You save $69.98
A logistics company needs a private route from its data center into VPCs through an existing Direct Connect connection. It does not need to reach AWS public service API endpoints. Which virtual interface type should it provision for private VPC connectivity?
A private VIF carries private connectivity toward supported VPC gateway destinations.
A public VIF is intended for public AWS service prefixes and not direct private VPC IP routing.
An internet gateway belongs to a VPC and does not terminate Direct Connect hybrid private routing.
CloudFront is a web delivery service, not a Direct Connect virtual interface.
After a network-account migration, a production Transit Gateway VPC attachment is AVAILABLE, but its source attachment is now associated with the wrong TGW route table. The branch /16 still propagates to the previously used table, and subnet routes remain intact. What is the minimal recovery action?
A TGW lookup uses the route table associated with the ingress attachment. Restoring the correct association and the permitted branch prefix addresses the actual missing dataplane path without broadening other attachments.
Changing a VPC subnet route cannot repair a TGW source attachment that looks up the wrong TGW route table.
Unrestricted propagation might make the route visible but would violate segmentation by mixing otherwise isolated networks.
Recreating an attachment is disruptive and does not by itself ensure association with the correct route table.
An internet-facing application receives a saturated upstream volumetric flood. The incident team points to a WAF rule that blocks a specific malicious HTTP URI and assumes it alone guarantees protection from every layer-three and layer-four DDoS pattern. What critical availability risk remains?
A WAF HTTP rule does not by itself handle all volumetric network-layer floods; confusing layer-seven request filtering with broader DDoS protection exposes availability.
This is a risk in firewall manager centralized security policy: Firewall Manager coordinates organization-wide firewall policies for eligible resources, while each resource's security behavior still requires policy scope and remediation. It does not account for the aws shield and resilient ddos posture fault stated in this incident.
Security groups are stateful at resource interfaces, while network ACLs are stateless subnet filters evaluated separately for each traffic direction. That explains the separate security groups versus network acl layers issue, not this demonstrated aws shield and resilient ddos posture failure.
This is a risk in cross-account transit gateway route segmentation: Transit Gateway attachment association and propagation control which routed prefixes each network segment can reach, independent of VPC security-group rules. It does not account for the aws shield and resilient ddos posture fault stated in this incident.
An internet-facing Application Load Balancer terminates TLS for checkout.example.com. The operations team wants a public trusted certificate with managed renewal rather than a manually copied private-key file on every target. Which AWS certificate workflow is appropriate?
An ALB can terminate TLS using an ACM-managed certificate, separating client-facing certificate handling from each backend target.
Allowing port 443 does not supply a server certificate.
DNSSEC and TLS serve different cryptographic functions.
Viewer authorization cookies cannot replace the ALB server certificate.
A VPC Flow Log for an EC2 ENI has log-status NODATA during an aggregation interval; a later interval shows SKIPDATA. A report labels both as equivalent evidence of no packets. Which distinction should the analyst make?
NODATA denotes no observed traffic in that interval, while SKIPDATA warns that records were skipped during collection; the two statuses support different conclusions.
Skipped records may be due to collection limitations, not an all-REJECT decision.
A quiet interface can legitimately yield a no-data interval.
ACL design is unrelated to the log delivery status field.
Two VPCs have an active peering connection but EC2 hosts cannot exchange private traffic.
Which observation would most directly demonstrate the required network outcome?
Network probes succeed both ways across the peering link and routing tables contain the correct peer CIDRs without unintended third-party access. That is relevant because vPC peering has no transitive routing and requires both VPCs to route toward the peering connection for successful bidirectional traffic.
This would validate interface vpc endpoint privatelink consumer configuration. The case instead needs evidence for vpc peering bilateral route update: Network probes succeed both ways across the peering link and routing tables contain the correct peer CIDRs without unintended third-party access.
This would validate aws ram share and attachment acceptance. The case instead needs evidence for vpc peering bilateral route update: Network probes succeed both ways across the peering link and routing tables contain the correct peer CIDRs without unintended third-party access.
This would validate transit gateway association and propagation tables. The case instead needs evidence for vpc peering bilateral route update: Network probes succeed both ways across the peering link and routing tables contain the correct peer CIDRs without unintended third-party access.
An existing Site-to-Site VPN connection has both tunnels established. After the data center team adds a new branch subnet, AWS workloads cannot initiate toward it; branch-to-AWS traffic for old subnets still works. BGP on the customer gateway never advertises the new prefix. What change should be made?
