You save $69.98
A service reachable inside one subnet fails across an internal firewall subnet. The team wants to identify the route-table or security-group rule that would block the expected VPC path without sending test packets. Which analysis should be performed first?
Reachability Analyzer inspects network configuration and reports the modeled path or blocking component.
CloudTrail counts do not compute whether current network configurations allow a particular path.
HTTP edge distribution would not diagnose the private subnet forwarding path.
An unrelated hybrid adjacency does not determine a local VPC static reachability path.
A company issues private TLS certificates for internal service identities through its governed CA. The service must not require public internet domain validation, and it must support organizational issuance and revocation policies. Which AWS certificate architecture fits?
AWS Private CA provides a managed private certificate authority hierarchy for internal trust and controlled issuance. Services must trust the appropriate private chain when validating peers.
DNS weighted routing selects eligible DNS answers but does not issue certificates, manage private keys, or act as an internal certificate authority.
Publicly trusted certificates depend on eligible domain-validation and trust constraints; they are not a substitute for governing a private organizational CA for arbitrary internal identities.
Security groups enforce network traffic allowances, not X.509 issuance, certificate chains, or cryptographic peer identity validation during a TLS handshake.
A company has dedicated private fiber to AWS but its security standard requires IPsec protection for regulated application data.
Which AWS networking configuration best addresses this specific requirement?
Direct Connect is a dedicated network connection but does not universally encrypt payloads; IPsec or TLS adds cryptographic confidentiality when configured. The proposed change can be checked by whether a supported cryptographic validation proves traffic uses an approved cipher and endpoint identities while remaining on the intended path.
This configuration addresses acm private ca internal mutual trust, not the vpn encryption over direct connect requirement. ACM Private CA issues private certificates under an organization-controlled certificate hierarchy, distinct from public ACM trust issuance.
This configuration addresses route 53 dnssec chain-of-trust protection, not the vpn encryption over direct connect requirement. DNSSEC uses cryptographic signatures and a parent-child chain of trust so validating resolvers can detect altered DNS records.
This configuration addresses cloudfront https viewer and origin settings, not the vpn encryption over direct connect requirement. CloudFront has separate viewer-to-edge and edge-to-origin transport settings; encrypting one segment does not automatically encrypt both.
A central inspection VPC has a stateful appliance behind a Transit Gateway attachment. Forward flows and return flows can reach different AZ attachment ENIs, causing stateful drop events. Which Transit Gateway attachment option should be considered with correct symmetric routing?
Appliance mode helps maintain flow affinity through a stateful inspection VPC when used with compatible routing.
DNS signing does not preserve inspection flow affinity across gateway attachments.
Overlapping CIDRs create routing ambiguity and do not solve appliance state.
Without routes the inspection traffic cannot be forwarded at all.
After a capacity upgrade, an analytics EC2 instance still tops out far below its required packets per second. The operations team verified that ENA is enabled but reused sizing assumptions from a larger instance family without checking the selected instance's published network limits. Which modeling error threatens the throughput target?
ENA support does not make different EC2 instance sizes offer identical throughput or packet rates; the smaller instance can cap this workload before CPU is exhausted.
VPC IPAM tracks allocations and overlap across organizational address pools, while usable subnet space still bounds ENI and pod growth. That explains the separate ipam and vpc cidr growth planning issue, not this demonstrated eni performance instance network capability failure.
That outcome depends on nat gateway data-processing cost reduction, whose mechanism is different: A gateway endpoint can route supported S3 traffic inside AWS without passing that traffic through a NAT gateway's per-GB processing path. The reported defect concerns eni performance instance network capability.
Elastic Fabric Adapter offers specialized OS-bypass networking for supported HPC workloads; it is not a generic internet-facing load balancer. That explains the separate elastic fabric adapter hpc placement issue, not this demonstrated eni performance instance network capability failure.
A centralized AWS Network Firewall stateful rule group is deployed across several VPC CIDRs. Inspection of a newly added spoke CIDR fails to match rules that depend on HOME_NET, despite correct firewall routing. What configuration should be reviewed?
Some stateful rule conditions rely on HOME_NET-style address variables; missing new networks can change matching outcomes.
