You save $69.98
An internal application ALB has healthy targets but a spike in HTTPCode_ELB_5XX_Count and TargetConnectionErrorCount. The targets show no corresponding application-level 5XX spike. Where should troubleshooting focus first?
ELB-generated errors and target connection errors can reflect failures before the backend application returns an HTTP response.
The metrics distinguish errors generated by the load balancer from target-generated application responses.
DNS validation does not account for a measured backend connection error series.
Viewer authorization lifetime does not establish ALB backend connections.
An engineer mistakenly tries to attach a private VIF directly to a Transit Gateway for multi-VPC datacenter routing.
Which observation would most directly demonstrate the required network outcome?
The transit VIF and gateway associations are active and approved hybrid prefixes reach multiple intended VPC attachments. That is relevant because a transit VIF uses the Direct Connect gateway to reach a Transit Gateway; a private VIF is associated with virtual private gateway connectivity instead.
This would validate direct connect physical provisioning and bgp bring-up. The case instead needs evidence for transit virtual interface to transit gateway: The transit VIF and gateway associations are active and approved hybrid prefixes reach multiple intended VPC attachments.
This would validate hybrid path mtu and fragmentation. The case instead needs evidence for transit virtual interface to transit gateway: The transit VIF and gateway associations are active and approved hybrid prefixes reach multiple intended VPC attachments.
This would validate site-to-site vpn bgp route propagation. The case instead needs evidence for transit virtual interface to transit gateway: The transit VIF and gateway associations are active and approved hybrid prefixes reach multiple intended VPC attachments.
A production VPC has private subnets in two Availability Zones, yet every internet-bound private subnet default route points at a NAT gateway in Zone A. The resilience plan assumes both zones can keep downloading critical software if Zone A fails. Which shared dependency invalidates that claim?
Both private subnets depend on one zonal NAT gateway, which can add inter-zone processing paths and fail when its Availability Zone is lost.
This is a risk in transit gateway cross-region static routing: Transit Gateway inter-Region peering does not automatically propagate remote attachment prefixes; route-table entries identify the peering path. It does not account for the nat gateway route and az resilience fault stated in this incident.
VPC peering has no transitive routing and requires both VPCs to route toward the peering connection for successful bidirectional traffic. That explains the separate vpc peering bilateral route update issue, not this demonstrated nat gateway route and az resilience failure.
This is a risk in transit gateway association and propagation tables: Transit Gateway forwards packets based on the attachment's associated route table, while propagation adds routes to selected tables rather than all tables. It does not account for the nat gateway route and az resilience fault stated in this incident.
A company has large same-Region S3 transfers from private subnets and an unexpected spike in NAT gateway data-processing charges.
Which AWS networking configuration best addresses this specific requirement?
A gateway endpoint can route supported S3 traffic inside AWS without passing that traffic through a NAT gateway's per-GB processing path. The proposed change can be checked by whether cost usage data shows reduced NAT bytes for S3 traffic while a private subnet can still access only approved S3 resources.
This configuration addresses eni performance instance network capability, not the nat gateway data-processing cost reduction requirement. Elastic Network Adapter supports enhanced network performance on compatible instance types, while achievable bandwidth also depends on instance size.
This configuration addresses elastic fabric adapter hpc placement, not the nat gateway data-processing cost reduction requirement. Elastic Fabric Adapter offers specialized OS-bypass networking for supported HPC workloads; it is not a generic internet-facing load balancer.
This configuration addresses cloudfront global egress optimization, not the nat gateway data-processing cost reduction requirement. A CDN uses regional and edge caches to satisfy repeated object requests, reducing origin bandwidth while incurring its own delivery charges.
An enterprise wants to share Route 53 Resolver rules across AWS accounts while controlling which VPCs use them.
Which AWS networking configuration best addresses this specific requirement?
A shared Resolver rule enables cross-account reuse of the same domain-specific outbound lookup policy, while attachment and network reachability remain necessary. The proposed change can be checked by whether all approved VPCs resolve the corporate suffix through the specified resolver targets and unapproved VPCs do not gain an implicit rule.
This configuration addresses route 53 resolver inbound endpoint deployment, not the route 53 resolver forwarding rule sharing requirement. An inbound resolver accepts queries from outside the VPC and resolves the associated private namespace without publishing the records to the public internet.