Dynamic routing requires the new prefix to be announced before AWS can choose the return path.
Compute restarts do not create missing hybrid BGP announcements.
An edge website hostname is unrelated to reachability for a branch CIDR.
DNS resolver selection cannot advertise a previously unknown branch route.
A load balancer's Target 5XX metric spikes after a backend deployment while Flow Logs continue to show accepted connections and throughput remains normal. A responder plans to replace Transit Gateway routes solely because 'all ALB 5XX errors are network routing faults.' What is the most immediate consequence of that assumption?
The target-generated HTTP failures and accepted transport point toward application investigation; changing Transit Gateway routes first can create a second outage without fixing the backend.
This is a risk in path mtu discovery black-hole diagnosis: Oversized packets may be discarded when encapsulation reduces effective MTU and Path MTU Discovery messages are blocked or misinterpreted. It does not account for the cloudwatch network metric versus application log correlation fault stated in this incident.
That outcome depends on reachability analyzer blocked security group diagnosis, whose mechanism is different: Reachability Analyzer performs static analysis of supported AWS network configuration and does not send real traffic or inspect application processes. The reported defect concerns cloudwatch network metric versus application log correlation.
Traffic Mirroring sends copied eligible packets for deep network inspection, while flow logs expose aggregate metadata rather than complete packet sequences. That explains the separate vpc traffic mirroring tls retransmission investigation issue, not this demonstrated cloudwatch network metric versus application log correlation failure.
A two-site hybrid design copies the same BGP preference controls across a Direct Connect private VIF and a Site-to-Site VPN without testing the AWS service-specific route priorities. During maintenance the primary route disappears, but the return path prefers another gateway. What routing risk did the copied-policy assumption introduce?
BGP attributes and AWS attachment-specific route priorities can select different next hops, producing asymmetric return traffic when the copied policy is never validated.
This is a risk in transit vif for multiple transit gateways: Transit VIFs connect a Direct Connect gateway to associated Transit Gateways, distinct from private VIF designs that access virtual private gateways. It does not account for the bgp route policy for hybrid path preference fault stated in this incident.
That outcome depends on site-to-site vpn encrypted hybrid baseline, whose mechanism is different: Site-to-Site VPN encrypts IP traffic over the internet using IPsec, with redundant tunnels and optional dynamic BGP route exchange. The reported defect concerns bgp route policy for hybrid path preference.
This is a risk in hybrid cidr overlap prevention: Routing uses destination prefixes to choose paths; overlapping address spaces make private packets ambiguous without deliberate isolation or translation. It does not account for the bgp route policy for hybrid path preference fault stated in this incident.
A central network account owns a Transit Gateway that application accounts should attach to without granting them network-admin rights.
Which technical explanation best accounts for the network behavior described?
AWS RAM shares eligible resource associations across accounts while resource-owner routing policy and each consumer's VPC routes remain separate responsibilities. A direct check is to use AWS Resource Access Manager to share supported networking resources with authorized accounts and enforce attachment controls and observe the corresponding path.
AWS PrivateLink offers a private service endpoint across VPC boundaries without granting general layer-three routing to the provider network. That is a valid account of privatelink service-consumer pattern, but it does not explain the aws ram controlled networking resource share behavior in the scenario.
Central egress uses attachment routes and stateful appliances to inspect traffic on both directions before leaving through approved egress points. That is a valid account of multi-account egress inspection design, but it does not explain the aws ram controlled networking resource share behavior in the scenario.
Transit Gateway can route between VPC attachments according to association and propagation rules, unlike non-transitive VPC peering. That is a valid account of transit gateway hub and spoke versus peering mesh, but it does not explain the aws ram controlled networking resource share behavior in the scenario.
Two Transit Gateways are peered across Regions A and B. A VPC in Region A can reach the local TGW, but traffic to a service subnet in Region B fails. The peering attachment is AVAILABLE and both VPC subnet route tables already point to their local TGW. The operator must verify that the inter-Region forwarding path AND its return path are actually provisioned. Which evidence is sufficient?
TGW peering does not propagate remote routes. Both regional TGW routing tables need the appropriate static routes, and successful bidirectional traffic confirms the packet path.
Attachment state and a one-way route cannot prove that the Region B return path is configured.
Routes from subnets to the local TGW cannot substitute for static routes across a peering attachment.
TGW peering attachments do not dynamically propagate remote VPC routes; toggling propagation is not proof of peering reachability.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
