A security auditor needs to provide evidence of who deleted a subnet in a VPC and when. The company has CloudTrail enabled in all regions. What is the fastest way to find this information?

Search the CloudTrail event history for the 'DeleteSubnet' event.

Check the AWS Config timeline for the subnet's configuration changes.

Query the VPC Flow Logs for the subnet's traffic around the time of deletion.

Review the CloudWatch Logs for the VPC's flow log entries.

A security team needs to identify the top 10 source IP addresses that are generating the most rejected traffic in their VPC, based on VPC Flow Logs. The logs are stored in S3. Which approach will provide this analysis with the least effort?

Use Amazon Athena to query the flow logs, grouping by source IP and filtering for 'REJECT'.

Use CloudWatch Logs Insights to query the flow logs if they are in CloudWatch Logs.

Download the flow logs and use a spreadsheet application to sort and filter the data.

Create a CloudWatch alarm based on the flow logs to identify top source IPs.

AWSCertified Advanced Networking - Specialty

Domain 4Objective 2

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 5)

Part of the Content Domain 4: Network Security, Compliance, and Governance domain, which accounts for 24% of the ANS-C01 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~17–28 in this domain), expect 6–9 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

24%of the exam

10 Concepts in This Objective

Network Monitoring and Logging Services Overview
VPC Flow Logs Configuration and Analysis
CloudWatch Logs for Network Security
CloudTrail for Network API Auditing
AWS Config for Network Compliance
GuardDuty for Threat Detection
Log Aggregation and Centralization
Security Auditing with Athena and QuickSight
Alarming and Notification for Security Events
Compliance Validation and Reporting

Questions 21–25

21application · medium
A security auditor needs to provide evidence of who deleted a subnet in a VPC and when. The company has CloudTrail enabled in all regions. What is the fastest way to find this information?
Select an answer first
22foundation · easy
A security engineer needs to capture details about IP traffic going to and from network interfaces in a VPC for security analysis. Which AWS service provides this capability by publishing flow records to a destination such as Amazon S3 or CloudWatch Logs?
Select an answer first
23foundation · easy
A security engineer wants to monitor VPC Flow Logs for a specific pattern (e.g., rejected traffic to a sensitive subnet) and trigger an alarm when the pattern occurs. Which CloudWatch feature should be used to extract the pattern from the log data?
Select an answer first
24application · medium
A security team needs to identify the top 10 source IP addresses that are generating the most rejected traffic in their VPC, based on VPC Flow Logs. The logs are stored in S3. Which approach will provide this analysis with the least effort?
Select an answer first
25foundation · easy
A security team needs to collect VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a single location for centralized auditing. Which AWS service can be used as a central destination to aggregate these logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ANS-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “ANS-C01” is a trademark of its owner, used for identification only.

Task 4.2: Validate and Audit Security by Using Network Monitoring and Logging Services ANS-C01 Practice Questions (Page 5)

Questions 21–25

A security auditor needs to provide evidence of who deleted a subnet in a VPC and when. The company has CloudTrail enabled in all regions. What is the fastest way to find this information?

A security engineer needs to capture details about IP traffic going to and from network interfaces in a VPC for security analysis. Which AWS service provides this capability by publishing flow records to a destination such as Amazon S3 or CloudWatch Logs?

A security engineer wants to monitor VPC Flow Logs for a specific pattern (e.g., rejected traffic to a sensitive subnet) and trigger an alarm when the pattern occurs. Which CloudWatch feature should be used to extract the pattern from the log data?

A security team needs to identify the top 10 source IP addresses that are generating the most rejected traffic in their VPC, based on VPC Flow Logs. The logs are stored in S3. Which approach will provide this analysis with the least effort?

A security team needs to collect VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a single location for centralized auditing. Which AWS service can be used as a central destination to aggregate these logs?

Keep studying — Content Domain 4: Network Security, Compliance, and Governance