You save $69.98
A private workload VPC has outbound internet egress through a zonal NAT gateway in Availability Zone A. AZ A becomes unavailable; application EC2 instances in AZ B are healthy but cannot download updates. Which operational dependency caused this?
An otherwise healthy workload can lose outbound reachability when its egress path has a single zonal dependency.
Private instances can use supported NAT egress without public addresses.
An ALB certificate does not explain every private subnet’s outbound NAT loss.
The failure coincides with an egress gateway zone loss, not public DNS delegation.
A security team is rolling out Route 53 Resolver DNS Firewall rules that would block newly registered suspicious domains. It first needs visibility into which VPC applications might be affected without rejecting requests. Which rollout sequence is safest?
Alert records matching DNS queries while allowing resolution, supporting a controlled transition to denial after impact review.
An immediate broad denial violates the required non-disruptive pilot.
Transport-wide blocking is not domain-selective and would break unrelated DNS.
Private zone shadowing can create unintended answers and is not a controlled Firewall alert pilot.
A VPC has a Resolver forwarding rule sending corp.example requests to on-premises DNS. A new AWS-only subdomain app.corp.example must be resolved within the VPC without forwarding it to the datacenter. The broader forwarding rule must remain in place. What DNS rule change is appropriate?
A more specific Resolver system rule can override the parent-domain forwarding behavior for the named AWS-only subdomain. Other corp.example queries continue to reach corporate DNS as required.
Public DNS records do not change the precedence of an existing VPC forwarding rule that matches the same namespace. It would also expose internal names unnecessarily.
Transit Gateway routing determines IP packet next hops, not whether a VPC resolver uses a specific DNS forwarding or system rule for a queried name.
Removing the outbound endpoint would break legitimate lookups for the rest of the corporate namespace. The scenario requires keeping those queries forwarded to the datacenter.
The network architect needs one Direct Connect gateway to connect eligible Transit Gateways across accounts using private IP routing.
Which AWS networking configuration best addresses this specific requirement?
Transit VIFs connect a Direct Connect gateway to associated Transit Gateways, distinct from private VIF designs that access virtual private gateways. The proposed change can be checked by whether a lab route test confirms eligible VPC prefixes traverse the intended transit VIF and Transit Gateway attachments in both directions.
This configuration addresses hybrid cidr overlap prevention, not the transit vif for multiple transit gateways requirement. Routing uses destination prefixes to choose paths; overlapping address spaces make private packets ambiguous without deliberate isolation or translation.
This configuration addresses ipsec encryption over direct connect, not the transit vif for multiple transit gateways requirement. Direct Connect provides a dedicated transport path but does not inherently encrypt all payloads, so confidentiality must be provided separately when policy requires it.
This configuration addresses bgp route policy for hybrid path preference, not the transit vif for multiple transit gateways requirement. BGP route attributes and permitted prefixes influence dynamic route selection, while AWS service-specific routing priorities and Direct Connect behavior impose constraints.
An international financial protocol runs raw TCP connections to two healthy AWS Regions. The client base cannot rely on caching and has fixed public firewall allowlists. Which optimization can improve global entry stability without requiring DNS failover updates to client rules?
An accelerator can preserve global ingress addresses while routing supported TCP connections toward eligible healthy regional backends.
An HTTP content cache does not transparently accelerate the required arbitrary raw TCP service.
Changing every client allowlist contradicts the fixed-ingress constraint.
Uncontrolled client resolver caching undermines the required stable entry-point behavior.
A global enterprise's branch-to-Region path changed after a network overlay maintenance event and clients notice variable latency.
Which technical explanation best accounts for the network behavior described?
Global network visibility tools present topology and routing evidence; they do not independently update all VPC, attachment or on-premises routes. A direct check is to use Network Manager topology and supported route analysis alongside CloudWatch or gateway route tables to inspect the actual hybrid path and observe the corresponding path.
Reachability Analyzer performs static analysis of supported AWS network configuration and does not send real traffic or inspect application processes. That is a valid account of reachability analyzer blocked security group diagnosis, but it does not explain the transit gateway network manager path diagnostics behavior in the scenario.
VPC Flow Logs summarize observed network flows, and ACCEPT usually indicates network-level permission rather than successful application-layer processing. That is a valid account of flow log reject versus accept interpretation, but it does not explain the transit gateway network manager path diagnostics behavior in the scenario.
