You save $69.98
A branch has one AWS Site-to-Site VPN connection with both AWS-provided tunnels, but the customer gateway was configured for only the first tunnel. A scheduled AWS endpoint maintenance window must not disrupt the branch's application sessions. What should the network operator change first?
A Site-to-Site VPN connection supplies two distinct tunnels to improve availability. Since the customer gateway uses only one, configuring and testing the other addresses the maintenance exposure directly; routing must also reach the surviving tunnel.
Adding an Elastic IP to an existing tunnel is not the documented VPN resilience mechanism. Each AWS-managed tunnel already has its own outside endpoint address, and redundancy depends on using the separate provided tunnel.
A public Direct Connect VIF reaches AWS public service prefixes, not the private VPC networks described here. It would also be a new connectivity product, not the corrective action for an unused VPN tunnel.
CIDR expansion supplies more network addresses but cannot maintain encryption transport if the only configured tunnel fails. Availability depends on tunnel diversity and the customer gateway's route choice.
At 03:14 UTC, an application subnet lost access after a security group ingress rule was deleted. The security engineer needs to identify which IAM principal issued the AWS API call and the request parameters. Packet payloads are not part of the investigation. Which evidence source is appropriate?
CloudTrail management events describe AWS control-plane actions, including caller identity, API event name, time and request parameters. Examining the relevant security-group change event addresses who changed configuration at 03:14 UTC.
A NAT metric might show an unrelated increase in dropped packets, but a count does not identify the source principal or API request for a security-group modification. This is an audit of the control plane.
Resolver query logs record DNS questions and responses. They cannot identify the IAM principal behind an EC2 security-group change or its authorized API arguments in CloudTrail.
CloudFront access logs show content-delivery request properties at the edge, not which AWS identity removed an inbound EC2 security rule. These are separate data and control planes.
A Network Firewall is already routing outbound VPC traffic through its stateful rules. An auditor asks why specific Suricata rules rejected connections to an unapproved destination. VPC Flow Logs show only ACCEPT or REJECT network-flow metadata. Which additional logging should be enabled?
Network Firewall alert logs include stateful rule matches that result in Alert, Drop or Reject behavior when logging is configured. Correlating this record with the configured policy gives the auditor the rule-specific decision absent from general flow metadata.
Traffic counts alone can show a trend but cannot attribute a rejected session to an individual stateful rule. The auditor explicitly needs the policy decision details, not a capacity signal.
CloudFront logs describe requests handled by its distributions, not stateful AWS Network Firewall rules applied to traffic from this VPC. The case requires policy-match evidence rather than web cache request history with its specific rule identity.
Route 53 public query logs capture DNS names asked of authoritative Route 53, not which Suricata drop or reject action Network Firewall applied to a transport session.
Security needs the CLIENT IP, queried name, request type and response code for DNS lookups made by EC2 instances through the VPC's Amazon-provided Resolver. The policy prohibits full packet capture and public DNS zone access logs are out of scope. Which telemetry answers the question?
Resolver query logging observes DNS queries by VPC workloads through the Amazon-provided resolver, retaining query identifiers and relevant source/response data without packet mirroring.
Flow Logs reveal network metadata but not the actual DNS name and DNS response code required by the investigator.
Authoritative public-zone logs are not the same as the VPC Resolver's workload query log stream.
CloudTrail records supported API operations, not the ordinary per-query DNS events requested here.
One HTTPS hostname serves /billing and /catalog from separately deployed target groups. The networking team must preserve the single DNS name while directing requests by URL path, and TLS should terminate at the entry service. What should be configured?
The ALB's layer-seven listener examines HTTP request conditions, including path patterns, and forwards to the designated target group. An HTTPS listener can use the appropriate certificate for TLS termination on the shared application hostname.
An NLB routes transport flows; it does not evaluate /billing versus /catalog paths inside decrypted HTTP requests. A UDP listener is additionally inappropriate for ordinary HTTPS traffic.
A Gateway Load Balancer is intended for transparent network appliance insertion over GENEVE. It is not a layer-seven application path router or a place to terminate application TLS for two microservices.
Weighted DNS answers distribute clients between endpoints, not individual requests according to path. Both routes share a hostname, so weighted A records cannot reliably select the correct backend for each URL path.
The DNS team provisioned a Route 53 Resolver outbound endpoint and a rule for legacy.example.internal, pointing to reachable corporate DNS addresses. Query logs show that instances in App-VPC never select this forwarding rule, while a test VPC where the rule is associated succeeds. What should be corrected?
