You save $69.98
An AWS Site-to-Site VPN is configured for dynamic routing. IPsec tunnels show UP, but the customer gateway BGP peer stays Idle after an engineer changes the on-premises ASN in router configuration without updating the AWS customer gateway settings. What should be aligned?
IPsec tunnel establishment and BGP adjacency are separate; mismatched autonomous-system expectations can prevent route exchange.
Endpoint routing does not establish the BGP session over the VPN.
Edge TLS configuration is unrelated to private VPN BGP negotiation.
Log retention cannot fix the peer ASN mismatch.
An incident team needs packet timing and TCP flags from a supported EC2 ENI during a transient handshake failure. It must copy only traffic to one approved destination and send it to a protected analyzer without capturing unrelated workloads. Which VPC capability best fits?
Traffic Mirroring can duplicate selected supported ENI packets toward a monitoring target, using filters to reduce sensitive capture scope. It provides packet-level evidence that flow summaries cannot supply.
Transit Gateway peering enables routing between gateways, not an out-of-band packet-copy session from a selected ENI with a capture filter.
VPC Flow Logs aggregate flow metadata rather than a lossless sequence of packet captures. They cannot by themselves show detailed retransmission timing and raw TCP flags.
CloudTrail records supported API operations and actor identities, not the packet stream received by applications. Replaying handshakes is outside management-event logging.
During a Site-to-Site VPN tunnel endpoint replacement, AWS lowers the BGP MED on the surviving VPN tunnel so the customer's router can prefer it. The router instead pins a higher Local Preference on the tunnel under maintenance and ignores the lower MED signal. What is the routing risk of that customer-side policy?
AWS changes MED for VPN tunnel maintenance, but customer Weight and Local Preference are evaluated before MED. Unequal higher-priority settings can defeat the intended failover preference.
DNS caching controls name answers, not the customer router’s BGP best-path precedence.
Creating a VPN connection does not explain why the existing customer router ignores the MED change.
Endpoint authorization has no role in selecting a VPN route via BGP attributes.
A multilingual documentation site returns English or German HTML based only on the Accept-Language header. CloudFront currently ignores this header in its cache key, and German visitors occasionally receive English pages from cache. What is the direct correction?
When origin bytes vary with an HTTP header, the edge key must distinguish the relevant values or normalize them consistently. Otherwise one language response can be served for another request.
Longer TTL prolongs a wrong-language cached representation. It does not make CloudFront distinguish requests with different origin-selected languages or eliminate the cache-key collision in the shared HTML path.
HTTPS protocol negotiation is unrelated to language-specific origin representations. Rejecting clients whose Accept-Language header indicates German is not a viable corrective cache policy and would unnecessarily harm valid users.
DNS geolocation does not ensure the same hostname and URL path are cached separately by actual requested language. The fault is explicitly a missing HTTP cache-key discriminator within CloudFront.
An authenticated API behind CloudFront processes POST /orders requests. The application team proposes an origin group to replay failed POST operations on a standby regional origin without the client knowing. Which documented behavior invalidates that plan?
CloudFront origin failover is restricted to supported safe viewer methods such as GET, HEAD and OPTIONS. Business-critical POST retries need application-level idempotency and a different recovery design.
HTTPS origin connections are supported for suitable custom origins. TLS is not why this origin-group plan fails for the described non-idempotent POST operation; the HTTP method determines failover eligibility.
Failover depends on configured error conditions and supported HTTP methods. It is not an unconditional duplication mechanism for every origin response or every individual HTTP operation, particularly POST.
Route 53 answers DNS queries and does not execute or replay HTTP requests at all. Its routing policies cannot supply POST transaction replay or protect against duplicate financial transactions.
A new Site-to-Site VPN negotiates IKE successfully but its IPsec tunnel repeatedly drops during phase-two negotiation after a security team tightens encryption settings on only the on-premises device. What is the proper diagnostic step?
An incompatible phase-two proposal can prevent or interrupt protected data-plane security associations despite partial IKE progress.
Extra route tables do not negotiate IPsec algorithms.
DNS publication does not reconcile VPN cryptographic proposals.
Broad app exposure is unrelated to IPsec negotiation and introduces risk.
