You save $69.98
A VPC Flow Logs record for the database ENI shows REJECT on the client five-tuple. The team has confirmed the route is correct but does not know whether a security group or a network ACL caused the denial. What is the best next investigation?
Flow-log action narrows a network filtering problem but does not by itself always identify which filter rejected the traffic.
The VPC Flow Log action relates to network traffic handling, not SQL authentication.
The record already shows IP addresses and denied traffic, not a DNS validation verdict.
An ENI flow reject does not explain higher-layer TLS processing by itself.
A large enterprise needs predictable high-throughput hybrid connectivity for non-public VPC IP addresses and can arrange colocation cross-connects.
Which technical explanation best accounts for the network behavior described?
Direct Connect provides a dedicated physical network path for AWS resources, while its private VIF and gateway controls determine private VPC reachability. A direct check is to design dedicated or hosted AWS Direct Connect connectivity with suitable private virtual interfaces, gateway associations and an independent secondary path and observe the corresponding path.
Routing uses destination prefixes to choose paths; overlapping address spaces make private packets ambiguous without deliberate isolation or translation. That is a valid account of hybrid cidr overlap prevention, but it does not explain the direct connect private connectivity and redundancy behavior in the scenario.
Direct Connect provides a dedicated transport path but does not inherently encrypt all payloads, so confidentiality must be provided separately when policy requires it. That is a valid account of ipsec encryption over direct connect, but it does not explain the direct connect private connectivity and redundancy behavior in the scenario.
Transit VIFs connect a Direct Connect gateway to associated Transit Gateways, distinct from private VIF designs that access virtual private gateways. That is a valid account of transit vif for multiple transit gateways, but it does not explain the direct connect private connectivity and redundancy behavior in the scenario.
An analyst must distinguish inbound packets dropped by a VPC network ACL from traffic accepted on a public subnet interface. The compliance evidence requires IP, ports, interface and the action on each observed network flow. Which log should be queried?
Flow Logs provide interface-level flow metadata and ACCEPT or REJECT outcomes useful in investigating network-layer controls.
API history cannot show each observed packet-flow permission result.
HTTP edge requests cannot prove an EC2 subnet interface flow action.
Certificate information does not include VPC interface allow/deny flow records.
A data center advertises the same prefix over two Direct Connect private virtual interfaces and uses supported AWS BGP local-preference communities. A router engineer then adds AS_PATH prepending to one path and assumes it will override the higher-precedence AWS local-preference setting for AWS-to-on-premises traffic. Which failure risk does that assumption create?
For supported Direct Connect routing, prefix match and AWS-supported BGP preference rules must be evaluated in their documented order.
AS_PATH changes cannot be assumed to outrank the documented AWS preference hierarchy.
Prefix-length changes alter reachability and are not a safe substitute for understanding supported BGP preference rules.
Link bandwidth is not the route policy attribute whose precedence is in dispute.
A retailer routes requests for /api/* to container targets but /images/* to a separate fleet under the same TLS domain. The edge entry is already an Application Load Balancer. Which feature implements the path split?
An ALB evaluates path patterns at layer 7 and forwards matches to their intended target groups.
A TCP listener does not evaluate HTTP URL path patterns.
VPC routing chooses IP destinations, not URL paths.
Gateway Load Balancer forwards network traffic to appliances instead of routing HTTP paths.
A CloudFront origin needs a short-running request hook that reads and modifies an HTTP response body after a miss. A teammate proposes CloudFront Functions because they are cheap, but the hook must inspect origin response bytes. What implementation should the architect choose?
Lambda@Edge is the documented choice for compute requiring origin events and supported body-related processing. CloudFront Functions do not provide arbitrary origin-response-body processing at the required hook.
Viewer request occurs before the origin sends any response. A CloudFront Function there cannot inspect payload bytes that have not been requested or returned yet.
A DNS health check measures supported health signals, not arbitrary per-object body transformations for CloudFront origin responses. It cannot inspect and rewrite document content sent to individual viewers.
VPC peering affects private network connectivity, not HTTP response transformations at a global CDN. It would alter routing topology without making response bytes available to an edge compute hook.
A research genomics team needs to minimize latency in an MPI all-reduce workload on eligible EC2 HPC instances. The cluster uses EFA, but its jobs are deployed across distant Availability Zones with network variability that fails the application’s latency budget. Which placement change should be assessed?
Tightly coupled communication benefits from compatible network placement and EFA capabilities; distributed placement can introduce variable network paths.
An edge HTTP content service cannot optimize low-level MPI node-to-node exchanges.
DNS cache lifetime does not improve inter-node packet latency inside the HPC job.
Internet NAT is not a suitable path for low-latency tightly coupled MPI communication.
A cross-account Transit Gateway VPC attachment was recreated after a deployment. Both AWS accounts report the attachment as Available, but the new attachment is associated with the default route table instead of the restricted production route table. Which operational correction is required?
Route-table association binds an attachment to its active transit forwarding policy; replacement attachments need correct policy mapping.
DNS authority does not fix the attachment’s transit policy association.
Origin caching cannot alter Transit Gateway packet routing.
User-agent strings are unrelated to transit attachment routing scope.
A team believes VPC Flow Logs ACCEPT proves an HTTPS endpoint served a valid response, despite ongoing application errors.
Which technical explanation best accounts for the network behavior described?
VPC Flow Logs summarize observed network flows, and ACCEPT usually indicates network-level permission rather than successful application-layer processing. A direct check is to analyze extended VPC Flow Logs action, interface, address, port, packet and byte fields together with host and application logs and observe the corresponding path.
Application Load Balancer HTTP error metrics and VPC flow metadata describe different layers; matching time windows localizes the likely origin. That is a valid account of cloudwatch network metric versus application log correlation, but it does not explain the flow log reject versus accept interpretation behavior in the scenario.
Oversized packets may be discarded when encapsulation reduces effective MTU and Path MTU Discovery messages are blocked or misinterpreted. That is a valid account of path mtu discovery black-hole diagnosis, but it does not explain the flow log reject versus accept interpretation behavior in the scenario.
Traffic Mirroring sends copied eligible packets for deep network inspection, while flow logs expose aggregate metadata rather than complete packet sequences. That is a valid account of vpc traffic mirroring tls retransmission investigation, but it does not explain the flow log reject versus accept interpretation behavior in the scenario.
A telemetry collector accepts a proprietary TCP stream on port 9000. Its corporate clients allow outbound connections only to fixed IP addresses, and the service needs a multi-AZ AWS load balancer. Which load-balancing family best matches?
NLB supports TCP transport and stable zonal addresses suitable for IP allowlists.
ALB is for HTTP(S) application processing rather than arbitrary raw TCP streams.
Gateway Load Balancer inserts inspection appliances and is not an ordinary TCP application front end.
A private hostname does not provide fixed public TCP entry addresses for external clients.
A development VPC must not route into the production network despite sharing a Transit Gateway. An engineer finds production CIDRs propagated into the development attachment’s associated route table. Which transit-level control most directly restores the boundary?
The attachment’s effective route table should exclude or deny destinations that policy prohibits it from reaching.
That violates the stated trust boundary rather than isolating development.
Log collection is not the forwarding permission allowing the unwanted path.
Internet egress capacity does not enforce a production transit deny policy.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
