Practice Test GeeksAWS Practice Test
← All AWS Flashcard Decks

Networking and Security Flashcards

7 cards from real AWS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Networking and Security flashcards as text

  1. A company is deploying a web application and wants to protect it against common web exploits such as SQL injection and cross-site scripting. Which AWS service should they use?

    Answer: AWS WAF

    AWS WAF (Web Application Firewall) inspects HTTP/HTTPS requests and allows you to create rules to block common web exploits like SQL injection and XSS at Layer 7.

  2. Which feature of AWS Transit Gateway allows you to isolate routing between connected VPCs so that VPC-A can reach the shared services VPC but not VPC-B?

    Answer: Route Tables on Transit Gateway

    Transit Gateway route tables enable you to segment traffic by associating VPCs with different route tables, controlling which VPCs can communicate with each other.

  3. An administrator wants to audit all changes to AWS resource configurations and receive alerts when non-compliant resources are detected. Which service provides this capability?

    Answer: AWS Config

    AWS Config continuously records resource configuration changes and evaluates them against desired rules, triggering alerts or remediation when resources become non-compliant.

  4. A company uses multiple AWS accounts and needs to share a centrally managed VPC with private subnets across accounts. Which AWS feature enables this?

    Answer: AWS Resource Access Manager (RAM) with VPC Sharing

    AWS Resource Access Manager (RAM) allows sharing subnets from a central VPC (owner account) with participant accounts, enabling a shared VPC architecture.

  5. Which security service continuously monitors for malicious activity and unauthorized behavior in an AWS account by analyzing CloudTrail, DNS logs, and VPC Flow Logs?

    Answer: Amazon GuardDuty

    Amazon GuardDuty is a managed threat detection service that uses ML and anomaly detection on CloudTrail, VPC Flow Logs, and DNS logs to identify threats.

  6. A Solutions Architect needs to ensure that only encrypted connections are allowed to an S3 bucket. How can this be enforced?

    Answer: Attach a bucket policy denying requests where aws:SecureTransport is false

    A bucket policy using the condition 'aws:SecureTransport: false' with Effect: Deny blocks any HTTP (non-TLS) requests to the bucket, enforcing HTTPS-only access.

  7. A team wants to use a single Elastic IP address for multiple EC2 instances behind a load balancer for whitelisting purposes. Which load balancer type supports this using static IP addresses?

    Answer: Network Load Balancer

    Network Load Balancers (NLB) support static IP addresses per Availability Zone (or can have Elastic IPs assigned), making them suitable for IP whitelisting scenarios.