A dedicated Direct Connect link is physically up and shows stable connection bandwidth, but critical VPC prefixes disappear intermittently. The network operator wants a CloudWatch alarm specifically for the number of BGP prefixes accepted on the private virtual interface. Which monitoring dimension and metric should be selected?
Direct Connect exposes virtual-interface-specific BGP prefix metrics and dimensions. Tracking accepted prefixes on the implicated VIF detects route withdrawals despite a healthy physical connection.
S3 storage size measures objects retained in a bucket, not hybrid routing state. It would not signal lost BGP prefixes on an otherwise active circuit.
EC2 CPU utilization reflects instance compute use, not BGP route acceptance on a Direct Connect VIF. It cannot directly establish which private prefixes are being learned.
A CDN hit rate can track edge cache effectiveness but says nothing about private VIF prefix advertisements or the hybrid network route control plane.
A security team sees a permitted TCP flow in VPC Flow Logs but must inspect packets to determine unusual connection behavior.
Which observation would most directly demonstrate the required network outcome?
The sensor receives the expected authorized traffic sample and analysts can correlate packet timing with flow and host events. That is relevant because traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata.
This would validate firewall manager organization compliance audit. The case instead needs evidence for vpc traffic mirroring security packet evidence: The sensor receives the expected authorized traffic sample and analysts can correlate packet timing with flow and host events.
This would validate route 53 resolver query logging security visibility. The case instead needs evidence for vpc traffic mirroring security packet evidence: The sensor receives the expected authorized traffic sample and analysts can correlate packet timing with flow and host events.
This would validate cloudwatch alarm and security response integration. The case instead needs evidence for vpc traffic mirroring security packet evidence: The sensor receives the expected authorized traffic sample and analysts can correlate packet timing with flow and host events.
An architecture review finds production and development VPCs attached to the same Transit Gateway. Both attachments are associated with one route table where all their CIDRs propagate, exposing development addresses to production. Which design change enforces network isolation without removing the attachments?
Transit Gateway can segment attachments by associating them with distinct forwarding tables and selecting permitted propagations. A production source then lacks paths to unapproved development CIDRs.
Public IGW routing does not safely isolate the existing Transit Gateway attachments and could introduce new internet access contrary to the private security objective.
DNS TTL affects name resolution caching but does not remove a reachable IP prefix already advertised in the Transit Gateway forwarding plane.
A common propagated table caused the stated overexposure. Adding more automatic full-mesh routes would widen, rather than eliminate, the development-production network trust boundary.
A new Direct Connect circuit must deliver private access to VPCs attached to an existing Transit Gateway rather than one isolated VGW.
Which AWS networking configuration best addresses this specific requirement?
A transit VIF uses the Direct Connect gateway to reach a Transit Gateway; a private VIF is associated with virtual private gateway connectivity instead. The proposed change can be checked by whether the transit VIF and gateway associations are active and approved hybrid prefixes reach multiple intended VPC attachments.
This configuration addresses redundant vpn tunnels with bgp failover, not the transit virtual interface to transit gateway requirement. Site-to-Site VPN supplies redundant tunnels, but failover depends on compatible dynamic routing and healthy peer sessions for both tunnel paths.
This configuration addresses site-to-site vpn bgp route propagation, not the transit virtual interface to transit gateway requirement. The tunnel protects packets, but dynamic routing and attachment route-table associations determine which prefixes the network actually forwards.
This configuration addresses customer gateway bgp asn coordination, not the transit virtual interface to transit gateway requirement. BGP peers must agree on neighbor addressing and expected autonomous systems before they can exchange dynamic routes over the encrypted tunnel.
A Direct Connect private VIF has stable ConnectionState=1 but its VirtualInterfaceBgpStatus fell to 0 after a customer router maintenance window. An application loses on-premises reachability while physical link alarms stay green. Which monitoring principle explains this discrepancy?
Physical transport and BGP control-plane states are different Direct Connect measurements; a VIF BGP-down alarm can catch a failure invisible to an optical link-up check.
A Direct Connect connection may stay up while its VIF BGP session is down.
EC2 CPU metrics do not describe the VIF routing peer state.
DNS/health checks do not fix router-level BGP adjacency faults.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
