You save $69.98
A development VPC must not route into the production network despite sharing a Transit Gateway. An engineer finds production CIDRs propagated into the development attachment’s associated route table. Which transit-level control most directly restores the boundary?
The attachment’s effective route table should exclude or deny destinations that policy prohibits it from reaching.
That violates the stated trust boundary rather than isolating development.
Log collection is not the forwarding permission allowing the unwanted path.
Internet egress capacity does not enforce a production transit deny policy.
Following a DNSSEC key-signing-key rotation, a public Route 53 hosted zone serves signed records but the parent still advertises the previous DS digest. A validating resolver returns SERVFAIL while a nonvalidating tool can read the zone. Which missing integrity dependency best explains the failure?
A parent DS digest must correspond to the current zone signing key; a stale digest breaks the DNSSEC chain of trust for validating resolvers.
This is a risk in alb acm certificate managed tls: ALB TLS listeners can terminate client connections using certificates stored in ACM, separating public certificate lifecycle from backend instance provisioning. It does not account for the route 53 dnssec chain-of-trust protection fault stated in this incident.
Direct Connect is a dedicated network connection but does not universally encrypt payloads; IPsec or TLS adds cryptographic confidentiality when configured. That explains the separate vpn encryption over direct connect issue, not this demonstrated route 53 dnssec chain-of-trust protection failure.
This is a risk in acm private ca internal mutual trust: ACM Private CA issues private certificates under an organization-controlled certificate hierarchy, distinct from public ACM trust issuance. It does not account for the route 53 dnssec chain-of-trust protection fault stated in this incident.
An auditor asks what a production network ACL looked like last Tuesday, not merely its present rules. The organization had AWS Config recording enabled during the period. Which evidence should be retrieved?
Config stores supported resource configuration snapshots and changes useful for point-in-time review. Auditors can inspect the recorded network ACL configuration on the specified day.
Application requests do not reconstruct a historical network ACL configuration.
Current state cannot reliably prove the configuration that existed last Tuesday.
CDN cache invalidation does not show subnet security policy history.
In an application VPC, an associated private hosted zone contains internal.example but omits api.internal.example. A developer publishes the missing API address in a public hosted zone with the same suffix and expects the VPC resolver to use it; internal clients still get no matching record. What mistake about split-horizon precedence is being made?
An associated private hosted zone shadows public DNS for matching names; publishing only the missing public record cannot override the private-zone resolution decision.
A shared Resolver rule enables cross-account reuse of the same domain-specific outbound lookup policy, while attachment and network reachability remain necessary. That explains the separate route 53 resolver forwarding rule sharing issue, not this demonstrated split-horizon dns precedence troubleshooting failure.
This is a risk in cross-account private hosted zone association: Private hosted-zone DNS answers are scoped to associated VPCs; cross-account use requires explicit authorization and association. It does not account for the split-horizon dns precedence troubleshooting fault stated in this incident.
That outcome depends on route 53 resolver outbound rule association, whose mechanism is different: Resolver forwarding rule selection depends on matching domain names and VPC association; endpoints alone do not select where matching DNS queries go. The reported defect concerns split-horizon dns precedence troubleshooting.
A customer-facing Application Load Balancer terminates HTTPS for a domain managed by the company. The platform team needs managed certificate issuance and renewal rather than distributing private key files by hand to every new load balancer. Which AWS service should supply the ALB listener certificate?
ACM integrates with supported load balancers for managed certificate provisioning and renewal.
Health checking does not issue or renew TLS certificates.
A reachable TCP path does not create the required server identity certificate.
NAT gateway addressing cannot terminate TLS for an HTTPS ALB listener.
A network engineer must investigate unexpected TCP retransmissions for an intermittent service on a supported EC2 interface. VPC Flow Logs show bytes and ports but cannot reveal sequence numbers or flags. Which telemetry mechanism should be added temporarily?
