You save $69.98
Private-subnet ETL workers in one AWS Region download large files from S3 buckets in that same Region through a public NAT gateway. The security team wants the workers to remain private and the finance team wants to avoid NAT data-processing fees for S3 traffic. What is the preferred network change?
An S3 gateway endpoint supplies a VPC route to same-Region S3 without requiring NAT or internet egress for the private instances. Associating the correct subnet route tables redirects eligible S3 traffic while maintaining applicable access controls.
Public addresses on every worker change the private-workload posture and create operational overhead. The cost problem is specifically service traffic via NAT, not an absence of instance public addresses.
A Direct Connect public VIF serves customer-to-AWS public connectivity, not a VPC-native endpoint for local private-subnet S3 requests. It adds a physical hybrid dependency where none is needed.
S3 website exposure is unnecessary for authorized application downloads and violates the intent to keep traffic and resources private. Removing transport security would create risk rather than reduce required NAT fees safely.
A PCI application sends selected east-west TCP traffic through a dedicated inspection VPC connected by TGW. AWS Network Firewall endpoints are healthy, but only outbound traffic crosses them; return packets follow a different TGW/VPC path and stateful sessions fail. What routing correction is required?
Stateful inspection requires symmetric enough routing for both directions to share the intended firewall state. Healthy endpoints do not matter when the response path bypasses the inspection VPC.
Opening security-group rules does not restore the stateful inspection path or shared firewall session state.
Logging can reveal the bypass but cannot direct packets through the missing stateful return path.
DNS naming does not solve the specified asymmetric packet forwarding through the stateful firewall.
A SaaS vendor hosts a private TCP service behind an NLB. A customer in another AWS account needs access from selected subnets while keeping both VPC CIDR spaces unrouted to each other. The vendor must approve new consumers. Which arrangement is appropriate?
An NLB-backed PrivateLink endpoint service exposes the specific service through consumer interface endpoints without general VPC CIDR routing. Principal permissions and optional acceptance give the vendor explicit control over which consumers connect.
VPC peering enables general private address reachability between selected VPCs and requires routing. The scenario explicitly prohibits routing the two VPC CIDR spaces into each other, so peering violates that boundary.
A VPN to an unrelated on-premises firewall adds infrastructure and is not the private service-consumer mechanism requested. There is already an AWS-hosted service behind an NLB.
A shared Transit Gateway route domain enables broader inter-VPC routing than the vendor intends. The customer is allowed to consume one service, not gain network-layer access to the vendor VPC.
A company serves confidential PDF manuals through a CloudFront distribution backed by a regular S3 bucket. Security has disabled public bucket access, but the distribution still needs read access to the objects. The organization also uses SSE-KMS encryption for the manuals. Which origin access design meets both requirements?
OAC signs the CloudFront requests to an ordinary S3 bucket origin. The bucket policy can restrict access to the distribution, and suitable KMS permissions permit encrypted object reads. This keeps the documents private at the origin while allowing distribution delivery.
An NLB distributes transport connections to supported targets; it cannot act as a native S3 authorization bridge that supplies OAC signatures or KMS access. Adding an internet-facing listener would introduce exposure without solving bucket access.
S3 website endpoints require the website-origin pattern and do not support CloudFront OAC. Making the bucket public would directly contradict the stated confidentiality policy, even if users reached the same manuals through CloudFront.
A private hosted zone changes DNS resolution inside associated VPCs; it does not authorize CloudFront to retrieve private S3 objects or to decrypt SSE-KMS data. The missing control is authenticated origin access, not name resolution.
During Direct Connect commissioning, the physical link is up and the 802.1Q VLAN is provisioned, but the private VIF's BGP session remains Idle. The router is configured with an ASN different from the customer ASN specified on the VIF. Which change should be assessed before modifying VPC routing?
The link and VLAN are already available, so an Idle BGP session points to the routing-peering configuration. Ensuring the configured peer/customer ASN and neighbor settings match the Direct Connect VIF is a specific prerequisite before downstream VPC routes can work.
DNSSEC protects DNS response authenticity and would not negotiate a BGP session. The described failure is a routing-control-plane adjacency, not an inability to trust hostnames.
A default route to an internet gateway neither fixes the BGP neighbor nor establishes a private path from the datacenter. It could introduce unapproved internet forwarding, unrelated to Direct Connect peering.
A public VIF would change the destination scope to AWS public services, but the requirement is a private VPC connection. The customer ASN mismatch must be resolved on the intended VIF instead.
A campus DNS server has a conditional forwarder for aws.corp.example pointing at the two private IPs of an inbound Resolver endpoint. Queries time out, although the datacenter-to-VPC route works and the endpoint is Operational. Its security group allows only TCP 443. What is the most likely configuration defect for standard DNS forwarding?
Standard DNS forwarding sends requests to port 53 over UDP and sometimes TCP. The endpoint is Operational and network routes exist, but the explicit security-group rule blocks these packets, so authorizing port 53 from trusted resolvers fixes this missing layer.
