You save $69.98
A hybrid application requires two VPN tunnels and recoverable dynamic routing without exposing backend databases publicly.
Which AWS networking configuration best addresses this specific requirement?
Site-to-Site VPN encrypts IP traffic over the internet using IPsec, with redundant tunnels and optional dynamic BGP route exchange. The proposed change can be checked by whether a controlled tunnel-down exercise keeps approved private traffic reachable over the surviving tunnel and shows expected BGP routes.
This configuration addresses transit vif for multiple transit gateways, not the site-to-site vpn encrypted hybrid baseline requirement. Transit VIFs connect a Direct Connect gateway to associated Transit Gateways, distinct from private VIF designs that access virtual private gateways.
This configuration addresses hybrid cidr overlap prevention, not the site-to-site vpn encrypted hybrid baseline requirement. Routing uses destination prefixes to choose paths; overlapping address spaces make private packets ambiguous without deliberate isolation or translation.
This configuration addresses ipsec encryption over direct connect, not the site-to-site vpn encrypted hybrid baseline requirement. Direct Connect provides a dedicated transport path but does not inherently encrypt all payloads, so confidentiality must be provided separately when policy requires it.
A computational chemistry cluster runs tightly coupled MPI jobs on supported EC2 instance types. TCP networking introduces latency and communication overhead. The workload requires low-latency, high-throughput OS-bypass network communication within a suitable placement configuration. Which EC2 networking feature should be evaluated?
EFA provides networking capabilities suited to tightly coupled HPC workloads, beyond ordinary ENA-based TCP networking.
CloudFront is a web CDN and cannot accelerate internal MPI transport between compute nodes.
DNS weight selection does not improve tightly coupled fabric communications.
HTTP stickiness does not supply the required low-latency HPC network fabric.
An AWS Organizations security team creates an AWS Firewall Manager web ACL policy scoped to a specific organizational unit. A newly created production account sits in a different OU and receives no policy protection. What should the security administrator review?
Central policy enrollment depends on configured account/OU and resource selection rather than automatic coverage of every possible account.
Domain caching cannot enroll an account in Firewall Manager policy scope.
Organization-wide resources are still controlled by policy scoping.
Removing existing protections does not achieve intended coverage in the new account.
Security investigators need retained records showing which VPC ENIs exchanged traffic with a suspicious IP, including protocol, source/destination and network accept/reject decisions. Packet payloads are not required. Which evidence pipeline is appropriate?
Flow Logs publish supported VPC traffic metadata and action classifications without requiring broad packet-capture deployment.
CloudTrail management records do not substitute for observed network flow metadata.
Traffic Mirroring covers configured sources, not arbitrary unselected ENIs.
Public DNS queries are not network-layer accept/reject evidence for VPC flows.
A production security group is accidentally opened to all IPv4 sources on port 22. The organization already records EC2 management API calls and wants a controlled, auditable automated evaluation before a tightly scoped remediation action. Which event-driven integration fits?
EventBridge can notify approved remediation automation of configuration API events while retaining identity and change audit context.
CDN HTTP logs are not a reliable source for network control-plane API events.
Opening more ports increases exposure and does not validate the change.
DNS renaming does not inspect or correct an overly permissive security group.
Hundreds of narrowly advertised branch prefixes approach the route limits supported by a hybrid gateway.
Which technical explanation best accounts for the network behavior described?
Route aggregation reduces route-table entry counts, but an overly broad summary may route destinations not actually owned by the advertising site. A direct check is to inventory exact allocated prefixes and apply safe BGP aggregation or segmentation within AWS-supported route and quota constraints and observe the corresponding path.
Gateway routing policy uses the route table associated with an originating attachment and propagates routes only to eligible route tables. That is a valid account of transit gateway route propagation drift, but it does not explain the hybrid route summarization and overlap response behavior in the scenario.
Direct Connect private routing depends on stable BGP advertisements and allowed prefix policy in addition to the physical cross-connect. That is a valid account of direct connect bgp session health maintenance, but it does not explain the hybrid route summarization and overlap response behavior in the scenario.
