AWS Networking and Security 3 — Questions and Answers
Question 1: A company wants to restrict outbound internet traffic from EC2 instances in a private subnet while allowing instances to initiate connections to the internet. Which solution should be used?
- Internet Gateway
- NAT Gateway placed in a public subnet (Correct answer)
- Egress-Only Internet Gateway
- VPC Endpoint
Correct answer: NAT Gateway placed in a public subnet
A NAT Gateway in a public subnet allows private subnet instances to initiate outbound connections while preventing inbound connections from the internet.
Question 2: Which AWS service enables you to centrally manage firewall rules across multiple AWS accounts and VPCs in an organization?
- AWS Shield
- AWS WAF
- AWS Firewall Manager (Correct answer)
- AWS Network Firewall
Correct answer: AWS Firewall Manager
AWS Firewall Manager lets you centrally configure and manage firewall rules (WAF, Shield, Security Groups, Network Firewall) across accounts in AWS Organizations.
Question 3: A developer needs to allow an EC2 instance to access an S3 bucket without embedding AWS credentials in the application code. What is the best approach?
- Store credentials in environment variables
- Attach an IAM role to the EC2 instance (Correct answer)
- Create an IAM user and store keys in ~/.aws/credentials
- Use a hardcoded access key in the application
Correct answer: Attach an IAM role to the EC2 instance
Attaching an IAM role to an EC2 instance provides temporary credentials via the instance metadata service, eliminating the need to store long-term credentials.
Question 4: What is the purpose of VPC Flow Logs?
- To route traffic between VPCs
- To capture information about IP traffic going to and from network interfaces in a VPC (Correct answer)
- To encrypt data in transit within a VPC
- To block malicious traffic at the subnet level
Correct answer: To capture information about IP traffic going to and from network interfaces in a VPC
VPC Flow Logs capture metadata about IP traffic (source/destination IP, ports, protocol, action) flowing through ENIs, useful for security analysis and troubleshooting.
Question 5: A security team needs to detect and alert on unusual API activity in their AWS account. Which service should they enable?
- AWS Config
- Amazon Inspector
- AWS CloudTrail with Amazon CloudWatch Alarms (Correct answer)
- AWS Trusted Advisor
Correct answer: AWS CloudTrail with Amazon CloudWatch Alarms
CloudTrail records all API calls; pairing it with CloudWatch Alarms enables automated detection and alerting on suspicious or unauthorized API activity.
Question 6: Which type of VPC endpoint should be used to privately connect to Amazon S3 without traversing the public internet?
- Interface Endpoint
- Gateway Endpoint (Correct answer)
- Transit Gateway
- Direct Connect Virtual Interface
Correct answer: Gateway Endpoint
A Gateway Endpoint for S3 (and DynamoDB) routes traffic through route table entries within the VPC, keeping traffic off the public internet at no additional cost.
Question 7: An organization wants to enforce MFA for all IAM users when they perform sensitive operations. Where should this requirement be configured?
- In the EC2 instance user data
- In an IAM policy using the aws:MultiFactorAuthPresent condition key (Correct answer)
- In the VPC security group rules
- In AWS Config rules
Correct answer: In an IAM policy using the aws:MultiFactorAuthPresent condition key
The aws:MultiFactorAuthPresent condition key in IAM policies enforces MFA by denying access when MFA has not been used during authentication.
AWS Networking and Security 3
A company wants to restrict outbound internet traffic from EC2 instances in a private subnet while allowing instances to initiate connections to the internet.
Which solution should be used?