Traffic Mirroring sends copied eligible packets for deep network inspection, while flow logs expose aggregate metadata rather than complete packet sequences. That is a valid account of vpc traffic mirroring tls retransmission investigation, but it does not explain the transit gateway network manager path diagnostics behavior in the scenario.
An uneven application target fleet has all healthy targets in one Availability Zone but client connections enter multiple zones.
Which observation would most directly demonstrate the required network outcome?
Zone-specific target and connection metrics demonstrate the expected distribution even when per-zone capacity is uneven. That is relevant because cross-zone choices determine whether load balancer nodes can distribute traffic to healthy targets beyond the node's own zone, subject to product-specific defaults.
This would validate alb layer-seven route and tls. The case instead needs evidence for cross-zone load balancing and target distribution: Zone-specific target and connection metrics demonstrate the expected distribution even when per-zone capacity is uneven.
This would validate gateway load balancer inline inspection. The case instead needs evidence for cross-zone load balancing and target distribution: Zone-specific target and connection metrics demonstrate the expected distribution even when per-zone capacity is uneven.
This would validate nlb static ip and tcp passthrough. The case instead needs evidence for cross-zone load balancing and target distribution: Zone-specific target and connection metrics demonstrate the expected distribution even when per-zone capacity is uneven.
A company needs to authenticate private east-west services with an internal PKI and protect certificate authority management roles.
Which observation would most directly demonstrate the required network outcome?
An authorized workload presents a correctly chained private certificate and an unauthorized issuer's certificate is rejected. That is relevant because aCM Private CA issues private certificates under an organization-controlled certificate hierarchy, distinct from public ACM trust issuance.
This would validate route 53 dnssec chain-of-trust protection. The case instead needs evidence for acm private ca internal mutual trust: An authorized workload presents a correctly chained private certificate and an unauthorized issuer's certificate is rejected.
This would validate tls end-to-end and nlb passthrough choice. The case instead needs evidence for acm private ca internal mutual trust: An authorized workload presents a correctly chained private certificate and an unauthorized issuer's certificate is rejected.
This would validate alb acm certificate managed tls. The case instead needs evidence for acm private ca internal mutual trust: An authorized workload presents a correctly chained private certificate and an unauthorized issuer's certificate is rejected.
A central network log archive receives VPC Flow Logs from multiple accounts. The auditor requires restricted reader roles and encrypted storage under an approved key policy. Which evidence design best meets the requirement?
Flow metadata contains internal network information; encryption, access control and lifecycle are part of reliable audit custody.
Public availability conflicts with restricted sensitive network evidence.
Automation-origin records are still subject to custody and authorization controls.
Public DNS is unsuitable for protected retained network logs.
Two application VPCs attach to a Transit Gateway in the same Region. Both attachment route tables contain expected propagated prefixes, but EC2 instances still forward remote-VPC packets to the local default gateway with no route to the Transit Gateway attachment. Which configuration is missing?
Transit Gateway routes alone do not cause EC2 subnet traffic to leave the VPC via its TGW target.
Longer logging retention cannot create a missing data-plane route.
DNS names cannot substitute for VPC route-table entries.
S3 origin access controls are unrelated to VPC-to-VPC subnet routing.
Auto-scaling worker fleets frequently exhaust usable IP addresses in otherwise healthy private VPC subnets.
Which AWS networking configuration best addresses this specific requirement?
VPC IPAM tracks allocations and overlap across organizational address pools, while usable subnet space still bounds ENI and pod growth. The proposed change can be checked by whether the allocation dashboard shows non-overlapping prefixes and a scale test creates the required number of new ENIs without address exhaustion.
This configuration addresses global accelerator latency and failover optimization, not the ipam and vpc cidr growth planning requirement. Global Accelerator routes eligible TCP or UDP traffic onto the AWS global network and supports static anycast ingress and health-based endpoint routing.
This configuration addresses cloudfront global egress optimization, not the ipam and vpc cidr growth planning requirement. A CDN uses regional and edge caches to satisfy repeated object requests, reducing origin bandwidth while incurring its own delivery charges.
This configuration addresses nat gateway data-processing cost reduction, not the ipam and vpc cidr growth planning requirement. A gateway endpoint can route supported S3 traffic inside AWS without passing that traffic through a NAT gateway's per-GB processing path.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
