You save $69.98
A web subnet's NACL permits inbound TCP/443 but denies outbound replies to the clients' ephemeral destination ports. The instance security group permits HTTPS with stateful return traffic. Why can the TLS connection still fail?
NACLs are stateless subnet filters; both directions require matching permit rules irrespective of security-group state tracking.
Security groups and NACLs are independent network controls.
NACLs filter protocol/port combinations; they do not rewrite the TCP destination port.
A correctly configured NACL can allow TLS traffic in both directions.
The branch maintenance plan must show that a single IPsec tunnel failure does not interrupt the essential private application.
Which AWS networking configuration best addresses this specific requirement?
Site-to-Site VPN supplies redundant tunnels, but failover depends on compatible dynamic routing and healthy peer sessions for both tunnel paths. The proposed change can be checked by whether during a controlled primary-tunnel shutdown, approved traffic recovers over the alternate tunnel and BGP routing converges.
This configuration addresses direct connect physical provisioning and bgp bring-up, not the redundant vpn tunnels with bgp failover requirement. Direct Connect connectivity depends on the physical handoff and correct virtual-interface BGP parameters; a physical optical link alone does not establish routed VPC access.
This configuration addresses site-to-site vpn bgp route propagation, not the redundant vpn tunnels with bgp failover requirement. The tunnel protects packets, but dynamic routing and attachment route-table associations determine which prefixes the network actually forwards.
This configuration addresses hybrid path mtu and fragmentation, not the redundant vpn tunnels with bgp failover requirement. Different media and IPsec encapsulation consume packet overhead; Path MTU Discovery or adjusted TCP MSS prevents oversized packets from being silently lost.
A company is shifting hybrid traffic from VPN to Direct Connect. Both paths are operational and advertise the same on-premises prefixes. The routing team needs to know which path AWS will favor before cutting over a production database. What should be reviewed?
Hybrid path selection depends on the gateway route rules and actual advertised prefixes, not on link speed alone.
A faster link does not override the gateway routing decision by itself.
ALB health checks do not describe which hybrid underlay route is selected.
Domain registration is not the deciding control for private gateway route selection.
A network architect needs to avoid unintentionally preferring a high-latency backup path for regular AWS-to-datacenter traffic.
Which observation would most directly demonstrate the required network outcome?
Route inspection and failover tests show expected preferred next hops and automatic recovery without unexpected asymmetric paths. That is relevant because bGP route attributes and permitted prefixes influence dynamic route selection, while AWS service-specific routing priorities and Direct Connect behavior impose constraints.
This would validate direct connect private connectivity and redundancy. The case instead needs evidence for bgp route policy for hybrid path preference: Route inspection and failover tests show expected preferred next hops and automatic recovery without unexpected asymmetric paths.
This would validate hybrid cidr overlap prevention. The case instead needs evidence for bgp route policy for hybrid path preference: Route inspection and failover tests show expected preferred next hops and automatic recovery without unexpected asymmetric paths.
This would validate ipsec encryption over direct connect. The case instead needs evidence for bgp route policy for hybrid path preference: Route inspection and failover tests show expected preferred next hops and automatic recovery without unexpected asymmetric paths.
A website hosted behind an Application Load Balancer needs a Route 53 record at the root of its DNS zone.
Which AWS networking configuration best addresses this specific requirement?
Route 53 alias records can target AWS resources while meeting zone-apex DNS constraints and tracking appropriate service target naming. The proposed change can be checked by whether public resolvers obtain usable address responses for the apex name and client requests arrive at the intended load balancer.
This configuration addresses route 53 weighted failover and health checks, not the route 53 alias record for load balancer requirement. Route 53 routing policies choose eligible DNS record answers according to their weights or failover order, while health checks exclude records marked unhealthy.
This configuration addresses route 53 resolver inbound endpoint for hybrid dns, not the route 53 alias record for load balancer requirement. Inbound Resolver endpoints receive DNS requests from reachable external DNS servers and resolve eligible AWS private namespace records in the associated VPC.
This configuration addresses route 53 resolver outbound endpoint and rules, not the route 53 alias record for load balancer requirement. Outbound Resolver rules forward matching VPC DNS queries through configured endpoints to designated corporate name servers.
A platform spans 80 VPCs with independent manual IP allocations. Teams repeatedly request overlapping CIDR blocks that prevent later peering and transit attachments. They need governed pools and allocation tracking before each VPC is created. Which service addresses the allocation problem?
IPAM manages IP address allocations and helps plan nonoverlapping VPC CIDRs at organization scale.
DNS distribution does not eliminate overlapping IP address spaces.
Packet inspection appliances do not allocate nonoverlapping VPC address blocks.
BGP timers cannot correct conflicting address plans between VPCs.
A campus DNS server forwards aws.private queries into Route 53 Resolver inbound endpoint IPs over VPN. Network ACLs on the endpoint subnet were tightened; UDP queries now time out, while the endpoint remains available. Which packet-permission check is most directly relevant?
Inbound DNS queries need permitted port 53 traffic and a viable network path through endpoint security controls.
An S3 endpoint cannot carry DNS queries to an inbound Resolver endpoint.
DNS TTL cannot permit UDP packets blocked at the private endpoint subnet.
An NLB health check does not replace endpoint DNS security rules.
A security incident requires identifying exactly which AWS principal modified a Transit Gateway route in the central network account, not just which source IP later used the route. Which record category should the centralized logging plan retain?
Control-plane API audit records include actor and request context, unlike packet-flow summaries. The route-change principal cannot be recovered from byte counters.
Flow records identify traffic patterns but not the IAM actor making the route API call.
Load balancer access logs do not document Transit Gateway route-table modifications.
Edge caching metrics are unrelated to AWS network configuration attribution.
A central incident response team must identify which identity changed a production security group at a particular time.
Which technical explanation best accounts for the network behavior described?
CloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads. A direct check is to enable organization-wide CloudTrail management event recording and aggregate relevant network API calls under a protected retention policy and observe the corresponding path.
Traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata. That is a valid account of vpc traffic mirroring security packet evidence, but it does not explain the cloudtrail network api audit behavior in the scenario.
Resolver query logs provide DNS request observations for associated VPC resolution paths, distinct from network-flow and API change logs. That is a valid account of route 53 resolver query logging security visibility, but it does not explain the cloudtrail network api audit behavior in the scenario.
Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches. That is a valid account of network firewall flow and alert log delivery, but it does not explain the cloudtrail network api audit behavior in the scenario.
A compliance team needs a unified view of network-resource configuration compliance across organizational accounts. Individual AWS Config rules are deployed in each account, but auditors cannot easily see enterprise-wide drift. Which aggregation design should be used?
Aggregation centralizes eligible configuration/compliance observations while underlying recorders and rules still produce the evidence.
HTTP traffic records do not aggregate network configuration compliance evaluations.
The aggregator cannot invent source data from stopped recorders.
A DNS record is not a cross-account configuration compliance repository.
A business wants to peer two VPCs owned by different accounts, but their primary IPv4 CIDRs overlap. Even though security groups could permit the application port, the console refuses the intended peering topology. What prerequisite should be addressed?
Overlapping address ranges prevent an ordinary peering connection from providing unambiguous routing. Both peers would claim the same destination address space.
Permissions cannot remove the addressing overlap restriction.
Stateless filters do not affect CIDR compatibility.
DNSSEC does not make identical source and destination prefixes routable.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
