You save $69.98
A domain registrar still delegates example.org to a legacy DNS provider. A network team creates a complete Route 53 public hosted zone and confirms its authoritative name servers answer correctly when queried directly, but normal internet lookups still see old records. What is missing?
Recursive resolvers discover authoritative servers via delegation, not by searching all hosted zones for a domain name.
Changing zone data does not redirect the parent delegation.
Private zones answer only associated VPC resolvers and do not fix public authority.
An inbound private DNS endpoint is not used by the internet’s delegation chain.
A CloudFront distribution with a custom HTTPS hostname uses an ACM certificate requested in eu-west-1. The certificate appears issued, yet cannot be selected for viewer HTTPS on the global distribution. The domain name matches and DNS is correct. What is the necessary fix?
CloudFront viewer certificates from ACM must be provisioned in US East (N. Virginia). A matching certificate there can serve the alternate domain name for the global distribution.
Route 53 alias records direct hostnames to distributions, but DNS has no mechanism to copy or relocate an issued ACM certificate between AWS Regions or enable viewer TLS.
CloudFront operates at globally distributed edge locations, but ACM viewer certificates are not manually copied to each edge Region. The service uses the properly issued us-east-1 certificate for the alternate domain name.
Origin-to-CloudFront TLS settings affect the back-end connection, not the location of the viewer-facing ACM certificate. Downgrading origin encryption would not make the certificate selectable.
Network logs show TCP sessions were allowed but a low-latency trading service experiences bursts of retransmission and resets.
Which observation would most directly demonstrate the required network outcome?
A controlled capture identifies retransmission patterns, dropped packets or handshake behavior and is protected under the approved evidence policy. That is relevant because traffic Mirroring sends copied eligible packets for deep network inspection, while flow logs expose aggregate metadata rather than complete packet sequences.
This would validate reachability analyzer blocked security group diagnosis. The case instead needs evidence for vpc traffic mirroring tls retransmission investigation: A controlled capture identifies retransmission patterns, dropped packets or handshake behavior and is protected under the approved evidence policy.
This would validate transit gateway network manager path diagnostics. The case instead needs evidence for vpc traffic mirroring tls retransmission investigation: A controlled capture identifies retransmission patterns, dropped packets or handshake behavior and is protected under the approved evidence policy.
This would validate path mtu discovery black-hole diagnosis. The case instead needs evidence for vpc traffic mirroring tls retransmission investigation: A controlled capture identifies retransmission patterns, dropped packets or handshake behavior and is protected under the approved evidence policy.
A shared services account owns a private hosted zone containing database records. A workload VPC in a different account needs the same names, and no organization-wide automatic association exists. What two-sided workflow permits the association?
Cross-account private hosted zones require explicit authorization and association so only selected VPCs receive private answers.
That would broaden access and change private namespace semantics.
DNS zone association does not require database admin credentials.
DNS association is a separate operation from full inter-VPC packet routing.
An edge team only needs to rewrite /old-home to /home and normalize trailing slashes before CloudFront checks its cache key. Processing must be lightweight with no network calls or large application dependencies. Which edge compute service is most appropriate?
CloudFront Functions run small viewer-facing transformations and are suited to URL rewriting and request normalization. The case does not need Lambda@Edge origin access, external network calls or long processing.
DynamoDB Streams invokes processing after data changes and is unrelated to HTTP requests arriving at CloudFront. It cannot normalize a viewer request path or change the incoming cache key.
An origin-response handler runs after origin retrieval and brings unnecessary complexity. It cannot serve as the most direct lightweight viewer-request path normalization control before the first cache lookup.
An NLB routes transport connections and cannot evaluate or rewrite HTTP URL paths, normalize trailing slashes, or change CloudFront cache keys the way a viewer-request function can.
A centralized third-party firewall VPC uses Gateway Load Balancer for inspection. Security must prove that traffic is not bypassing the inspection targets when an east-west flow crosses the shared network. Which combined observation establishes the actual dataplane path?