DNSSEC does not configure stateful firewall address variables.
CDN distribution does not extend firewall rule network scope.
S3 endpoint authorization does not define the stateful rule HOME_NET membership.
An EC2 instance cannot reach a database across VPCs even though a console dashboard reports both instances running.
Which technical explanation best accounts for the network behavior described?
Reachability Analyzer performs static analysis of supported AWS network configuration and does not send real traffic or inspect application processes. A direct check is to use VPC Reachability Analyzer on the specific source and destination to identify the modeled blocking component, then validate with a real packet test and observe the corresponding path.
Traffic Mirroring sends copied eligible packets for deep network inspection, while flow logs expose aggregate metadata rather than complete packet sequences. That is a valid account of vpc traffic mirroring tls retransmission investigation, but it does not explain the reachability analyzer blocked security group diagnosis behavior in the scenario.
Oversized packets may be discarded when encapsulation reduces effective MTU and Path MTU Discovery messages are blocked or misinterpreted. That is a valid account of path mtu discovery black-hole diagnosis, but it does not explain the reachability analyzer blocked security group diagnosis behavior in the scenario.
VPC Flow Logs summarize observed network flows, and ACCEPT usually indicates network-level permission rather than successful application-layer processing. That is a valid account of flow log reject versus accept interpretation, but it does not explain the reachability analyzer blocked security group diagnosis behavior in the scenario.
An application target serves 200 on /ready but returns 404 on /. Its ALB target group uses the default HTTP GET health-check path / and marks every target unhealthy, although users can reach the ready endpoint directly. Which precise correction should be made?
ALB target-group health checks use a configured HTTP path and acceptable response codes. Choosing /ready matches the application readiness contract and allows healthy targets to pass the probe.
A DNS alias can direct users to an ALB but does not influence the URL sent from ALB health checkers to registered targets.
Access logs can describe past requests but cannot change the failing health probe. Targets still respond 404 to / and remain unhealthy with the original configuration.
Cross-zone load balancing changes target distribution across enabled zones. It does not fix the wrong path requested by the target-group health checker.
A network engineer discovers that a production security group permitted SSH from 0.0.0.0/0 for two hours yesterday. The audit team must identify the IAM role that made the ModifySecurityGroupRules API call. Which record source answers that attribution question?
CloudTrail captures supported management API calls and associated principal details for change attribution.
Flow Logs describe network traffic but not who edited an EC2 API resource.
DNS query logs cannot identify the IAM actor behind the security-group update.
Link monitoring does not record EC2 security-group administrator identities.
A gRPC service runs behind an ALB HTTPS listener and uses the HTTP/2 target protocol version. It exposes a documented custom CheckService RPC for readiness. The team configured /healthz as a conventional HTTP path and the health probes fail. What health-check format is appropriate?
ALB gRPC target groups support a custom /package.service/method health-check path and gRPC code matcher. Probing the application’s readiness RPC directly tests the implemented service method.
ALB gRPC runs over HTTP/2 in an HTTPS listener configuration; a UDP target probe would use the wrong protocol and never call the specified RPC.
Private hosted zone records influence DNS answers, not the target-group gRPC method or its expected return status. They cannot repair a malformed backend readiness probe.
S3 static website hosting serves HTTP objects, not an application gRPC readiness method. It is unrelated to the ALB target group configured for the service.
A security organization is deploying vendor virtual-firewall appliances to inspect arbitrary IP protocols between VPCs, not just HTTP or TCP. Its target appliances can decapsulate GENEVE traffic. Which load-balancer target-group protocol is required for the managed insertion service?
Gateway Load Balancer forwards original IP packets to inspection appliances using GENEVE encapsulation on its documented port. This transparent layer-three pattern fits arbitrary protocol inspection.
An ALB routes decrypted HTTP requests according to layer-seven conditions, and cannot transparently insert a virtual firewall into arbitrary routed IP packet flows.
A UDP/53 NLB target group could distribute that transport traffic but does not perform Gateway Load Balancer GENEVE appliance insertion for every IP protocol.
A CDN origin group selects HTTP origins, not inline packet inspection appliances. Disabling caching does not turn CloudFront into a layer-three network firewall transport.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
