You save $69.98
A SaaS ALB has two HTTPS listener rules: priority 10 matches /api/* and priority 20 matches /api/admin/*. The general API target group receives sensitive admin requests despite the more specific-looking second path. What should the engineer adjust?
ALB listener rules are evaluated by assigned priority; matching a broad rule first prevents the later specific rule from winning.
Connection draining does not change listener rule precedence.
Listener rules need distinct ordering and cannot share the same priority.
DNS record type does not reorder an ALB’s HTTPS listener rules.
An organization needs to prove its fallback VPN remains usable when the primary Direct Connect route is withdrawn.
Which observation would most directly demonstrate the required network outcome?
Route inspections and end-to-end tests show successful failover to encrypted VPN after disabling the private circuit and restoration afterward. That is relevant because route preference depends on AWS routing-priority rules and available advertised routes; backup transport must already carry compatible reachability.
This would validate hybrid path mtu and fragmentation. The case instead needs evidence for direct connect failover to vpn route selection: Route inspections and end-to-end tests show successful failover to encrypted VPN after disabling the private circuit and restoration afterward.
This would validate customer gateway bgp asn coordination. The case instead needs evidence for direct connect failover to vpn route selection: Route inspections and end-to-end tests show successful failover to encrypted VPN after disabling the private circuit and restoration afterward.
This would validate direct connect physical provisioning and bgp bring-up. The case instead needs evidence for direct connect failover to vpn route selection: Route inspections and end-to-end tests show successful failover to encrypted VPN after disabling the private circuit and restoration afterward.
A private SaaS endpoint breaks after the provider rotates backend NLB targets and consumers report intermittent failures.
Which AWS networking configuration best addresses this specific requirement?
PrivateLink connectivity depends on accepted service endpoints and healthy provider backends without granting consumer VPCs general routes. The proposed change can be checked by whether endpoint connection state is available, provider target groups are healthy and a consumer-side private call succeeds with expected DNS.
This configuration addresses aws gateway route-priority and static-route validation, not the privatelink endpoint lifecycle restoration requirement. IP routing selects a matching destination prefix under the service's route-selection rules; changing security groups cannot override the selected next hop.
This configuration addresses transit gateway route propagation drift, not the privatelink endpoint lifecycle restoration requirement. Gateway routing policy uses the route table associated with an originating attachment and propagates routes only to eligible route tables.
This configuration addresses direct connect bgp session health maintenance, not the privatelink endpoint lifecycle restoration requirement. Direct Connect private routing depends on stable BGP advertisements and allowed prefix policy in addition to the physical cross-connect.
A customer-facing HTTPS ALB presents a valid certificate, but its configured security policy allows an older protocol version no longer permitted by the organization’s regulatory baseline. What listener change best addresses the cryptographic requirement?
The certificate alone does not control the protocol suites negotiated with viewers; the listener policy does.
Health checks do not determine client-side TLS protocol negotiation.
DNS caching has no effect on allowed TLS cipher suites.
Address stability is unrelated to negotiated TLS protocol strength.
A tightly coupled HPC simulation runs MPI communication among EC2 nodes and is limited by operating-system networking overhead. Supported HPC instance types are available. Which feature is purpose-built for low-latency inter-node communication?
EFA provides specialized low-latency, OS-bypass network capabilities for compatible tightly coupled HPC applications.
An HTTP frontend load balancer is not an HPC interconnect.
Public addresses do not create EFA’s communication capabilities.
Object version retention does not change inter-node HPC latency.
An auditor must track changes to Transit Gateway routes and VPC networking policy across separate AWS accounts.
Which observation would most directly demonstrate the required network outcome?
A controlled security-group modification produces an accessible audit event with the expected principal, operation, resource and timestamp. That is relevant because cloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads.
This would validate network firewall flow and alert log delivery. The case instead needs evidence for cloudtrail network api audit: A controlled security-group modification produces an accessible audit event with the expected principal, operation, resource and timestamp.
