You save $69.98
A Direct Connect private VIF has stable ConnectionState=1 but its VirtualInterfaceBgpStatus fell to 0 after a customer router maintenance window. An application loses on-premises reachability while physical link alarms stay green. Which monitoring principle explains this discrepancy?
Physical transport and BGP control-plane states are different Direct Connect measurements; a VIF BGP-down alarm can catch a failure invisible to an optical link-up check.
A Direct Connect connection may stay up while its VIF BGP session is down.
EC2 CPU metrics do not describe the VIF routing peer state.
DNS/health checks do not fix router-level BGP adjacency faults.
A data processing site sends 95% of its scheduled traffic across a Direct Connect circuit during a one-hour window. CloudWatch shows connection bandwidth near the purchased capacity and packet drops, while BGP is stable. Which operational mitigation is best supported?
Capacity saturation with stable control-plane routing points to throughput management rather than BGP neighbor repair.
Removing reachability would not increase available transport throughput.
DNS signing has no direct impact on circuit saturation.
Broad ingress exposure cannot relieve the dedicated circuit’s bandwidth limit.
A network team can see route reachability but needs inspection logs to justify why certain protocols were denied.
Which AWS networking configuration best addresses this specific requirement?
Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches. The proposed change can be checked by whether a test connection triggers the expected firewall decision and a retained log entry identifies the relevant rule or event.
This configuration addresses vpc traffic mirroring security packet evidence, not the network firewall flow and alert log delivery requirement. Traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata.
This configuration addresses cloudwatch alarm and security response integration, not the network firewall flow and alert log delivery requirement. CloudWatch alarms evaluate metric periods and thresholds while EventBridge and notification integrations can dispatch timely security response signals.
This configuration addresses vpc flow logs for security investigations, not the network firewall flow and alert log delivery requirement. Flow logs emit metadata such as IP addresses, ports, bytes and ACCEPT/REJECT action for supported network flows, not raw packet bodies.
A subnet has a custom network ACL allowing inbound client TCP port 443 traffic, but return connections fail. The ACL has no corresponding outbound ephemeral-port rule. Instance security groups already permit the service. What is the required fix?
Network ACLs are stateless; reply traffic must independently match allowed outbound rules.
NACLs do not automatically allow the reverse flow for an accepted request.
The subnet ACL blocks return traffic regardless of an edge connection timeout.
Transit Gateway routing does not override the local stateless ACL denial.
An S3-backed help center uses CloudFront with primary and secondary regional origins. The primary intermittently returns 503 to GET /manual.pdf, and the secondary holds identical approved documents. Operators want transparent failover only for these server failures. What must be configured?
An origin group can retry a supported GET request against a configured secondary when the primary returns a designated failover status such as 503. The secondary must contain the appropriate object.
Short DNS TTL changes resolution caching but does not make CloudFront retry a failed GET at a second configured origin. The needed decision is inside the distribution.
Adding all headers to the cache key changes representation fragmentation and hit rate; it does not define primary-to-secondary origin failover when a cached PDF request receives HTTP 503.
A UDP listener is unrelated to CloudFront GET retrieval and is not a native S3 origin failover facility. It introduces a transport mismatch rather than meeting the HTTP requirement.
AWS Network Firewall logs show a stateful rule rejecting one outbound TCP flow. VPC Flow Logs for the same source interface show ACCEPT for a flow matching its initial network path. Which combined interpretation is most defensible?
Different AWS network controls log decisions at different points; acceptance at one point does not override later firewall inspection.
Distinct filtering components can produce different decisions along one attempted path.
An inspection-layer reject contradicts a guaranteed end-to-end success claim.
DNS alias resolution does not grant exception to network inspection policy.
Multiple AWS accounts need the same approved VPC subnet and routing pattern but engineers currently copy manual console steps.
Which observation would most directly demonstrate the required network outcome?
