You save $69.98
A workload runs in two Availability Zones but both private application subnets send all outbound internet traffic through a NAT gateway created in only one AZ. The network team wants to reduce cross-AZ dependencies and avoid losing egress solely when that AZ fails. What design should it evaluate?
Zonal NAT deployments aligned with subnet AZs can reduce cross-AZ path dependency and resilience risk.
Moving the resource alone does not establish resilient or working outbound paths.
DNS TTL is unrelated to the NAT gateway’s AZ dependency.
Cache invalidations do not alter private subnet internet egress topology.
An engineer sees multiple candidate routes and needs to verify the most specific matching destination before editing application rules.
Which observation would most directly demonstrate the required network outcome?
A route-table trace shows the approved next hop for the exact destination CIDR and end-to-end probes complete on the return path. That is relevant because iP routing selects a matching destination prefix under the service's route-selection rules; changing security groups cannot override the selected next hop.
This would validate privatelink endpoint lifecycle restoration. The case instead needs evidence for aws gateway route-priority and static-route validation: A route-table trace shows the approved next hop for the exact destination CIDR and end-to-end probes complete on the return path.
This would validate vpc endpoint private versus public service reachability. The case instead needs evidence for aws gateway route-priority and static-route validation: A route-table trace shows the approved next hop for the exact destination CIDR and end-to-end probes complete on the return path.
A propagated broad prefix is insufficient when a more-specific source-subnet route selects an unintended target. This observation confirms the unresolved route-priority problem rather than successful validation.
An AWS WAF managed rule group begins blocking legitimate API clients after an update. Security needs to assess the specific rule’s impact before selectively applying an exception, while maintaining other controls. Which approach is most defensible?
Count mode exposes the rule’s match behavior without blocking test traffic while preserving the rest of the WAF policy.
That removes unrelated protections and gives little evidence about the false positive.
Broader network access cannot correct an HTTP inspection false positive.
Authoritative name servers do not choose a WAF managed rule action.
A security team sees a permitted TCP flow in VPC Flow Logs but must inspect packets to determine unusual connection behavior.
Which AWS networking configuration best addresses this specific requirement?
Traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata. The proposed change can be checked by whether the sensor receives the expected authorized traffic sample and analysts can correlate packet timing with flow and host events.
This configuration addresses network firewall flow and alert log delivery, not the vpc traffic mirroring security packet evidence requirement. Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches.
This configuration addresses vpc flow logs for security investigations, not the vpc traffic mirroring security packet evidence requirement. Flow logs emit metadata such as IP addresses, ports, bytes and ACCEPT/REJECT action for supported network flows, not raw packet bodies.
This configuration addresses firewall manager organization compliance audit, not the vpc traffic mirroring security packet evidence requirement. Firewall Manager can evaluate whether eligible resources meet organization-wide firewall policy assignments and report noncompliant cases.
A Route 53 Resolver outbound endpoint is operational, and a new rule for finance.corp.example targets reachable datacenter DNS IPs. Only one of two VPCs resolves the corporate name; inspection shows the rule is associated with the first VPC but not the second. Which DNS mechanism explains this split?
Resolver chooses rules in the context of the querying VPC and associated suffixes. The second VPC has not been given the required forwarding selection.
Rules require explicit VPC association and are not account-global.
Public DNS delegation does not substitute for a VPC Resolver rule association.
BGP peer ASN is unrelated to DNS rule membership in VPCs.
A VPC subnet route points the branch CIDR at an elastic network interface belonging to a packet-filtering appliance that was terminated last night. The route is now marked blackhole, but an engineer checks only security-group permissions and leaves the route untouched. What risk results from this stale next-hop dependency?
VPC route targets must refer to usable network resources; a deleted target cannot forward packets.
The route is blackholed before an allowed packet can reach the branch.
New compute capacity does not automatically retarget a subnet route pointing at a removed ENI.
The branch uses a destination-specific route that overrides the default for matching traffic.
A mission-critical network application on a public NLB faces volumetric DDoS traffic. The team proposes AWS WAF on that NLB to block all packet floods, but the current design does not use an HTTP-layer endpoint. Which protection direction is most appropriate?
DDoS defenses for volumetric network traffic differ from WAF inspection of supported HTTP application requests.
AWS WAF is not a general UDP packet filter for arbitrary NLB listeners.
Content caching does not mitigate the NLB volumetric attack path.
Broadening ingress increases exposure and is not DDoS mitigation.
A Gateway Load Balancer sits in the required egress inspection path. New TGW routes send outbound packets through its endpoint but the returning packets take a direct path around the stateful firewall. Which security and availability risk follows?
Stateful packet inspection requires coherent forward and return flow handling; bypassing the appliance on return can cause state errors and audit gaps.
A symmetric tested inspection path does not have the described return-path bypass.
DNS caching does not explain the stateful inspection failure.
Endpoint availability does not override TGW and subnet route selection for return packets.
A provider replaced the on-premises router and the AWS VPN now shows tunnel transport up with its BGP session down.
Which observation would most directly demonstrate the required network outcome?
The BGP session reaches the established state, expected prefixes appear and the cloud-to-datacenter test succeeds. That is relevant because bGP peers must agree on neighbor addressing and expected autonomous systems before they can exchange dynamic routes over the encrypted tunnel.
This would validate redundant vpn tunnels with bgp failover. The case instead needs evidence for customer gateway bgp asn coordination: The BGP session reaches the established state, expected prefixes appear and the cloud-to-datacenter test succeeds.
This would validate direct connect physical provisioning and bgp bring-up. The case instead needs evidence for customer gateway bgp asn coordination: The BGP session reaches the established state, expected prefixes appear and the cloud-to-datacenter test succeeds.
The IPsec and subnet route state do not prove a restored BGP adjacency. The peer is still IDLE and route exchange remains unavailable.
An eligible dedicated Direct Connect circuit carries traffic between an AWS Direct Connect location and a regulated customer router. The customer requires Ethernet link encryption on that physical segment, distinct from application TLS. Which AWS feature should be evaluated?
MACsec protects Ethernet frames on the eligible physical Direct Connect link; it does not automatically imply end-to-end app encryption.
At-rest object encryption does not secure the physical link frames.
Health checks cannot encrypt link-layer payloads.
OAC is a CloudFront-to-S3 authorization mechanism, not Ethernet link encryption.
A fleet of application VPCs independently deploys an interface endpoint for each supported AWS service in every Availability Zone. An architect proposes sharing central VPC endpoints through private transit for selected services. Which tradeoff must be evaluated before consolidating?
Centralized endpoint architecture can alter costs but may introduce shared dependency, cross-zone or inter-VPC routing overhead.
Interface and gateway endpoints have different attachment and DNS/routing semantics.
That may violate private-access constraints rather than optimize a viable approved design.
Static duplicate addresses do not create valid endpoint connections across VPC boundaries.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
