You save $69.98
A Direct Connect link occasionally saturates at the top of the hour. The operations team must detect sustained throughput growth before BGP peers reset. What should be measured?
Published link utilization metrics reveal sustained approaching-capacity trends rather than relying only on BGP Up/Down state.
DNS caching does not measure circuit byte throughput.
ALB target health cannot estimate utilization on the hybrid circuit.
Tag compliance does not measure near-saturation link behavior.
An international enterprise wants inter-Region backbone connectivity but must preserve independent Regional route control.
Which AWS networking configuration best addresses this specific requirement?
Transit Gateway peering joins separate regional gateway routing domains, and the peering attachment does not automatically propagate all remote routes. The proposed change can be checked by whether each Regional attachment route table explicitly selects the peer and a cross-Region test shows the intended reachable prefixes.
This configuration addresses multi-account egress inspection design, not the cross-region transit gateway peering requirement. Central egress uses attachment routes and stateful appliances to inspect traffic on both directions before leaving through approved egress points.
This configuration addresses aws ram controlled networking resource share, not the cross-region transit gateway peering requirement. AWS RAM shares eligible resource associations across accounts while resource-owner routing policy and each consumer's VPC routes remain separate responsibilities.
This configuration addresses transit gateway hub and spoke versus peering mesh, not the cross-region transit gateway peering requirement. Transit Gateway can route between VPC attachments according to association and propagation rules, unlike non-transitive VPC peering.
AWS Network Firewall inspects transit traffic with stateful signature rules. The SOC already has VPC Flow Logs and needs the matched rule and alert message for a deliberately triggered intrusion signature, not just a five-tuple. Which additional logging should it enable?
Network Firewall alert logs expose inspection-rule detections. VPC Flow Logs alone contain connection metadata and do not report the signature identity that caused a stateful alert.
Flow Logs can expose richer network metadata but do not reproduce the Network Firewall stateful alert message.
Flow logs describe sessions, but the stated evidence requires an explicit stateful signature alert and its rule identity.
Configuration-change audit evidence does not demonstrate runtime detection of the test intrusion pattern.
A data center uses a custom IPsec gateway with route-based VPN. Tunnel establishment succeeds only when IKE parameters exactly match the AWS-generated configuration. A proposed policy changes one side’s encryption transform but not the other. What is the expected design risk?
IPsec peers must negotiate compatible security parameters; one-sided transform changes break the protected tunnel establishment.
A VPN negotiation does not permit unsupported or mismatched proposals without agreement.
IKE compatibility directly affects tunnel creation and rekeying.
Service endpoints do not negotiate customer gateway IKE settings.
A private circuit outage should fail over critical hybrid traffic to an existing Site-to-Site VPN without manual route-table edits.
Which technical explanation best accounts for the network behavior described?
Route preference depends on AWS routing-priority rules and available advertised routes; backup transport must already carry compatible reachability. A direct check is to configure supported failover route policy between Direct Connect and VPN and validate the advertised prefixes and gateway route priorities and observe the corresponding path.
The tunnel protects packets, but dynamic routing and attachment route-table associations determine which prefixes the network actually forwards. That is a valid account of site-to-site vpn bgp route propagation, but it does not explain the direct connect failover to vpn route selection behavior in the scenario.
Site-to-Site VPN supplies redundant tunnels, but failover depends on compatible dynamic routing and healthy peer sessions for both tunnel paths. That is a valid account of redundant vpn tunnels with bgp failover, but it does not explain the direct connect failover to vpn route selection behavior in the scenario.
Direct Connect connectivity depends on the physical handoff and correct virtual-interface BGP parameters; a physical optical link alone does not establish routed VPC access. That is a valid account of direct connect physical provisioning and bgp bring-up, but it does not explain the direct connect failover to vpn route selection behavior in the scenario.
A media site uses CloudFront with a custom HTTPS origin. Viewers connect securely to CloudFront, but an internal scan shows the distribution fetches some content from the origin over HTTP. Compliance requires encrypted delivery across both legs. Which CloudFront origin configuration should change?