This configuration addresses split-horizon dns precedence troubleshooting, not the route 53 resolver forwarding rule sharing requirement. VPC Resolver selects eligible private namespaces and forwarding rules based on match and association; public records need not be consulted when a matching private zone exists.
This configuration addresses dnssec public-zone validation and signing, not the route 53 resolver forwarding rule sharing requirement. DNSSEC establishes a chain of trust from a parent DS record to the child zone's signing keys, allowing validating resolvers to reject forged answers.
Security wants to know which VPC workloads queried a known malicious domain without exposing every DNS payload to public tools.
Which AWS networking configuration best addresses this specific requirement?
Resolver query logs provide DNS request observations for associated VPC resolution paths, distinct from network-flow and API change logs. The proposed change can be checked by whether a synthetic lookup from an approved VPC generates a time-correlated DNS query record with the relevant domain and source context.
This configuration addresses vpc traffic mirroring security packet evidence, not the route 53 resolver query logging security visibility requirement. Traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata.
This configuration addresses cloudtrail network api audit, not the route 53 resolver query logging security visibility requirement. CloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads.
This configuration addresses network firewall flow and alert log delivery, not the route 53 resolver query logging security visibility requirement. Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches.
CloudFront must pass an internal X-Tenant-Region request header to the application origin, but the origin response is identical for all values of that header. Including this value in the cache key has sharply reduced hits. What is the targeted policy correction?
Origin request policies can forward a value needed by the origin without also varying the cache identity. Since response bytes do not differ, that separation preserves correctness and improves hits.
TLS certificates authenticate hostnames rather than arbitrary application headers. Extra ACM certificates do not affect X-Tenant-Region header forwarding, origin request policy settings, or the CloudFront cache key.
Deleting the header prevents the origin from receiving a value it explicitly requires for routing or logging. It may improve caching but breaks the stipulated origin contract.
Keeping an irrelevant header in the key continues unnecessary cache fragmentation. Shortening TTL further increases revalidation and origin load instead of addressing the actual variation.
Two internal microservices establish mutual TLS using certificates issued by the company's ACM Private CA. A replacement workload presents a publicly trusted certificate for the correct DNS name, but the receiving service trusts only the enterprise private CA for workload identity. Why should the replacement connection be rejected even though its public chain is valid?
A private CA establishes an organization-controlled identity trust boundary. Public trust validation cannot replace an application policy that explicitly anchors client certificates to that private hierarchy.
A transport listener forwards TLS bytes but does not change client certificate issuers or service trust policy.
Encrypting a viewer connection does not issue the required private workload credential.
A private network path does not supersede mTLS client identity validation.
VPC instances need to resolve printer.factory.internal via on-premises DNS over Direct Connect. The VPC already has an outbound Resolver endpoint and target corporate DNS addresses, but no forwarding rule matches factory.internal. Which missing configuration explains NXDOMAIN?
An outbound endpoint alone does not select which DNS names should be forwarded to the specified on-premises servers.
Publicizing a private factory name breaks the intended split DNS design.
CloudFront delivers web content and cannot choose VPC DNS forwarding rules.
Subnet address capacity is not the reason for missing DNS rule selection.
A Site-to-Site VPN CloudWatch alarm reports TunnelState=0 for one tunnel. The second tunnel shows healthy BGP routes, and application probes are successful. What should the alert convey?
One down tunnel creates exposure to a further failure and warrants repair while the surviving route currently carries traffic.
The other tunnel and successful probes demonstrate that at least some approved traffic still flows.
A tunnel failure does not increase transport capacity.
TunnelState concerns VPN tunnel availability, not authoritative DNS response timing.
A private workload VPC has outbound internet egress through a zonal NAT gateway in Availability Zone A. AZ A becomes unavailable; application EC2 instances in AZ B are healthy but cannot download updates. Which operational dependency caused this?
An otherwise healthy workload can lose outbound reachability when its egress path has a single zonal dependency.
Private instances can use supported NAT egress without public addresses.
An ALB certificate does not explain every private subnet’s outbound NAT loss.
The failure coincides with an egress gateway zone loss, not public DNS delegation.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
