You save $69.98
A new application account lacks a required WAF policy even though the central security team believes the baseline applies everywhere.
Which observation would most directly demonstrate the required network outcome?
A newly added in-scope resource appears as protected and previous noncompliant findings clear after enforced remediation. That is relevant because firewall Manager can evaluate whether eligible resources meet organization-wide firewall policy assignments and report noncompliant cases.
This would validate cloudwatch alarm and security response integration. The case instead needs evidence for firewall manager organization compliance audit: A newly added in-scope resource appears as protected and previous noncompliant findings clear after enforced remediation.
This would validate route 53 resolver query logging security visibility. The case instead needs evidence for firewall manager organization compliance audit: A newly added in-scope resource appears as protected and previous noncompliant findings clear after enforced remediation.
This would validate vpc flow logs for security investigations. The case instead needs evidence for firewall manager organization compliance audit: A newly added in-scope resource appears as protected and previous noncompliant findings clear after enforced remediation.
A manufacturer must connect private, non-internet-addressable PLC subnets in a campus to private AWS VPC subnets for a three-month migration. A Direct Connect cross-connect cannot be provisioned yet, but a public IPsec termination point is available on the campus gateway and the AWS-side VPN service. Which temporary hybrid design preserves private subnet addressing in transit?
The VPN uses internet transport for encrypted tunneling between public tunnel endpoints while the application IP prefixes inside the tunnel remain private and need not be publicly routed.
RFC1918 private subnets should not be made public internet routes, and this omits the specified encrypted tunnel.
A single configured tunnel forfeits the redundant path that the scenario requires during normal endpoint changes.
Public DNS and direct exposure do not provide encrypted private-subnet routing or preserve controller isolation.
A legacy campus router supports only a restricted tunnel MTU. Small pings through a VPN reach EC2, but bulk HTTPS transfers fail; captures show packets exceeding the effective path limit and missing ICMP fragmentation-needed replies. What implementation change best fits?
Reducing packet sizes or allowing proper PMTU feedback prevents oversized encrypted packets from disappearing in transit.
Connection draining does not control IP packet size through the hybrid tunnel.
DNS authority has no direct effect on oversized IP packets.
Endpoint health polling does not repair packet-size blackholing.
A business connects a VPC to a Transit Gateway in three Availability Zones. The application subnet in the third zone sends traffic to the TGW, but the attachment subnet was created only in the first two zones. What implementation detail should be checked for zonal reachability?
Transit attachment participation is zonal; missing attachment coverage can prevent expected paths from a workload zone.
DNS authority cannot create a missing transit attachment path.
Viewer authorization is unrelated to zonal gateway attachment networking.
Load balancer source handling does not provide a TGW attachment ENI.
A team forwards an Authorization header to an API origin but must never cache the API response. A teammate suggests setting the cache policy minimum TTL to 60 seconds while the origin sends Cache-Control: private. Which setting avoids the confidentiality error?
CloudFront can cache for the cache policy minimum TTL even when origin Cache-Control requests no-store or private treatment. Disabling caching for authenticated response paths directly meets the stated privacy requirement.
A positive minimum TTL can force caching despite private or no-store origin directives. Relying on the origin header alone would not meet the explicit guarantee.
Random query strings may fragment cached objects but do not prohibit caching or ensure authorization isolation. This is not a dependable confidentiality control.
Origin-group failover determines how selected origin failures are handled. A successful authenticated API response can still be cached according to its behavior and policy.
A central infrastructure account owns a Route 53 private hosted zone for app.service.internal. A new workload VPC in a different AWS account must resolve that zone, but the owner cannot simply select the foreign VPC in the console. What association sequence is required?
Route 53 uses an association authorization followed by the cross-account VPC association operation.
Publishing the records publicly breaks the private DNS boundary.
Peering routes do not create a private hosted-zone association.
CloudFront does not grant Route 53 cross-account association rights.
An ALB target group has an otherwise healthy EC2 service listening on port 8080. The target was registered with an override port of 8090 during a deployment, but the listener forwards traffic to that target group correctly. All target health checks time out on the override port. Which configuration is faulty?
ALB target groups can register targets on specific ports, including overrides. Health checks use the configured port rules, so probing unused 8090 cannot establish the actual service readiness.
ALB target protocols support ports beyond 80 and 443. The service already listens on valid HTTP port 8080, so changing to UDP would break traffic.
DNS address stability does not govern the destination port used by a load balancer when connecting to a registered target. The fault is local target registration.
CloudFront cache invalidations operate on cached viewer objects and cannot modify ALB target health checks or correct a mistaken registered port.
A branch has a dynamic-routing Site-to-Site VPN attached to its AWS network. IPsec is established on both tunnels, but the customer router advertises no local prefixes over BGP. Return traffic from VPC workloads cannot find a route back to the branch. What action addresses the missing reachability?
An encrypted tunnel alone does not insert customer LAN prefixes into dynamic routing; BGP must announce them.
CloudFront keys are unrelated to route exchange across the VPN tunnels.
Longer DNS caching does not install a reverse route to branch subnets.
An ALB cannot supply the missing branch BGP route announcements.
An operations team receives thousands of short CloudWatch alarms because a network throughput metric crosses a threshold for a single 60-second spike. Security wants escalation only when the condition persists for three consecutive periods. Which alarm configuration should change?
CloudWatch alarm evaluation settings can distinguish repeated sustained threshold breaches from isolated brief spikes.
Removing monitoring is not an alert quality improvement.
Dashboard client addressing does not control evaluation history.
ALB listener rule evaluation does not determine metric alarm persistence.
A production VPN forwards all AWS-to-datacenter traffic through one tunnel even though a second tunnel is available.
Which technical explanation best accounts for the network behavior described?
Site-to-Site VPN supplies redundant tunnels, but failover depends on compatible dynamic routing and healthy peer sessions for both tunnel paths. A direct check is to enable and validate both AWS VPN tunnels, supported BGP route preference and on-premises peer configuration for automatic failover and observe the corresponding path.
The tunnel protects packets, but dynamic routing and attachment route-table associations determine which prefixes the network actually forwards. That is a valid account of site-to-site vpn bgp route propagation, but it does not explain the redundant vpn tunnels with bgp failover behavior in the scenario.
Direct Connect connectivity depends on the physical handoff and correct virtual-interface BGP parameters; a physical optical link alone does not establish routed VPC access. That is a valid account of direct connect physical provisioning and bgp bring-up, but it does not explain the redundant vpn tunnels with bgp failover behavior in the scenario.
BGP peers must agree on neighbor addressing and expected autonomous systems before they can exchange dynamic routes over the encrypted tunnel. That is a valid account of customer gateway bgp asn coordination, but it does not explain the redundant vpn tunnels with bgp failover behavior in the scenario.
An internal application ALB has healthy targets but a spike in HTTPCode_ELB_5XX_Count and TargetConnectionErrorCount. The targets show no corresponding application-level 5XX spike. Where should troubleshooting focus first?
ELB-generated errors and target connection errors can reflect failures before the backend application returns an HTTP response.
The metrics distinguish errors generated by the load balancer from target-generated application responses.
DNS validation does not account for a measured backend connection error series.
Viewer authorization lifetime does not establish ALB backend connections.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