Origin protocol policy must enforce HTTPS so that encryption continues from CloudFront to the custom origin.
Viewer encryption leaves the edge-to-origin hop unprotected if HTTP remains allowed.
DNS record type does not enforce TLS on the origin request.
Flow logs observe traffic but do not encrypt the origin connection.
A cloud network operator wants repeatable response to configuration-change events without polling every VPC manually.
Which technical explanation best accounts for the network behavior described?
EventBridge can route management events to automation targets while CloudTrail records the underlying API activity and IAM restricts what automation may alter. A direct check is to use EventBridge rules for relevant CloudTrail configuration events and trigger a scoped Lambda remediation or approval workflow and observe the corresponding path.
AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts. That is a valid account of aws config network compliance conformance, but it does not explain the eventbridge-driven network remediation behavior in the scenario.
AWS CDK turns supported imperative-language constructs into deployable CloudFormation infrastructure definitions, enabling standard reusable network patterns. That is a valid account of aws cdk secure network constructs, but it does not explain the eventbridge-driven network remediation behavior in the scenario.
STS role assumption grants temporary credentials limited by role trust and permissions, separating pipeline identity from persistent account-level root access. That is a valid account of multi-account network automation role boundaries, but it does not explain the eventbridge-driven network remediation behavior in the scenario.
A CloudFormation change set proposes replacing a production route-table resource and deleting its prior route associations. The pipeline's deployment step was configured to execute immediately without anybody reading the change set or testing rollback. Which operational failure follows from approving this workflow unchanged?
Replacing active routes without inspecting the change set can remove working production next hops even when the infrastructure template itself is syntactically valid.
That outcome depends on aws config network compliance conformance, whose mechanism is different: AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts. The reported defect concerns route-table change set safe rollout.
AWS CDK turns supported imperative-language constructs into deployable CloudFormation infrastructure definitions, enabling standard reusable network patterns. That explains the separate aws cdk secure network constructs issue, not this demonstrated route-table change set safe rollout failure.
That outcome depends on cloudformation parameterized vpc deployment, whose mechanism is different: Declarative infrastructure templates create repeatable network resources while parameters and outputs separate environment-specific values from resource definitions. The reported defect concerns route-table change set safe rollout.
A bank operates one Direct Connect circuit in a colocation site. A fiber-cut scenario could isolate every AWS application even if its AWS VPCs span multiple Availability Zones. Which design change addresses the physical single point of failure?
Location-diverse connections reduce dependency on one colocation facility or local physical path.
Additional software routing entries do not create a second physical path from the data center.
Edge HTTP caching cannot replace lost private hybrid network transport.
A longer hold timer does not survive loss of the underlying fiber connection.
A security team must detect newly created unrestricted internet-facing security-group rules and open a controlled remediation workflow.
Which AWS networking configuration best addresses this specific requirement?
EventBridge can route management events to automation targets while CloudTrail records the underlying API activity and IAM restricts what automation may alter. The proposed change can be checked by whether a safe test rule change produces an auditable event and a controlled alert or approved correction without affecting permitted rules.
This configuration addresses aws cdk secure network constructs, not the eventbridge-driven network remediation requirement. AWS CDK turns supported imperative-language constructs into deployable CloudFormation infrastructure definitions, enabling standard reusable network patterns.
This configuration addresses aws config network compliance conformance, not the eventbridge-driven network remediation requirement. AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts.
This configuration addresses cloudformation parameterized vpc deployment, not the eventbridge-driven network remediation requirement. Declarative infrastructure templates create repeatable network resources while parameters and outputs separate environment-specific values from resource definitions.
A VPC Flow Logs record for the database ENI shows REJECT on the client five-tuple. The team has confirmed the route is correct but does not know whether a security group or a network ACL caused the denial. What is the best next investigation?
Flow-log action narrows a network filtering problem but does not by itself always identify which filter rejected the traffic.
The VPC Flow Log action relates to network traffic handling, not SQL authentication.
The record already shows IP addresses and denied traffic, not a DNS validation verdict.
An ENI flow reject does not explain higher-layer TLS processing by itself.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