Resolver rule association is evaluated for each relevant VPC. Since the identical rule works when associated with another VPC, assigning it to App-VPC directly addresses why only the current VPC ignores the forwarding path.
A public hosted zone would not use the on-premises DNS target and might expose internal names. The problem identifies which VPC uses the rule, not missing authoritative records.
An inbound endpoint serves DNS requests coming from the datacenter into AWS; these failed queries originate from App-VPC. The working test VPC confirms the outbound rule and target infrastructure are functioning.
An ALB certificate governs TLS identity for HTTPS connections. The observed failure occurs before connecting to the service, at rule selection for a private DNS suffix.
A manufacturer has a Direct Connect circuit and must reach EC2 instances at 10.40.0.0/16 through their private addresses in one VPC. No Transit Gateway is part of the design. Which Direct Connect virtual-interface type addresses this network destination?
A private Direct Connect VIF is intended for VPC access using private IP addresses. With the appropriate gateway association and BGP configuration, it supplies the requested route to the VPC without a Transit Gateway.
Route 53 DNS records do not establish BGP private network connectivity over the circuit. An alias to a CIDR is not even a valid replacement for routing to private EC2 IP addresses.
A public VIF reaches public IP endpoints for AWS services. It is not the private addressing route into a VPC's EC2 subnet, and publishing a private prefix there would misinterpret its supported purpose.
A transit VIF connects through a Direct Connect gateway to Transit Gateways, not directly to a VPC internet gateway. The case explicitly excludes a Transit Gateway and asks for one VPC's private EC2 addresses.
Three workload VPCs attach to the same Transit Gateway. A finance VPC must reach the shared directory VPC but must not initiate connections to the engineering VPC. Default attachment association and broad propagation currently allow all three to communicate. Which change imposes the required L3 segmentation?
Transit Gateway attachment association selects the table used for forwarding incoming traffic. Combining a restricted finance association with intentional propagated/static destination and return routes can allow directory access while omitting engineering reachability.
A DNS resolver change only influences hostname answers. It does not stop IP-layer packets from finance from reaching an engineering CIDR over a permissive Transit Gateway route table.
Direct VPC peering to engineering grants a new network path that contradicts the requirement to isolate engineering. It does not enforce the existing Transit Gateway's permitted finance-to-directory reachability.
Publishing all attachment prefixes into every Transit Gateway route table is the behavior that created unintended reachability. Broad propagation makes segmentation harder rather than limiting the traffic to the directory service.
A legacy market-data protocol uses long-running TCP sessions, and external partners require a stable IP for every enabled Availability Zone in their firewall allowlists. Header- or path-based HTTP inspection is unnecessary. Which load-balancer choice best fits?
An NLB handles TCP flows and exposes stable per-AZ addresses; an internet-facing NLB can associate Elastic IPs with enabled subnets. This meets the transport protocol and partner IP allowlisting without needless layer-seven routing.
Gateway Load Balancer targets inline security appliances; nothing in the case requires middlebox insertion or GENEVE forwarding. It would not be the public service listener chosen merely to secure fixed partner IP lists.
Autoscaled instances change as targets are replaced, so directly publishing their private IPs is neither a public endpoint strategy nor a way to maintain stable externally allowlisted service addresses.
An ALB is effective when routing HTTP application requests, but the given protocol is raw TCP and partner allowlists require fixed per-AZ addresses. ALB DNS addresses should not be treated as fixed client destination IPs.
Private-subnet ETL workers in one AWS Region download large files from S3 buckets in that same Region through a public NAT gateway. The security team wants the workers to remain private and the finance team wants to avoid NAT data-processing fees for S3 traffic. What is the preferred network change?
An S3 gateway endpoint supplies a VPC route to same-Region S3 without requiring NAT or internet egress for the private instances. Associating the correct subnet route tables redirects eligible S3 traffic while maintaining applicable access controls.
Public addresses on every worker change the private-workload posture and create operational overhead. The cost problem is specifically service traffic via NAT, not an absence of instance public addresses.
A Direct Connect public VIF serves customer-to-AWS public connectivity, not a VPC-native endpoint for local private-subnet S3 requests. It adds a physical hybrid dependency where none is needed.
S3 website exposure is unnecessary for authorized application downloads and violates the intent to keep traffic and resources private. Removing transport security would create risk rather than reduce required NAT fees safely.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