This would validate cloudwatch alarm and security response integration. The case instead needs evidence for cloudtrail network api audit: A controlled security-group modification produces an accessible audit event with the expected principal, operation, resource and timestamp.
This would validate vpc flow logs for security investigations. The case instead needs evidence for cloudtrail network api audit: A controlled security-group modification produces an accessible audit event with the expected principal, operation, resource and timestamp.
A hybrid circuit reports physical connectivity but the routed network intermittently fails when BGP peer sessions reset.
Which AWS networking configuration best addresses this specific requirement?
Direct Connect private routing depends on stable BGP advertisements and allowed prefix policy in addition to the physical cross-connect. The proposed change can be checked by whether monitoring shows stable established BGP sessions and consistent intended prefix reachability throughout an observation window.
This configuration addresses transit gateway route propagation drift, not the direct connect bgp session health maintenance requirement. Gateway routing policy uses the route table associated with an originating attachment and propagates routes only to eligible route tables.
This configuration addresses hybrid route summarization and overlap response, not the direct connect bgp session health maintenance requirement. Route aggregation reduces route-table entry counts, but an overly broad summary may route destinations not actually owned by the advertising site.
This configuration addresses vpc endpoint private versus public service reachability, not the direct connect bgp session health maintenance requirement. Gateway endpoints provide VPC route targets for supported services such as S3, while interface endpoints expose private service addresses through endpoint ENIs.
An infrastructure engineer must alter CIDR associations in a production CloudFormation-managed VPC stack. Security requires a reviewable list of proposed stack resource actions before deployment. Which CloudFormation workflow supports this review?
CloudFormation change sets preview intended stack changes so reviewers can assess resource replacements and updates before execution.
Immediate deployment removes the requested preexecution review step.
Traffic logs are retrospective and do not preview planned stack mutations.
DNS caching does not enumerate infrastructure resource changes.
Private application instances require controlled outbound package downloads but must not accept inbound internet sessions.
Which observation would most directly demonstrate the required network outcome?
Instances in each intended private subnet can reach approved outbound endpoints with correct return traffic while unsolicited inbound sessions remain blocked. That is relevant because a public NAT gateway translates outbound private IPv4 flows using public subnet connectivity but does not make private instances directly internet-addressable.
This would validate interface vpc endpoint privatelink consumer configuration. The case instead needs evidence for nat gateway route and az resilience: Instances in each intended private subnet can reach approved outbound endpoints with correct return traffic while unsolicited inbound sessions remain blocked.
This would validate transit gateway association and propagation tables. The case instead needs evidence for nat gateway route and az resilience: Instances in each intended private subnet can reach approved outbound endpoints with correct return traffic while unsolicited inbound sessions remain blocked.
This would validate vpc peering bilateral route update. The case instead needs evidence for nat gateway route and az resilience: Instances in each intended private subnet can reach approved outbound endpoints with correct return traffic while unsolicited inbound sessions remain blocked.
A telemetry collector receives UDP datagrams through an NLB. The engineering team proposes a UDP health check on the target group, but the service does not have a TCP or HTTP readiness endpoint. Which readiness design is appropriate?
NLB health checks use supported transport/application probes rather than a UDP exchange to assess UDP target health.
UDP listener traffic does not mean an arbitrary UDP health-check protocol is available.
Without useful health signals the load balancer cannot reliably avoid failed targets.
An unrelated CDN endpoint does not report the registered target’s actual readiness.
A packet analyst examines VPC Flow Log TCP flag fields after repeated connection resets. An entry contains an RST bit mask while the application reports abrupt disconnects. What can the log establish without overclaiming?
TCP flag metadata can narrow the investigation to reset behavior but does not identify the application fault or all packet sequence details.
TCP reset information alone does not establish why a TLS application stopped.
Flow Logs contain metadata rather than full packet bodies.
A TCP reset can occur for many reasons without host failure.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