CloudFront operates on application content delivered over HTTP, not recursive DNS questions arriving over a private forwarding path. It cannot process the campus resolver's port-53 exchanges.
VPC DNS support is required for normal Amazon-provided DNS behavior and is not incompatible with inbound forwarding. Turning it off would introduce additional resolution faults rather than allowing a denied packet.
Global Accelerator accepts application transport traffic to configured regional endpoints; it is not a DNS Resolver inbound endpoint replacement. The observed denial is on the inbound endpoint's security group.
An infrastructure team proposes a CloudFormation update that changes two VPC route tables and modifies an existing NAT gateway. Network policy requires a review of replacements and deletions before production execution. Which deployment step provides that preview without immediately applying the change?
Change sets describe planned adds, modifications, replacements and removals before deployment. Reviewers can assess the networking impact and execute the selected change set only when approved; the preview is not itself a success guarantee.
DNS weighting can alter client routing for eligible names but cannot preview or approve CloudFormation changes to subnets, NAT gateways and route tables. It acts on traffic rather than infrastructure-as-code plans.
Traffic Mirroring captures present packet flows from supported ENIs. It has no ability to inspect the future AWS CloudFormation resource change list or predict infrastructure replacement behavior from a template.
A direct stack update begins modifying production immediately, so even if the event stream records a replacement, it does not satisfy the required advance review window.
An on-premises DNS server at 192.0.2.53 must resolve names from an AWS private hosted zone associated with the application VPC. A Direct Connect private network path already exists. Existing internet resolvers must not be authoritative for these records. What should the DNS engineer configure?
Inbound Resolver endpoints give the on-premises DNS server private addresses to query. Conditional forwarding for the private namespace sends those requests through Direct Connect to the VPC Resolver, which can answer from the associated private zone.
Outbound Resolver endpoints move queries from a VPC toward external DNS servers. The required flow is the reverse: on-premises resolvers must query the VPC Resolver for private-zone records over an existing private connection.
Public hosted zones publish externally resolvable DNS data and cannot replace a private hosted zone's VPC-scoped record behavior. Exposing internal records would breach the condition that internet resolvers stay out of this lookup path.
Weighted routing chooses among answers inside an authoritative zone; it does not establish a hybrid recursive forwarding path. A record pointing at the DNS server would not allow that server to discover private VPC zone entries.
Six application teams repeatedly choose overlapping 10.0.0.0/16 CIDR blocks when creating VPCs in separate accounts. The central network group needs allocation history, policy-driven nonoverlap and visibility into CIDR usage before expanding a Transit Gateway. What should it deploy?
Amazon VPC IPAM tracks address pools and allocations, supports automated CIDR assignments, and offers organizational visibility. Using governed pools prevents ad hoc VPC CIDR reuse before routes are joined in a common network domain.
CloudFront origin groups direct web requests toward HTTP origins and have no network-address allocation role. They cannot stop teams from creating colliding RFC1918 ranges across AWS accounts.
Firewall drops might mask broken connectivity after overlap occurs, but they do not prevent conflicting allocations or retain address assignment history. They would also disrupt legitimate traffic rather than plan address space.
TXT records can document values but they do not allocate nonoverlapping address space or monitor live VPC CIDR use. DNS is not a suitable source of truth for IPAM policy enforcement across accounts.
A security group ingress rule changed at 02:41 UTC in a regulated AWS account. Investigators need the exact IAM principal and EC2 API operation that made the change. VPC Flow Logs show traffic later but cannot identify the editor. Which audit source should be queried?
CloudTrail management events record supported AWS control-plane API operations and caller identity, allowing investigators to attribute the security group modification by time and resource.
Flow Logs provide network flow metadata and permission outcomes; they do not record which IAM identity issued a separate security-group control-plane change.
CloudFront cache hit rates describe HTTP delivery performance, not which user or assumed role edited an EC2 firewall rule at the cited time.
BGP prefix metrics show route exchange behavior on a network interface and do not identify individual management API authors in a VPC account.
Private EC2 batch workers in us-east-1 read terabytes from regional Amazon S3 buckets through a public NAT gateway. Costs show substantial NAT data-processing charges, and the workload needs no public inbound access. What network change targets this cost without changing its S3 API?
An S3 gateway endpoint routes eligible S3 traffic without traversing the public NAT gateway, reducing its per-GB processing usage while retaining private subnet clients and existing APIs.
Direct Connect is a hybrid connectivity service; it is not an EC2 instance route substitute for same-Region private S3 access from a VPC.
EC2 CPU reservation does not alter NAT gateway bytes processed or S3 routing. The cost driver is explicit network address translation on the S3 path.
Adding a second NAT gateway adds capacity and fixed cost but still processes eligible S3 bytes through NAT. It does not remove the identified charge mechanism.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
