A company needs to audit all API calls that modify network resources (e.g., create/delete subnets, modify security groups) across all AWS regions. They want to store these logs for 7 years for compliance. What is the most efficient way to achieve this?

Enable CloudTrail in each region and deliver logs to a single S3 bucket with a lifecycle policy to transition to S3 Glacier after 90 days.

Enable VPC Flow Logs in each region and store them in S3.

Enable CloudTrail in one region and use AWS Config to replicate the logs to other regions.

Use Amazon GuardDuty to monitor for API calls and store findings in S3.

A security engineer wants to centralize logs from multiple VPCs in the same account into a single CloudWatch Logs log group for monitoring. Which approach can accomplish this?

Use Amazon GuardDuty to centralize logs

Use AWS Config to aggregate logs

Use Amazon Athena to centralize logs

Configure each VPC Flow Log to publish to the same CloudWatch Logs log group

AWSCertified Advanced Networking - Specialty

Domain 4Objective 2

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 3)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

24%of the exam

10 Concepts in This Objective

Network Monitoring and Logging Services Overview
VPC Flow Logs Configuration and Analysis
CloudWatch Logs for Network Security
CloudTrail for Network API Auditing
AWS Config for Network Compliance
GuardDuty for Threat Detection
Log Aggregation and Centralization
Security Auditing with Athena and QuickSight
Alarming and Notification for Security Events
Compliance Validation and Reporting

Questions 11–15

11expert · hard
A company needs to audit all API calls that modify network resources (e.g., create/delete subnets, modify security groups) across all AWS regions. They want to store these logs for 7 years for compliance. What is the most efficient way to achieve this?
Select an answer first
12foundation · easy
A compliance auditor needs to review who made changes to a VPC's security group rules over the past month. Which AWS service provides a record of API calls that can be used to audit these changes?
Select an answer first
13foundation · easy
A security engineer wants to centralize logs from multiple VPCs in the same account into a single CloudWatch Logs log group for monitoring. Which approach can accomplish this?
Select an answer first
14foundation · easy
A security auditor needs to produce evidence that network monitoring is enabled and that logs are being collected for compliance reporting. Which AWS service can provide a compliance report that includes the status of AWS Config rules and other security checks?
Select an answer first
15foundation · easy
An organization wants to automatically evaluate whether security groups in their VPC allow unrestricted inbound SSH access, and be notified when a non-compliant security group is created. Which AWS service can continuously evaluate the security group configuration against this rule?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 3)

Questions 11–15

A company needs to audit all API calls that modify network resources (e.g., create/delete subnets, modify security groups) across all AWS regions. They want to store these logs for 7 years for compliance. What is the most efficient way to achieve this?

A compliance auditor needs to review who made changes to a VPC's security group rules over the past month. Which AWS service provides a record of API calls that can be used to audit these changes?

A security engineer wants to centralize logs from multiple VPCs in the same account into a single CloudWatch Logs log group for monitoring. Which approach can accomplish this?

A security auditor needs to produce evidence that network monitoring is enabled and that logs are being collected for compliance reporting. Which AWS service can provide a compliance report that includes the status of AWS Config rules and other security checks?

An organization wants to automatically evaluate whether security groups in their VPC allow unrestricted inbound SSH access, and be notified when a non-compliant security group is created. Which AWS service can continuously evaluate the security group configuration against this rule?

Keep studying — Content Domain 4: Network Security, Compliance, and Governance