AWS Network Security Governance Quiz

1. Which service enables you to centrally manage DNS records and apply security policies across accounts?

Amazon Route 53

AWS CloudFront

AWS Direct Connect

Amazon VPC Peering

2. In AWS advanced networking, what does the term 'defense in depth' mean for security?

Using only the most expensive security tools

Implementing multiple layers of security controls to reduce risk

Restricting all traffic by default

Using encryption for all data

3. Which service aggregates security findings from multiple AWS security tools for centralized governance?

Amazon GuardDuty

AWS Security Hub

AWS Macie

Amazon Inspector

4. What is the primary function of AWS Systems Manager Session Manager in network security?

Route network traffic securely

Provide secure shell access without SSH keys or bastion hosts

Manage VPC peering

Configure security groups

5. AWS Secrets Manager is primarily used for managing which type of sensitive data?

VPC configurations

Database credentials, API keys, and encryption keys

CloudWatch metrics

Route table entries

6. Network segmentation in AWS is best achieved using which combination?

Multiple regions only

VPCs, subnets, and security groups

NAT gateways and route tables

CloudFront distributions

7. Which compliance framework assessment service helps verify AWS infrastructure against security standards?

AWS Artifact

Amazon Inspector

AWS Security Hub

AWS Secrets Manager

8. AWS PrivateLink enables secure communication by creating which type of connection?

Public internet connections

Private, encrypted connections between VPCs and services

Direct fiber optic links

VPN tunnels only

9. In network governance, what is the purpose of implementing least privilege access?

To maximize user convenience

To grant only necessary permissions to minimize security risk

To simplify network architecture

To increase network throughput

10. What does AWS CloudTrail primarily log for governance and compliance purposes?

Network packet contents

API calls and account activities

DNS query results

VPC Flow data

11. Which AWS service provides centralized management of firewall rules across multiple accounts and VPCs?

AWS Firewall Manager

Amazon VPC Flow Logs

AWS Config

AWS Shield

12. AWS Identity and Access Management (IAM) policies are used to control access to which resources?

Only EC2 instances

Only network resources

All AWS services and resources

Only S3 buckets

13. What is the primary benefit of using VPC endpoints for governance and security?

They reduce latency by 50%

They allow private connectivity to AWS services without internet gateway

They automatically encrypt all data

They eliminate the need for NAT gateways

14. AWS Shield Standard provides protection against which type of DDoS attacks?

Only Layer 3 attacks

Common Layer 3 and Layer 4 DDoS attacks at no cost

All DDoS attacks including Layer 7

Only volumetric attacks

15. Network ACLs differ from security groups in that they operate at which layer?

Application layer

Subnet level with stateless filtering

Instance level only

Region level

16. Which AWS service enforces compliance by evaluating resource configurations against desired states?

AWS Config

Amazon CloudWatch

AWS Systems Manager

AWS Trusted Advisor

17. In a multi-account AWS environment, what does AWS Organizations help govern?

VPC peering connections only

EC2 instance types

Centralized policies, billing, and access controls across accounts

S3 bucket replication

18. AWS WAF (Web Application Firewall) primarily protects against which type of attacks?

DDoS attacks at network layer

Layer 7 application-level attacks like SQL injection

BGP hijacking

DNS poisoning

19. Which security group rule direction controls outbound traffic from EC2 instances?

Inbound rules

Outbound rules

Ingress rules

Egress policies

20. What is the primary purpose of VPC Flow Logs in network security governance?

Encrypt traffic between instances

Monitor and log IP traffic for auditing and troubleshooting

Automatically block malicious traffic

Scale network capacity dynamically

AWS Advanced Networking Network Security Governance Quiz