Gateway endpoints provide VPC route targets for supported services such as S3, while interface endpoints expose private service addresses through endpoint ENIs. That is a valid account of vpc endpoint private versus public service reachability, but it does not explain the hybrid route summarization and overlap response behavior in the scenario.
A hybrid app in a branch fails to resolve AWS-only private records while EC2 clients inside the VPC resolve them.
Which observation would most directly demonstrate the required network outcome?
A datacenter client resolves a known private hosted-zone record and query logs show the intended inbound resolver path. That is relevant because an inbound resolver accepts queries from outside the VPC and resolves the associated private namespace without publishing the records to the public internet.
This would validate route 53 resolver outbound rule association. The case instead needs evidence for route 53 resolver inbound endpoint deployment: A datacenter client resolves a known private hosted-zone record and query logs show the intended inbound resolver path.
This would validate cross-account private hosted zone association. The case instead needs evidence for route 53 resolver inbound endpoint deployment: A datacenter client resolves a known private hosted-zone record and query logs show the intended inbound resolver path.
This would validate route 53 resolver forwarding rule sharing. The case instead needs evidence for route 53 resolver inbound endpoint deployment: A datacenter client resolves a known private hosted-zone record and query logs show the intended inbound resolver path.
A payment VPC and a development VPC are both attached to a regional Transit Gateway. Policy requires a shared logging VPC to be reachable by both, while payments must never route directly to development. Which central design supports that separation?
Transit Gateway attachment table associations and propagations can enforce segmented routing through a shared hub.
Unrestricted common propagation would expose the payment and development networks to one another.
VPC peering is not transitive, so it cannot supply the intended central separation.
Public DNS records do not enforce subnet or VPC packet isolation.
An HTTP service behind an ALB shows rising HTTPCode_Target_5XX_Count while HTTPCode_ELB_5XX_Count stays low. The team wants an initial dashboard interpretation before changing transit routes. What is the strongest lead?
Target-generated 5XX responses point toward the backend side rather than proving that the load balancer itself generated errors.
The observed metric separates target 5XX from errors generated by the load balancer.
Successful HTTP target responses do not directly indicate a DNS validation issue.
Destructive replacement is not justified by a backend-oriented metric alone.
A startup needs encrypted private subnet access between its datacenter and an AWS VPC before dedicated circuits are deployed.
Which observation would most directly demonstrate the required network outcome?
A controlled tunnel-down exercise keeps approved private traffic reachable over the surviving tunnel and shows expected BGP routes. That is relevant because site-to-Site VPN encrypts IP traffic over the internet using IPsec, with redundant tunnels and optional dynamic BGP route exchange.
This would validate ipsec encryption over direct connect. The case instead needs evidence for site-to-site vpn encrypted hybrid baseline: A controlled tunnel-down exercise keeps approved private traffic reachable over the surviving tunnel and shows expected BGP routes.
This would validate transit vif for multiple transit gateways. The case instead needs evidence for site-to-site vpn encrypted hybrid baseline: A controlled tunnel-down exercise keeps approved private traffic reachable over the surviving tunnel and shows expected BGP routes.
This would validate hybrid cidr overlap prevention. The case instead needs evidence for site-to-site vpn encrypted hybrid baseline: A controlled tunnel-down exercise keeps approved private traffic reachable over the surviving tunnel and shows expected BGP routes.
A company uses AWS Direct Connect for private datacenter reachability, but policy explicitly requires IPsec at the IP network layer between the customer gateway and AWS. A dedicated fiber circuit without crypto does not qualify, and application TLS alone is insufficient under policy. Which architecture adds the required network-layer protection?
Direct Connect transport is not universally encrypted. The supported IPsec VPN overlay supplies network-layer encryption and must be paired with compatible reachability and routing for the protected datacenter prefixes.
A private dedicated physical path does not by itself supply the required IPsec encryption.
MACsec can protect an eligible link, but it is not the required network-layer IPsec tunnel between the specified gateways.
Application TLS does not satisfy a policy requiring an IP-layer IPsec overlay for the entire designated network flow.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
