You save $69.98
A partner integration requires certificate-based client identity. An Application Load Balancer is set to mTLS passthrough mode, and the backend application has no code to verify the forwarded client certificate chain. What security gap remains?
In passthrough mode the ALB forwards certificate information without independently validating it, so the target must enforce trust.
Passthrough forwards client certificate details; verification is a distinct configuration or backend responsibility.
Domain resolution does not verify a client X.509 identity.
Removing TLS eliminates the required authenticated encrypted connection.
A hybrid app in a branch fails to resolve AWS-only private records while EC2 clients inside the VPC resolve them.
Which technical explanation best accounts for the network behavior described?
An inbound resolver accepts queries from outside the VPC and resolves the associated private namespace without publishing the records to the public internet. A direct check is to create Route 53 Resolver inbound endpoints with security-group UDP/TCP 53 rules and on-premises conditional forwarding to their IPs and observe the corresponding path.
Private hosted-zone DNS answers are scoped to associated VPCs; cross-account use requires explicit authorization and association. That is a valid account of cross-account private hosted zone association, but it does not explain the route 53 resolver inbound endpoint deployment behavior in the scenario.
A shared Resolver rule enables cross-account reuse of the same domain-specific outbound lookup policy, while attachment and network reachability remain necessary. That is a valid account of route 53 resolver forwarding rule sharing, but it does not explain the route 53 resolver inbound endpoint deployment behavior in the scenario.
VPC Resolver selects eligible private namespaces and forwarding rules based on match and association; public records need not be consulted when a matching private zone exists. That is a valid account of split-horizon dns precedence troubleshooting, but it does not explain the route 53 resolver inbound endpoint deployment behavior in the scenario.
Firewall Manager policy reporting shows a protected ALB was compliant last week. A developer detached its required AWS WAF web ACL yesterday, but the account inventory still lists the ALB. What is the primary governance risk of relying only on that inventory?
Resource existence and policy enforcement are separate; current association and compliance findings must be inspected.
WAF attachment state does not imply loss of all load-balancer metrics.
Inventory is observational; it does not by itself enforce a security policy.
Web ACL association and DNSSEC signing are unrelated controls.
A forensic analyst relies on VPC Flow Logs to reconstruct a suspicious HTTPS transaction and promises to recover the encrypted request body from ACCEPT/REJECT records. No application or packet-level capture was preserved. What evidence limitation makes that reconstruction impossible?
ACCEPT or REJECT Flow Log metadata cannot reconstruct an encrypted HTTPS body; the required packet or application evidence was never recorded.
Traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata. That explains the separate vpc traffic mirroring security packet evidence issue, not this demonstrated vpc flow logs for security investigations failure.
This is a risk in cloudtrail network api audit: CloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads. It does not account for the vpc flow logs for security investigations fault stated in this incident.
Firewall Manager can evaluate whether eligible resources meet organization-wide firewall policy assignments and report noncompliant cases. That explains the separate firewall manager organization compliance audit issue, not this demonstrated vpc flow logs for security investigations failure.
A newly provisioned Direct Connect port has working optics and a private virtual interface, but the project attempts to use that private VIF to associate a Transit Gateway through a Direct Connect gateway. The expected multi-VPC prefixes never appear in the TGW path. What is the architectural consequence of selecting the wrong VIF type?
A private Direct Connect VIF does not perform the transit-VIF-to-Direct-Connect-gateway association used for multiple VPCs behind a Transit Gateway.
That outcome depends on redundant vpn tunnels with bgp failover, whose mechanism is different: Site-to-Site VPN supplies redundant tunnels, but failover depends on compatible dynamic routing and healthy peer sessions for both tunnel paths. The reported defect concerns transit virtual interface to transit gateway.
BGP peers must agree on neighbor addressing and expected autonomous systems before they can exchange dynamic routes over the encrypted tunnel. That explains the separate customer gateway bgp asn coordination issue, not this demonstrated transit virtual interface to transit gateway failure.
This is a risk in direct connect physical provisioning and bgp bring-up: Direct Connect connectivity depends on the physical handoff and correct virtual-interface BGP parameters; a physical optical link alone does not establish routed VPC access. It does not account for the transit virtual interface to transit gateway fault stated in this incident.
A marketing site forwards the X-Campaign-Trace request header to its origin analytics service, but the header never changes the returned page. Each request carries a different value and cache hit ratio has collapsed since it was included in CloudFront’s cache key. What should change?
The origin still receives the trace header on misses while identical pages share cached content.
Adding the request value to the key creates even more unique cache entries for otherwise identical responses.
That would lose the campaign information required by the origin.
A unique path would also defeat shared caching.
Network engineers manually altered production security groups after a CloudFormation stack deployment. A nightly governance job must detect that the live resource configuration no longer matches the stack template without immediately rewriting it. What CloudFormation capability helps?
Drift detection compares supported deployed properties with the recorded desired stack definition. It identifies manual changes without necessarily correcting the resource.
Backend readiness is not a general desired-versus-actual resource configuration comparison.
Editing output text does not reconcile altered security-group rules.
Removing monitoring cannot improve detection of infrastructure changes.
Developers in a VPC use the default Amazon-provided resolver. They must resolve names under plant.internal whose authoritative DNS servers remain in a factory data center connected over VPN. Which Route 53 Resolver configuration should the architect select?
The outbound endpoint sends matching VPC resolver queries toward specified on-premises DNS targets.
Inbound endpoints are for DNS queries entering AWS from external networks, not VPC-to-factory forwarding.
Public DNS hosting does not forward private factory records to their current authoritative server.
An HTTP edge policy cannot implement DNS conditional forwarding.
A hub account owns a Transit Gateway attachment for a shared service VPC. The network team wants a new workload account to send packets toward that VPC but not automatically receive routes to every other spoke. Which setting should be inspected?
Attachment associations and propagations control which Transit Gateway destinations a spoke can use.
DNS TTL does not determine Transit Gateway spoke route visibility.
Content delivery edge selection is independent of regional transit route separation.
S3 access controls cannot restrict Transit Gateway attachment routing policy.
A content network has primary and backup custom origins in a CloudFront origin group. Static GET downloads fail over during primary HTTP 503 errors, but customer payment POST requests return 503 instead of trying the backup. Which behavior best explains the difference?
The download uses an eligible method; CloudFront intentionally avoids replaying non-idempotent POST requests to the secondary origin.
Origin failover does not require both origins to share an IP.
Even a configured 503 failover status does not make POST eligible.
Changing external DNS does not extend CloudFront origin-group method support.
A workload runs in two Availability Zones but both private application subnets send all outbound internet traffic through a NAT gateway created in only one AZ. The network team wants to reduce cross-AZ dependencies and avoid losing egress solely when that AZ fails. What design should it evaluate?
Zonal NAT deployments aligned with subnet AZs can reduce cross-AZ path dependency and resilience risk.
Moving the resource alone does not establish resilient or working outbound paths.
DNS TTL is unrelated to the NAT gateway’s AZ dependency.
Cache invalidations do not alter private subnet internet egress topology.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
