AWS Networking and Security 3

Question 1

A company wants to restrict outbound internet traffic from EC2 instances in a private subnet while allowing instances to initiate connections to the internet. Which solution should be used?

Accepted Answer

NAT Gateway placed in a public subnet

Answer

A NAT Gateway in a public subnet allows private subnet instances to initiate outbound connections while preventing inbound connections from the internet.

Question 2

Which AWS service enables you to centrally manage firewall rules across multiple AWS accounts and VPCs in an organization?

Accepted Answer

AWS Firewall Manager

Answer

AWS Firewall Manager lets you centrally configure and manage firewall rules (WAF, Shield, Security Groups, Network Firewall) across accounts in AWS Organizations.

Question 3

A developer needs to allow an EC2 instance to access an S3 bucket without embedding AWS credentials in the application code. What is the best approach?

Accepted Answer

Attach an IAM role to the EC2 instance

Answer

Attaching an IAM role to an EC2 instance provides temporary credentials via the instance metadata service, eliminating the need to store long-term credentials.

Question 4

What is the purpose of VPC Flow Logs?

Accepted Answer

To capture information about IP traffic going to and from network interfaces in a VPC

Answer

VPC Flow Logs capture metadata about IP traffic (source/destination IP, ports, protocol, action) flowing through ENIs, useful for security analysis and troubleshooting.

Question 5

A security team needs to detect and alert on unusual API activity in their AWS account. Which service should they enable?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Alarms

Answer

CloudTrail records all API calls; pairing it with CloudWatch Alarms enables automated detection and alerting on suspicious or unauthorized API activity.

AWS Practice Test

AWS Practice Test

AWS Networking and Security 3