Task 4.1: Implement and Maintain Network Features to Meet Security and Compliance Needs and Requirements ANS-C01 Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A company is preparing for a PCI DSS audit. The auditor requires evidence that all network traffic to the cardholder data environment (CDE) is logged and that access is restricted. What should the company implement to meet these requirements?

   • AEnable CloudTrail on the CDE subnets and use network ACLs to restrict access.
   • BEnable Amazon GuardDuty on the CDE subnets and use network ACLs to restrict access.
   • CEnable AWS Config on the CDE subnets and use security groups to restrict access.
   • DEnable VPC Flow Logs on the CDE subnets and use security groups to restrict access to the CDE.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which AWS service allows you to define and provision network infrastructure as code, enabling consistent and compliant deployments?

   • AAWS CloudFormation
   • BAWS Elastic Beanstalk
   • CAWS Config
   • DAWS Service Catalog
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   A company must document the security requirements for a network that will process credit card data. Which source is most relevant to identify the specific network security controls required?

   • AThe AWS Well-Architected Framework general design principles
   • BThe AWS Free Tier usage limits
   • CThe PCI DSS requirements that define network segmentation and firewall rules
   • DThe VPC default security group rules
   Reveal Solution Discussion Select an answer first