A stateful inspection assurance requires the packet path and an appliance decision tied to the same traffic, rather than just a deployed endpoint resource.
Resource inventory does not prove the target observed an actual bidirectional session.
That demonstrates a potential inspection bypass, not policy enforcement at the appliance.
Flow Logs ACCEPT is not direct evidence that the appliance inspected and allowed the flow.
An internet-facing ALB receives HTTPS requests with a Host header for admin.example.com, but the listener has a broad default forward action and a higher-priority rule for that host. Security now wants that host to receive a fixed 403 response instead of reaching targets. What should be changed?
ALB listener rules can match host conditions and return fixed responses without forwarding the request to a target.
Health checks alter target health rather than implementing a host-specific intentional client response.
Layer-four listener forwarding removes the host rule behavior needed.
That creates broad errors rather than a scoped host-header fixed response.
A Network Load Balancer has cross-zone balancing disabled and has registered eligible targets only in Zone A. Clients connect through NLB node IPs in Zones A and B. Which result demonstrates the impact of the missing Zone B target capacity?
With cross-zone disabled, each enabled NLB zone depends on eligible targets local to that node's zone.
That assumes cross-zone forwarding in a configuration that intentionally disables it.
DNS delegation does not create NLB backend capacity.
An NLB is a different load balancer; the relevant tests concern its zonal entry and target health.
A security team sees a permitted TCP flow in VPC Flow Logs but must inspect packets to determine unusual connection behavior.
Which technical explanation best accounts for the network behavior described?
Traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata. A direct check is to set up narrowly scoped VPC Traffic Mirroring to a protected inspection target with an explicit retention and access policy and observe the corresponding path.
Firewall Manager can evaluate whether eligible resources meet organization-wide firewall policy assignments and report noncompliant cases. That is a valid account of firewall manager organization compliance audit, but it does not explain the vpc traffic mirroring security packet evidence behavior in the scenario.
Resolver query logs provide DNS request observations for associated VPC resolution paths, distinct from network-flow and API change logs. That is a valid account of route 53 resolver query logging security visibility, but it does not explain the vpc traffic mirroring security packet evidence behavior in the scenario.
Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches. That is a valid account of network firewall flow and alert log delivery, but it does not explain the vpc traffic mirroring security packet evidence behavior in the scenario.
A private healthcare API uses TLS between internal services. Public trust CAs must not issue these endpoint identities; the organization wants its own managed certificate hierarchy and short-lived internal client certificates. Which service fits?
A private CA can issue and manage certificate chains under organization-controlled trust for internal TLS authentication.
DNSSEC signatures do not issue X.509 client or server certificates.
Disclosing TLS private keys undermines the required confidentiality.
Transport forwarding without TLS would not satisfy the certificate-based identity requirement.
An analyst wants to correlate suspicious IP connections across multiple ENIs without taking full packet captures from production workloads.
Which technical explanation best accounts for the network behavior described?
Flow logs emit metadata such as IP addresses, ports, bytes and ACCEPT/REJECT action for supported network flows, not raw packet bodies. A direct check is to enable VPC Flow Logs with appropriate fields, aggregation, scope and protected log delivery for the investigated resources and observe the corresponding path.
CloudWatch alarms evaluate metric periods and thresholds while EventBridge and notification integrations can dispatch timely security response signals. That is a valid account of cloudwatch alarm and security response integration, but it does not explain the vpc flow logs for security investigations behavior in the scenario.
Firewall Manager can evaluate whether eligible resources meet organization-wide firewall policy assignments and report noncompliant cases. That is a valid account of firewall manager organization compliance audit, but it does not explain the vpc flow logs for security investigations behavior in the scenario.
Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches. That is a valid account of network firewall flow and alert log delivery, but it does not explain the vpc flow logs for security investigations behavior in the scenario.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
