You save $69.98
An EC2 host must resolve the datacenter namespace hr.onprem.internal. A Route 53 Resolver outbound endpoint is healthy and the target corporate DNS servers accept queries, but no forwarding rule matches hr.onprem.internal in the application VPC. What configuration completes this design?
An outbound endpoint alone does not choose which names to send externally. A domain-specific forwarding rule and VPC association route eligible VPC DNS queries to the corporate resolvers.
An inbound endpoint receives queries from on-premises resolvers toward VPC namespaces. The requirement is VPC clients querying an existing datacenter authoritative service, so direction is wrong.
An empty public zone does not forward private HR DNS requests to datacenter servers and would not meet the nonpublic namespace design.
ALB target group timeouts govern application connections and have no effect on Route 53 Resolver rules or how the VPC chooses DNS forwarding destinations.
A public application receives a high-volume distributed traffic flood and must maintain network-layer availability.
Which technical explanation best accounts for the network behavior described?
AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats. A direct check is to apply the appropriate AWS Shield protection tier and pair it with tested edge scaling, AWS WAF where relevant and incident procedures and observe the corresponding path.
Security groups are stateful at resource interfaces, while network ACLs are stateless subnet filters evaluated separately for each traffic direction. That is a valid account of security groups versus network acl layers, but it does not explain the aws shield and resilient ddos posture behavior in the scenario.
Network Firewall processing depends on stateless defaults and stateful rule evaluation behavior, so policy precedence must match the intended inspection model. That is a valid account of aws network firewall policy precedence, but it does not explain the aws shield and resilient ddos posture behavior in the scenario.
PrivateLink allows authorized VPC consumers to access a published endpoint service without broad VPC peering or transitive network reachability. That is a valid account of privatelink least-privilege service boundary, but it does not explain the aws shield and resilient ddos posture behavior in the scenario.
Hundreds of private EC2 batch workers upload results directly to Amazon S3 in the same Region. Nearly all internet egress through zonal NAT gateways consists of these S3 API calls, raising data-processing charges. The workloads do not need public internet access for S3. What should the architect add?
An S3 gateway endpoint provides private S3 access through the VPC route path, reducing dependence on NAT processing for those requests.
Additional gateways add capacity but do not avoid NAT processing for the dominant S3 traffic.
An ALB is not a gateway for VPC instances to access Amazon S3 APIs.
Edge caching does not replace the private VPC route to native S3 API endpoints.
Two Transit Gateways are peered across AWS Regions. The attachment is AVAILABLE, but a network operator enables route propagation and leaves all inter-Region peer-prefix static routes absent. What dataplane risk remains?
Peering attachment health and route propagation settings do not create the required explicit static destination routes across the inter-Region peering path.
TGW peering does not automatically publish VPC addressing to internet gateways.
TGW peering state does not create or select a public DX VIF.
Static route absence affects packet forwarding, not certificate expiration.
A new Direct Connect private virtual interface has the correct AWS VLAN and IP addresses, but BGP remains Idle. The customer-side router logs show it is configured to peer with a different remote autonomous system number than AWS specified. What must be corrected?
A BGP session requires the peer ASN and neighbor settings to match the configured remote peer.
Instance CIDR sizes do not repair a BGP autonomous-system mismatch.
DNS aliases do not set the router peer ASN.
HTTP probes cannot establish an incorrectly configured BGP control-plane session.
A colocation router receives the Direct Connect cross-connect handoff. The configured BGP neighbor addresses and ASN match AWS, but no frames for the virtual interface reach the expected tagged subinterface. The customer router currently sends untagged Ethernet traffic. What should be checked first?
Direct Connect VIFs use the assigned VLAN; missing tags prevent the intended logical link from receiving traffic.
The failure occurs at the customer Ethernet handoff before application address family selection.
Authoritative DNS cannot perform Ethernet VLAN tagging.
Subnet ACL rules do not affect the physical Direct Connect handoff framing.
A commerce service needs to limit abusive request rates per client while preserving ordinary HTTPS traffic.
Which AWS networking configuration best addresses this specific requirement?
AWS WAF inspects supported HTTP request attributes at layer seven and can count, block or challenge requests according to web ACL rules. The proposed change can be checked by whether controlled benign requests succeed while simulated matching malicious patterns are logged and blocked under the selected rules.
This configuration addresses gateway load balancer third-party appliance insertion, not the aws waf managed and rate-limiting rules requirement. Gateway Load Balancer provides appliance load balancing via GENEVE encapsulation and can support central transparent inspection designs.
This configuration addresses aws shield and resilient ddos posture, not the aws waf managed and rate-limiting rules requirement. AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats.
This configuration addresses cross-account transit gateway route segmentation, not the aws waf managed and rate-limiting rules requirement. Transit Gateway attachment association and propagation control which routed prefixes each network segment can reach, independent of VPC security-group rules.
Several workload VPCs share a Resolver outbound rule for corp.internal through AWS RAM. One newly created VPC resolves public DNS but not corp.internal; the shared rule is visible in its account yet not associated with that VPC. What should the consumer administrator do?
Sharing a Resolver rule grants access to the rule resource, but each consumer VPC needs an association for its resolver to apply the forwarding policy.
Deleting the central shared rule would break existing consumers and is unrelated to the local missing association. Public DNS also cannot replace controlled private forwarding.
An S3 gateway endpoint provides routing to the S3 service and does not configure corporate DNS forwarding from the VPC resolver.
TTL changes affect cached answers after resolution succeeds. The newly created VPC has no matching rule selection, so longer DNS caching cannot establish the missing path.
A DNS server at a warehouse must resolve api.aws.internal hosted in an AWS private zone. IPsec routing to AWS is healthy, but the warehouse server has no route to any VPC Resolver inbound endpoint and forwards queries to a public resolver instead. Which AWS DNS component should be introduced?
Inbound Resolver endpoints accept queries originating outside the VPC for eligible private namespace resolution.
Outbound rules send VPC queries outward; they do not receive the warehouse queries for private zone names.
Public DNS exposure violates the internal namespace requirement.
S3 gateway endpoints do not accept external conditional DNS forwarding.
A network change board wants to know whether a new security-group rule and subnet route combination permits a modeled EC2-to-RDS connection before a maintenance test. They need a static path explanation, not live packet capture. Which AWS analysis tool fits?
Reachability Analyzer evaluates network configuration along a modeled path and identifies reachable or blocking components.
Change history can show who configured resources, but not compute a prospective network path.
Mirroring captures actual packets, not an end-to-end static configuration path.
An edge endpoint health check does not evaluate the internal security-group and subnet-route path.
A service reachable inside one subnet fails across an internal firewall subnet. The team wants to identify the route-table or security-group rule that would block the expected VPC path without sending test packets. Which analysis should be performed first?
Reachability Analyzer inspects network configuration and reports the modeled path or blocking component.
CloudTrail counts do not compute whether current network configurations allow a particular path.
HTTP edge distribution would not diagnose the private subnet forwarding path.
An unrelated hybrid adjacency does not determine a local VPC static reachability path.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
