AWS Networking and Security 5 — Questions and Answers
Question 1: A company is deploying a web application and wants to protect it against common web exploits such as SQL injection and cross-site scripting. Which AWS service should they use?
- AWS Shield Advanced
- AWS WAF (Correct answer)
- Amazon GuardDuty
- AWS Macie
Correct answer: AWS WAF
AWS WAF (Web Application Firewall) inspects HTTP/HTTPS requests and allows you to create rules to block common web exploits like SQL injection and XSS at Layer 7.
Question 2: Which feature of AWS Transit Gateway allows you to isolate routing between connected VPCs so that VPC-A can reach the shared services VPC but not VPC-B?
- Transit Gateway Peering
- Route Tables on Transit Gateway (Correct answer)
- VPC Peering Transitive Routing
- Transit Gateway Multicast
Correct answer: Route Tables on Transit Gateway
Transit Gateway route tables enable you to segment traffic by associating VPCs with different route tables, controlling which VPCs can communicate with each other.
Question 3: An administrator wants to audit all changes to AWS resource configurations and receive alerts when non-compliant resources are detected. Which service provides this capability?
- AWS CloudTrail
- AWS Config (Correct answer)
- Amazon Inspector
- AWS Security Hub
Correct answer: AWS Config
AWS Config continuously records resource configuration changes and evaluates them against desired rules, triggering alerts or remediation when resources become non-compliant.
Question 4: A company uses multiple AWS accounts and needs to share a centrally managed VPC with private subnets across accounts. Which AWS feature enables this?
- VPC Peering
- AWS Resource Access Manager (RAM) with VPC Sharing (Correct answer)
- Transit Gateway with Cross-Account Attachments
- AWS PrivateLink
Correct answer: AWS Resource Access Manager (RAM) with VPC Sharing
AWS Resource Access Manager (RAM) allows sharing subnets from a central VPC (owner account) with participant accounts, enabling a shared VPC architecture.
Question 5: Which security service continuously monitors for malicious activity and unauthorized behavior in an AWS account by analyzing CloudTrail, DNS logs, and VPC Flow Logs?
- AWS Config
- Amazon Macie
- Amazon GuardDuty (Correct answer)
- AWS Security Hub
Correct answer: Amazon GuardDuty
Amazon GuardDuty is a managed threat detection service that uses ML and anomaly detection on CloudTrail, VPC Flow Logs, and DNS logs to identify threats.
Question 6: A Solutions Architect needs to ensure that only encrypted connections are allowed to an S3 bucket. How can this be enforced?
- Enable S3 default encryption
- Attach a bucket policy denying requests where aws:SecureTransport is false (Correct answer)
- Enable S3 Block Public Access
- Create a VPC Gateway Endpoint for S3
Correct answer: Attach a bucket policy denying requests where aws:SecureTransport is false
A bucket policy using the condition 'aws:SecureTransport: false' with Effect: Deny blocks any HTTP (non-TLS) requests to the bucket, enforcing HTTPS-only access.
Question 7: A team wants to use a single Elastic IP address for multiple EC2 instances behind a load balancer for whitelisting purposes. Which load balancer type supports this using static IP addresses?
- Application Load Balancer
- Classic Load Balancer
- Network Load Balancer (Correct answer)
- Gateway Load Balancer
Correct answer: Network Load Balancer
Network Load Balancers (NLB) support static IP addresses per Availability Zone (or can have Elastic IPs assigned), making them suitable for IP whitelisting scenarios.
AWS Networking and Security 5
A company is deploying a web application and wants to protect it against common web exploits such as SQL injection and cross-site scripting.
Which AWS service should they use?