A company's compliance team requires that all security groups in a VPC must not have a rule that allows inbound traffic from 0.0.0.0/0 on port 22. They need to continuously monitor and report any non-compliant security groups. Which AWS service should they use?

AWS Trusted Advisor with a security check for open SSH ports.

Amazon GuardDuty with a threat detection rule for SSH brute force.

AWS Config with a managed rule like 'restricted-ssh'.

VPC Flow Logs with a metric filter for port 22.

A company must provide a compliance report to auditors showing that their network security groups comply with the policy that no security group allows SSH from the internet. They need an automated, continuous assessment. Which AWS service should they use?

Amazon GuardDuty with a finding for open SSH ports.

AWS Trusted Advisor with a one-time security check.

VPC Flow Logs with a metric filter for SSH traffic.

AWS Config with the managed rule 'restricted-ssh'.

A company has VPC Flow Logs enabled and sending to CloudWatch Logs. They want to be notified when the number of rejected connections from a specific IP address exceeds 100 in a 5-minute period. What is the most efficient way to set this up?

Create a CloudWatch alarm directly on the VPC Flow Logs metric 'RejectedPackets'.

Create an AWS Config rule to check for security group changes that block the IP.

Create a metric filter on the flow log log group for the specific IP and 'REJECT', then create a CloudWatch alarm on that metric.

Use CloudTrail to monitor for the IP address and set an alarm.

AWSCertified Advanced Networking - Specialty

Domain 4Objective 2

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 4)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

24%of the exam

10 Concepts in This Objective

Network Monitoring and Logging Services Overview
VPC Flow Logs Configuration and Analysis
CloudWatch Logs for Network Security
CloudTrail for Network API Auditing
AWS Config for Network Compliance
GuardDuty for Threat Detection
Log Aggregation and Centralization
Security Auditing with Athena and QuickSight
Alarming and Notification for Security Events
Compliance Validation and Reporting

Questions 16–20

16foundation · easy
A security team needs to store VPC Flow Logs in CloudWatch Logs for centralized monitoring and set up an alarm when a certain number of rejected connections occur. What must be created in CloudWatch Logs to receive the flow log data?
Select an answer first
17application · medium
A company's compliance team requires that all security groups in a VPC must not have a rule that allows inbound traffic from 0.0.0.0/0 on port 22. They need to continuously monitor and report any non-compliant security groups. Which AWS service should they use?
Select an answer first
18application · medium
A company must provide a compliance report to auditors showing that their network security groups comply with the policy that no security group allows SSH from the internet. They need an automated, continuous assessment. Which AWS service should they use?
Select an answer first
19application · medium
A company has VPC Flow Logs enabled and sending to CloudWatch Logs. They want to be notified when the number of rejected connections from a specific IP address exceeds 100 in a 5-minute period. What is the most efficient way to set this up?
Select an answer first
20foundation · easy
A security analyst wants to automatically detect a potential cryptocurrency mining activity originating from an EC2 instance in their VPC. Which AWS service can analyze network and DNS data to generate a finding for this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 4)

Questions 16–20

A security team needs to store VPC Flow Logs in CloudWatch Logs for centralized monitoring and set up an alarm when a certain number of rejected connections occur. What must be created in CloudWatch Logs to receive the flow log data?

A company's compliance team requires that all security groups in a VPC must not have a rule that allows inbound traffic from 0.0.0.0/0 on port 22. They need to continuously monitor and report any non-compliant security groups. Which AWS service should they use?

A company must provide a compliance report to auditors showing that their network security groups comply with the policy that no security group allows SSH from the internet. They need an automated, continuous assessment. Which AWS service should they use?

A company has VPC Flow Logs enabled and sending to CloudWatch Logs. They want to be notified when the number of rejected connections from a specific IP address exceeds 100 in a 5-minute period. What is the most efficient way to set this up?

A security analyst wants to automatically detect a potential cryptocurrency mining activity originating from an EC2 instance in their VPC. Which AWS service can analyze network and DNS data to generate a finding for this activity?

Keep studying — Content Domain 4: Network Security, Compliance, and Governance