You save $69.98
A business wants to peer two VPCs owned by different accounts, but their primary IPv4 CIDRs overlap. Even though security groups could permit the application port, the console refuses the intended peering topology. What prerequisite should be addressed?
Overlapping address ranges prevent an ordinary peering connection from providing unambiguous routing. Both peers would claim the same destination address space.
Permissions cannot remove the addressing overlap restriction.
Stateless filters do not affect CIDR compatibility.
DNSSEC does not make identical source and destination prefixes routable.
A security review must record exactly which IAM role called ModifyTransitGatewayRouteTable during a production change, and also which network flows later used the resulting path. Which pairing best covers both evidence categories?
Configuration change identities and routed traffic observations are different evidence layers and should be correlated by time.
Flow logs describe network traffic and do not reliably attribute AWS control-plane API identities.
CloudTrail is not a packet capture service.
DNS queries neither expose route-table modifying principals nor reconstruct transit flows.
A finance VPC experiences sporadic failed TCP connection attempts. Investigators need source and destination IPs, ports, protocol, and whether network interfaces accepted or rejected traffic; full payloads are expressly not needed. Which telemetry is most suitable?
Flow Logs emit connection metadata including addressing and flow action without recording packet payload.
Packet mirroring could expose payloads and is unnecessary for the requested flow summaries.
CloudTrail records API operations, not each attempted TCP flow.
Authoritative DNS queries do not show per-interface IP traffic accept/reject outcomes.
A healthcare network uses dedicated Direct Connect circuits but requires cryptographic protection for all sensitive traffic in transit.
Which observation would most directly demonstrate the required network outcome?
A capture or approved cryptographic validation confirms protected traffic traverses the dedicated path and keys are managed under policy. That is relevant because direct Connect provides a dedicated transport path but does not inherently encrypt all payloads, so confidentiality must be provided separately when policy requires it.
This would validate bgp route policy for hybrid path preference. The case instead needs evidence for ipsec encryption over direct connect: A capture or approved cryptographic validation confirms protected traffic traverses the dedicated path and keys are managed under policy.
This would validate transit vif for multiple transit gateways. The case instead needs evidence for ipsec encryption over direct connect: A capture or approved cryptographic validation confirms protected traffic traverses the dedicated path and keys are managed under policy.
This would validate direct connect private connectivity and redundancy. The case instead needs evidence for ipsec encryption over direct connect: A capture or approved cryptographic validation confirms protected traffic traverses the dedicated path and keys are managed under policy.
A VPC Flow Logs query shows log-status SKIPDATA during a five-minute incident. A network engineer wants to claim there were no denied flows during that period because the queried log contains no REJECT records. What is the justified conclusion?
SKIPDATA indicates one or more flow records were not captured, so missing REJECT entries cannot prove the absence of denied traffic.
Records can be skipped; silence is not an all-accepted verdict.
NODATA, not SKIPDATA, is the status associated with no observed traffic.
The status describes log collection and does not establish EC2 instance state.
Two private zones with overlapping suffixes create surprising resolution behavior for workloads attached to different VPCs.
Which observation would most directly demonstrate the required network outcome?
Queries from each approved VPC return documented private or public answers consistently and no unintended shadow zone remains. That is relevant because vPC Resolver selects eligible private namespaces and forwarding rules based on match and association; public records need not be consulted when a matching private zone exists.
This would validate dnssec public-zone validation and signing. The case instead needs evidence for split-horizon dns precedence troubleshooting: Queries from each approved VPC return documented private or public answers consistently and no unintended shadow zone remains.
This would validate route 53 resolver forwarding rule sharing. The case instead needs evidence for split-horizon dns precedence troubleshooting: Queries from each approved VPC return documented private or public answers consistently and no unintended shadow zone remains.
This would validate route 53 resolver outbound rule association. The case instead needs evidence for split-horizon dns precedence troubleshooting: Queries from each approved VPC return documented private or public answers consistently and no unintended shadow zone remains.
A public image API accepts requests with ?format=avif or ?format=jpeg and returns different encoded bytes for each. CloudFront is configured to ignore all query strings in its cache key, so AVIF clients sometimes receive JPEG. What must change?
Format changes the representation of the same path, so it must distinguish cached objects. Including that parameter in the key also forwards it when the origin needs to encode the variant.
Longer TTL makes incorrect cross-format reuse persist for longer; the cache key still merges byte-incompatible AVIF and JPEG representations under the same public path.
Removing format would make the origin encoder unable to know which representation the viewer requested. It would not preserve the intended dual-format image API contract.
Global Accelerator addresses transport entry to eligible regional endpoints and cannot change how CloudFront distinguishes query-dependent AVIF and JPEG representations in an edge cache.
A team must publish the zone apex sales.example.com directly to an Application Load Balancer without putting a conventional CNAME at the apex. The ALB DNS name may change underlying IP addresses. Which Route 53 record fits?
Route 53 alias records can refer to supported AWS targets at the apex without violating CNAME and SOA/NS coexistence rules.
A conventional apex CNAME conflicts with the zone’s required records.
Load balancer node addresses can change; pinning one IP undermines resiliency.
Browsers do not use TXT records as web origin address mappings.
A production application normally reaches a private datacenter over Direct Connect. The organization expects a Site-to-Site VPN backup, but the VPN uses BGP only for a different, less-specific destination prefix. After Direct Connect withdrawal, the service prefix is not reachable through the backup. Which failover risk is demonstrated?
Route coverage and supported route preference must be tested for the exact application destination; VPN tunnel-up does not guarantee a matching failover path.
An unrelated VPN backup state does not enable encryption on a dedicated physical circuit.
VPN failover routing does not imply public address translation of the workload.
No DNS delegation change is stated; the failure is missing route coverage for the private prefix.
A highly distributed read-only scientific archive uses CloudFront with a single S3 origin. Many edge caches miss on the same multi-gigabyte public dataset at once. The team wants an additional centralized caching layer before the origin. Which feature addresses repeated regional origin fetches?
Origin Shield adds a centralized extra caching layer for CloudFront origin fetches, reducing duplicate misses that otherwise travel back to the data origin across distributed edge locations.
ALB target-group stickiness influences selection of back-end web targets. It does not insert an extra CloudFront cache layer in front of an S3 origin.
A NAT gateway is an outbound IPv4 translation device for private subnets, not a global read cache. It would add network cost and fail the archive objective.
Resolver inbound endpoints allow hybrid DNS queries from external networks. They do not consolidate CloudFront cache misses or increase cache reuse for large public archive objects.
A resolver team enabled query logging for the accounts that use an internal domain. An incident reviewer finds far fewer log entries than application DNS calls during the hour, and TTLs were long. What must the logging specification clarify?
Cached responses can satisfy multiple application requests without new upstream Resolver log events.
Resolver caching can suppress repeated query processing and logging.
The application calls may have been answered from previously cached DNS data.
Query logging concerns DNS data rather than the later HTTP payload.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
