AWS Networking and Security 4 — Questions and Answers
Question 1: A Solutions Architect needs to connect two VPCs in different AWS accounts so they can communicate privately. The IP ranges do not overlap. Which solution is most appropriate?
- VPC Peering (Correct answer)
- NAT Gateway
- Internet Gateway
- VPC Endpoint
Correct answer: VPC Peering
VPC Peering creates a direct private network connection between two VPCs (same or different accounts/regions) as long as CIDR ranges do not overlap.
Question 2: Which AWS service provides a managed, scalable solution for distributed denial-of-service (DDoS) protection at the network and transport layers?
- AWS WAF
- AWS Shield Standard (Correct answer)
- AWS Shield Advanced
- AWS GuardDuty
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically included at no cost for all AWS customers and provides protection against common Layer 3 and Layer 4 DDoS attacks.
Question 3: A company is setting up a hybrid network and needs consistent, low-latency connectivity between their on-premises data center and AWS. Which service best meets this requirement?
- AWS Site-to-Site VPN
- AWS Direct Connect (Correct answer)
- AWS Transit Gateway
- Amazon CloudFront
Correct answer: AWS Direct Connect
AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, offering consistent performance and lower latency than internet-based VPN.
Question 4: What happens to traffic that does not match any rule in an AWS Network ACL?
- It is allowed by default
- It is logged to CloudWatch
- It is denied by the implicit deny-all rule (Correct answer)
- It is forwarded to the security group for evaluation
Correct answer: It is denied by the implicit deny-all rule
NACLs include an implicit deny-all rule (rule number *) at the end; any traffic not matching an explicit allow or deny rule is automatically denied.
Question 5: A developer is using AWS KMS to encrypt data. They want to ensure the encryption key is automatically rotated annually. Which feature should they enable?
- Multi-Region Keys
- Key Policy Rotation
- Automatic Key Rotation (Correct answer)
- Key Aliases
Correct answer: Automatic Key Rotation
AWS KMS Automatic Key Rotation rotates the key material for a customer-managed key annually while keeping the same key ID and alias.
Question 6: An application running in a VPC needs to access AWS Systems Manager Parameter Store without routing traffic through the internet. What should be configured?
- A NAT Gateway
- An Interface VPC Endpoint for Systems Manager (Correct answer)
- A Gateway Endpoint
- An Internet Gateway
Correct answer: An Interface VPC Endpoint for Systems Manager
An Interface VPC Endpoint (powered by AWS PrivateLink) for AWS Systems Manager allows private connectivity from within a VPC to Parameter Store without internet exposure.
Question 7: Which IAM policy evaluation logic is correct when a user has both an explicit Allow and an explicit Deny for the same action?
- Allow takes precedence
- Deny takes precedence (Correct answer)
- The most specific policy wins
- The last evaluated policy wins
Correct answer: Deny takes precedence
In IAM, an explicit Deny always overrides any Allow; if any policy attached to the identity or resource explicitly denies an action, access is denied regardless of other allows.
AWS Networking and Security 4
A Solutions Architect needs to connect two VPCs in different AWS accounts so they can communicate privately.
The IP ranges do not overlap.
Which solution is most appropriate?