Test and production stacks deploy equivalent intended topology with distinct CIDRs and tracked changes under version control. That is relevant because declarative infrastructure templates create repeatable network resources while parameters and outputs separate environment-specific values from resource definitions.
This would validate aws cdk secure network constructs. The case instead needs evidence for cloudformation parameterized vpc deployment: Test and production stacks deploy equivalent intended topology with distinct CIDRs and tracked changes under version control.
This would validate multi-account network automation role boundaries. The case instead needs evidence for cloudformation parameterized vpc deployment: Test and production stacks deploy equivalent intended topology with distinct CIDRs and tracked changes under version control.
This would validate aws config network compliance conformance. The case instead needs evidence for cloudformation parameterized vpc deployment: Test and production stacks deploy equivalent intended topology with distinct CIDRs and tracked changes under version control.
A media CDN has a declining CloudFront cache-hit ratio after a release. The application began appending a unique analytics query parameter to every static image request, and the cache policy includes all query parameters. What observation supports the optimization hypothesis?
A unique irrelevant query field makes equivalent objects appear distinct and causes unnecessary origin fetches.
Additional high-cardinality values would further fragment shared cached objects.
Load-balancer probes do not change CloudFront’s object cache key.
Registrar delegation does not eliminate cache-key fragmentation.
A network administrator needs to identify why return traffic behaves differently across security group and network ACL policies.
Which AWS networking configuration best addresses this specific requirement?
Security groups are stateful at resource interfaces, while network ACLs are stateless subnet filters evaluated separately for each traffic direction. The proposed change can be checked by whether approved app-to-database sessions complete with return traffic and explicit unauthorized subnet access is rejected in tests.
This configuration addresses aws shield and resilient ddos posture, not the security groups versus network acl layers requirement. AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats.
This configuration addresses cross-account transit gateway route segmentation, not the security groups versus network acl layers requirement. Transit Gateway attachment association and propagation control which routed prefixes each network segment can reach, independent of VPC security-group rules.
This configuration addresses privatelink least-privilege service boundary, not the security groups versus network acl layers requirement. PrivateLink allows authorized VPC consumers to access a published endpoint service without broad VPC peering or transitive network reachability.
The central network account shared a Transit Gateway but another account's VPC attachment is pending and unable to pass traffic.
Which AWS networking configuration best addresses this specific requirement?
Resource sharing and attachment authorization are separate from route-table configuration; each stage must be complete before transit is usable. The proposed change can be checked by whether the consumer attachment is accepted and available, its routes are permitted, and the source VPC can reach only approved prefixes.
This configuration addresses transit gateway cross-region static routing, not the aws ram share and attachment acceptance requirement. Transit Gateway inter-Region peering does not automatically propagate remote attachment prefixes; route-table entries identify the peering path.
This configuration addresses vpc peering bilateral route update, not the aws ram share and attachment acceptance requirement. VPC peering has no transitive routing and requires both VPCs to route toward the peering connection for successful bidirectional traffic.
This configuration addresses nat gateway route and az resilience, not the aws ram share and attachment acceptance requirement. A public NAT gateway translates outbound private IPv4 flows using public subnet connectivity but does not make private instances directly internet-addressable.
An EC2 host must resolve the datacenter namespace hr.onprem.internal. A Route 53 Resolver outbound endpoint is healthy and the target corporate DNS servers accept queries, but no forwarding rule matches hr.onprem.internal in the application VPC. What configuration completes this design?
An outbound endpoint alone does not choose which names to send externally. A domain-specific forwarding rule and VPC association route eligible VPC DNS queries to the corporate resolvers.
An inbound endpoint receives queries from on-premises resolvers toward VPC namespaces. The requirement is VPC clients querying an existing datacenter authoritative service, so direction is wrong.
An empty public zone does not forward private HR DNS requests to datacenter servers and would not meet the nonpublic namespace design.
ALB target group timeouts govern application connections and have no effect on Route 53 Resolver rules or how the VPC chooses DNS forwarding destinations.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