Traffic Mirroring supplies packet-level evidence for TCP sequence and retransmission analysis on supported interfaces.
Longer retention preserves summaries but never adds packet sequence numbers.
DNS aliasing does not produce packet captures or TCP flags.
Infrastructure change plans do not reveal live retransmitted TCP segments.
A Route 53 Resolver query-log configuration sends records to a protected CloudWatch Logs group, but no VPC DNS queries appear. The configuration is not associated with any VPC. Which operational change makes the existing logging pipeline cover approved applications?
Resolver query logging does not collect a VPC's names merely because a log group and configuration exist; association is required.
Retention changes how long delivered records are stored, not whether queries are collected.
Flow metadata does not carry the same DNS query information as Resolver query logs.
Publishing internal names publicly does not activate the intended Resolver query-log collection.
An enterprise has several VPCs in a Region attached to Transit Gateway. It wants a dedicated Direct Connect connection to reach those spoke VPCs through the transit hub without managing a separate private VIF for each VPC. Which arrangement is most appropriate?
A transit VIF and Direct Connect gateway support reaching attached networks via a regional Transit Gateway.
S3 endpoints do not provide data-center-to-spoke VPC routing.
Public VIF reachability is not a private route for internal spoke CIDRs.
DNS health checks do not establish packet-level hybrid network connectivity.
Two VPCs in one organization use shared Route 53 Resolver outbound rules. The central DNS team has configured an outbound endpoint that can reach the on-premises resolver, but a new VPC still sends legacy.example queries to public resolution. What must be attached to the new VPC?
A VPC must use an associated forwarding rule for matching queries to be sent through the configured Resolver outbound path.
HTTP request forwarding is unrelated to DNS rule associations.
An ALB does not act as a DNS forwarding rule for VPC Resolver queries.
Public latency routing does not redirect VPC DNS queries to the on-premises resolver.
A company registered a public domain with another registrar and needs Route 53 to answer its authoritative internet DNS records.
Which observation would most directly demonstrate the required network outcome?
Independent external DNS lookups return the intended records and parent-zone NS delegation matches the assigned Route 53 name servers. That is relevant because a public hosted zone becomes authoritative to external recursive resolvers only when the domain's parent delegation points to its name servers.
This would validate route 53 weighted failover and health checks. The case instead needs evidence for route 53 public hosted zone delegation: Independent external DNS lookups return the intended records and parent-zone NS delegation matches the assigned Route 53 name servers.
This would validate route 53 resolver outbound endpoint and rules. The case instead needs evidence for route 53 public hosted zone delegation: Independent external DNS lookups return the intended records and parent-zone NS delegation matches the assigned Route 53 name servers.
This would validate route 53 resolver inbound endpoint for hybrid dns. The case instead needs evidence for route 53 public hosted zone delegation: Independent external DNS lookups return the intended records and parent-zone NS delegation matches the assigned Route 53 name servers.
A datacenter team wants to summarize routing advertisements without accidentally including a third-party address block.
Which observation would most directly demonstrate the required network outcome?
Observed advertised prefix counts drop without dropping legitimate endpoint reachability or accepting unauthorized destination blocks. That is relevant because route aggregation reduces route-table entry counts, but an overly broad summary may route destinations not actually owned by the advertising site.
This would validate transit gateway route propagation drift. The case instead needs evidence for hybrid route summarization and overlap response: Observed advertised prefix counts drop without dropping legitimate endpoint reachability or accepting unauthorized destination blocks.
This would validate vpc endpoint private versus public service reachability. The case instead needs evidence for hybrid route summarization and overlap response: Observed advertised prefix counts drop without dropping legitimate endpoint reachability or accepting unauthorized destination blocks.
This would validate direct connect bgp session health maintenance. The case instead needs evidence for hybrid route summarization and overlap response: Observed advertised prefix counts drop without dropping legitimate endpoint reachability or accepting unauthorized destination blocks.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
