You save $69.98
A resolver team enabled query logging for the accounts that use an internal domain. An incident reviewer finds far fewer log entries than application DNS calls during the hour, and TTLs were long. What must the logging specification clarify?
Cached responses can satisfy multiple application requests without new upstream Resolver log events.
Resolver caching can suppress repeated query processing and logging.
The application calls may have been answered from previously cached DNS data.
Query logging concerns DNS data rather than the later HTTP payload.
A subnet’s network ACL permits inbound TCP 443 to a private web server. Its outbound rules deny the client’s ephemeral destination port range. The server security group is stateful and correctly allows the session. Why does the TCP handshake still fail?
Network ACLs inspect each traffic direction independently, so the server’s SYN-ACK requires an allowed outbound return path.
Stateful security-group tracking does not bypass stateless subnet ACL filtering.
The return packet destination is the client’s ephemeral port, not necessarily destination port 443.
Listener routing cannot transmit packets rejected at the subnet network filter.
A low-latency trading application intermittently resets TCP connections. Its network dashboard has aggregate byte counters but no packet-level capture, so investigators cannot see retransmission sequence numbers or out-of-order segments even though traffic was allowed. What diagnostic limitation follows?
Flow counters cannot show which TCP segments retransmitted or arrived out of order, so investigators lack the packet evidence needed to isolate the intermittent resets.
VPC Flow Logs summarize observed network flows, and ACCEPT usually indicates network-level permission rather than successful application-layer processing. That explains the separate flow log reject versus accept interpretation issue, not this demonstrated vpc traffic mirroring tls retransmission investigation failure.
This is a risk in path mtu discovery black-hole diagnosis: Oversized packets may be discarded when encapsulation reduces effective MTU and Path MTU Discovery messages are blocked or misinterpreted. It does not account for the vpc traffic mirroring tls retransmission investigation fault stated in this incident.
That outcome depends on reachability analyzer blocked security group diagnosis, whose mechanism is different: Reachability Analyzer performs static analysis of supported AWS network configuration and does not send real traffic or inspect application processes. The reported defect concerns vpc traffic mirroring tls retransmission investigation.
A two-tunnel VPN was created with static routing rather than dynamic BGP. The branch adds a new routed IPv4 subnet but only the original prefix is configured on the AWS VPN connection and gateway route tables. Which administrative update is necessary?
Static VPN designs do not automatically learn a newly added branch network from an advertisement that is never exchanged.
This VPN explicitly uses static routing and therefore lacks dynamic BGP route learning.
CloudFront object caching does not insert VPN static route entries.
Load-balancer protocol choice has no bearing on the configured branch static prefix.
A Transit Gateway dashboard shows elevated packets-lost-mtu-exceeded during a large-data replication job, but packets-lost-no-route remains at baseline. The application failures happen only for larger payloads. What fault domain should receive priority?
The gateway telemetry distinguishes size-related discard from missing-route loss, matching the large-payload symptom.
The no-route counter did not rise; a global routing replacement is not indicated.
A blanket BGP shutdown does not address gateway MTU-exceeded evidence.
DNSSEC signing does not cause a size-specific transit drop counter.
An engineer mistakenly tries to attach a private VIF directly to a Transit Gateway for multi-VPC datacenter routing.
Which technical explanation best accounts for the network behavior described?
A transit VIF uses the Direct Connect gateway to reach a Transit Gateway; a private VIF is associated with virtual private gateway connectivity instead. A direct check is to create a transit VIF associated with a Direct Connect gateway, associate the eligible Transit Gateway, and verify CIDR and ASN constraints and observe the corresponding path.
The tunnel protects packets, but dynamic routing and attachment route-table associations determine which prefixes the network actually forwards. That is a valid account of site-to-site vpn bgp route propagation, but it does not explain the transit virtual interface to transit gateway behavior in the scenario.
Route preference depends on AWS routing-priority rules and available advertised routes; backup transport must already carry compatible reachability. That is a valid account of direct connect failover to vpn route selection, but it does not explain the transit virtual interface to transit gateway behavior in the scenario.
BGP peers must agree on neighbor addressing and expected autonomous systems before they can exchange dynamic routes over the encrypted tunnel. That is a valid account of customer gateway bgp asn coordination, but it does not explain the transit virtual interface to transit gateway behavior in the scenario.
A DNSSEC-enabled public Route 53 hosted zone was re-signed during a key rotation. The registrar still publishes a DS record for the previous key, and some validating resolvers return SERVFAIL. Which corrective action is appropriate?
The parent DS must match the live DNSSEC keys for validating resolvers to establish trust.
Record alias changes do not repair a mismatched DS record and apex CNAMEs have their own constraints.
Load-balancer protocol has no effect on DNSSEC trust-chain validation.
Private forwarding does not correct public resolver validation of a stale DS digest.
A customer VPC has an interface endpoint for an internal API. DNS returns the endpoint’s private address correctly, but HTTPS SYN packets are rejected by the endpoint ENI security group. What should the network owner change?
Interface endpoints use ENI security group controls; correct DNS cannot override blocked endpoint ingress.
Another record would not permit the private endpoint’s denied packets.
The connection fails at the endpoint network filter before host authentication.
S3 permissions do not control this partner API endpoint’s security group.
A hybrid WAN uses a private Direct Connect VIF that remains physically Up. Every ten minutes the customer BGP neighbor resets and the AWS-side BGP session count drops, coinciding with user outages. What should operations inspect before modifying application rules?
A physical carrier can stay active while the BGP control plane repeatedly loses adjacency and advertised routes.
TLS certificate renewal cannot stabilize an unrelated BGP session.
An application pool does not repair missing hybrid routes during BGP resets.
Reducing redundancy does not diagnose control-plane instability.
A production team suspects a malformed TLS ClientHello generated by a custom client and must inspect actual packets from a supported EC2 network interface for a narrow maintenance window. Existing flow summaries lack the bytes needed to decode the handshake. What should be configured?
Traffic Mirroring can send copies of supported instance traffic for packet-level protocol analysis.
Flow Logs summarize flows and do not include the packet bytes needed to decode TLS handshake structure.
Control-plane behavior anomalies do not reveal malformed client handshake packets.
A DNS policy cannot capture packets emitted by a specific EC2 interface.
A public Route 53 hosted zone has enabled DNSSEC signing and publishes signatures and its key-signing key, but the parent registry does not yet contain a DS record for that domain. An administrator says this guarantees externally validated authenticity simply because signed records are visible. What security-assurance gap remains?
DNSSEC assurance depends on delegation trust information as well as signed resource records.
More child signatures alone do not create the missing parent trust link.
A DNS Firewall policy does not create the public parent-child DS chain.
TTL changes do not cryptographically authenticate the signed child zone to a validating resolver.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
