A security engineer needs to ensure that all API calls that modify network resources are recorded for compliance. What is the first step to enable this audit capability?

Create a trail in AWS CloudTrail

A security engineer wants to send an email notification to the security team when a CloudWatch alarm for high rejected traffic is triggered. Which AWS service should be used to deliver the notification?

Amazon Simple Email Service (SES)

Amazon Simple Notification Service (SNS)

A security analyst needs to run SQL queries against VPC Flow Logs stored in Amazon S3 to identify traffic patterns for a security audit. Which AWS service can be used to query the data directly in S3 without loading it into a database?

Amazon CloudWatch Logs Insights

A company wants to centralize VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a single S3 bucket for security analysis. They want to use Athena to query across all log types. What is the most efficient way to set this up?

Store logs in separate S3 buckets for each account and use Athena to query across buckets.

Use AWS Config to aggregate all logs into a single S3 bucket.

Store all logs in CloudWatch Logs and use Athena to query them directly.

Use AWS Organizations to aggregate logs into a central S3 bucket with a prefix structure that includes account ID and log type.

AWSCertified Advanced Networking - Specialty

Domain 4Objective 2

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 1)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

24%of the exam

10 Concepts in This Objective

Network Monitoring and Logging Services Overview
VPC Flow Logs Configuration and Analysis
CloudWatch Logs for Network Security
CloudTrail for Network API Auditing
AWS Config for Network Compliance
GuardDuty for Threat Detection
Log Aggregation and Centralization
Security Auditing with Athena and QuickSight
Alarming and Notification for Security Events
Compliance Validation and Reporting

Questions 1–5

1foundation · easy
A security engineer needs to ensure that all API calls that modify network resources are recorded for compliance. What is the first step to enable this audit capability?
Select an answer first
2foundation · easy
A security engineer wants to send an email notification to the security team when a CloudWatch alarm for high rejected traffic is triggered. Which AWS service should be used to deliver the notification?
Select an answer first
3foundation · easy
A security analyst needs to run SQL queries against VPC Flow Logs stored in Amazon S3 to identify traffic patterns for a security audit. Which AWS service can be used to query the data directly in S3 without loading it into a database?
Select an answer first
4foundation · easy
A security analyst wants to detect and validate potential threats by analyzing network activity and other telemetry sources. Which AWS service continuously monitors for malicious activity and unexpected behavior across AWS accounts and workloads?
Select an answer first
5expert · hard
A company wants to centralize VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a single S3 bucket for security analysis. They want to use Athena to query across all log types. What is the most efficient way to set this up?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.