor to check for open SSH.
   • BAdd a tag to the security groups in the CloudFormation template and use AWS Config rules to check for open SSH.
   • CUse AWS Organizations to enforce the tag and use AWS Config to check for open SSH.
   • DUse AWS CloudTrail to enforce the tag and use AWS Config to check for open SSH.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has multiple VPCs that need to communicate with each other. They want to use AWS Transit Gateway to centralize connectivity, but they also need to ensure that only specific VPCs can communicate with each other. What should they configure?

   • ACreate a Transit Gateway route table for each VPC and associate only the desired VPCs with each route table.
   • BCreate a VPC peering connection between each pair of VPCs that need to communicate.
   • CUse network ACLs on the Transit Gateway attachments to restrict traffic.
   • DUse security groups on the Transit Gateway attachments to restrict traffic.
   Reveal Solution Discussion Select an answer first