You save $69.98
A central outbound Resolver endpoint forwards a factory domain to on-premises DNS. The target network ACL recently changed and permits UDP 53 but rejects TCP 53. Most short lookups work while larger truncated DNS responses fail. What network fix should be considered?
DNS can retry truncated responses over TCP; blocking that transport causes intermittent failures for larger answers.
Deliberately disabling working DNS transport does not solve the truncated-answer problem.
Public exposure violates the on-premises internal DNS architecture.
Gateway route preference is not the cause of selective DNS TCP failure.
Two VPCs have an active peering connection. The requester route table sends 10.70.0.0/16 to the peer, but the accepter only has its local 10.80.0.0/16 route and no path back to requester 10.60.0.0/16. Why do requests fail?
Peering requires appropriate routes on both sides; traffic cannot complete when responses have no route to the requester.
Unrelated peering does not supply the missing return path.
DNS record signing does not affect IP return-route lookup.
Removing the forward path would make connectivity worse.
A new application account lacks a required WAF policy even though the central security team believes the baseline applies everywhere.
Which AWS networking configuration best addresses this specific requirement?
Firewall Manager can evaluate whether eligible resources meet organization-wide firewall policy assignments and report noncompliant cases. The proposed change can be checked by whether a newly added in-scope resource appears as protected and previous noncompliant findings clear after enforced remediation.
This configuration addresses network firewall flow and alert log delivery, not the firewall manager organization compliance audit requirement. Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches.
This configuration addresses vpc flow logs for security investigations, not the firewall manager organization compliance audit requirement. Flow logs emit metadata such as IP addresses, ports, bytes and ACCEPT/REJECT action for supported network flows, not raw packet bodies.
This configuration addresses cloudtrail network api audit, not the firewall manager organization compliance audit requirement. CloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads.
An organization is planning protections for business-critical public endpoints exposed to volumetric DDoS traffic.
Which AWS networking configuration best addresses this specific requirement?
AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats. The proposed change can be checked by whether a controlled resilience exercise and Shield telemetry demonstrate traffic mitigation and uninterrupted legitimate request handling under the approved plan.
This configuration addresses cross-account transit gateway route segmentation, not the aws shield and resilient ddos posture requirement. Transit Gateway attachment association and propagation control which routed prefixes each network segment can reach, independent of VPC security-group rules.
This configuration addresses firewall manager centralized security policy, not the aws shield and resilient ddos posture requirement. Firewall Manager coordinates organization-wide firewall policies for eligible resources, while each resource's security behavior still requires policy scope and remediation.
This configuration addresses gateway load balancer third-party appliance insertion, not the aws shield and resilient ddos posture requirement. Gateway Load Balancer provides appliance load balancing via GENEVE encapsulation and can support central transparent inspection designs.
A VPN tunnel is UP and the customer gateway BGP session is Established after correcting its ASN. One branch /24 still never arrives in AWS because an outbound prefix filter excludes it. Which evidence isolates the remaining issue?
A healthy BGP session does not prove that every permitted route is being advertised through configured prefix policies.
Route advertisements can be filtered after adjacency establishes.
DNS resolution is not proof of the missing BGP prefix.
Local permitted traffic does not validate the hybrid advertisement.
An EKS environment launches new pods through ENIs in a /27 private subnet. The scheduler can place pods, but EC2 network interface allocation fails because few usable private addresses remain. CPU is largely idle. What resource should operations remediate?
Pod/ENI provisioning depends on available subnet IPs and can fail independently of host CPU utilization.
Health probe timing cannot create additional IP addresses.
Removing allocation visibility does not add addresses to the exhausted subnet.
CDN caching is unrelated to pod networking address exhaustion.
A CloudFront distribution forces HTTPS from viewers to the edge, but its custom origin behavior still permits HTTP to an internal ALB. Security requires encryption throughout the viewer-to-origin chain. What must change?
Viewer TLS does not encrypt the separate CloudFront-to-origin connection when the origin policy allows HTTP.
TLS at the edge does not imply end-to-end encryption to the custom origin.
DNS authority changes do not force TLS on the origin connection.
A counting rule does not establish encryption on CloudFront’s outbound origin fetch.
A security team wants its network deployment pipeline to create endpoints in many application accounts. It cannot store long-lived administrator keys in the CI environment, and every account must enforce a scoped permissions boundary. What should the pipeline use?
Temporary assumed-role credentials provide cross-account operations under the target account’s limited role policy.
Long-lived broadly privileged credentials violate the stated credential and scope controls.
Exposing addresses does not authorize infrastructure changes.
Broad SSH access is unrelated to secure API-based automation roles.
A shared Transit Gateway used to route to a branch but traffic stopped after an attachment was moved to another route table.
Which technical explanation best accounts for the network behavior described?
Gateway routing policy uses the route table associated with an originating attachment and propagates routes only to eligible route tables. A direct check is to inspect Transit Gateway route-table associations, permitted propagations and attachment state, then restore the intended prefix route entries and observe the corresponding path.
Gateway endpoints provide VPC route targets for supported services such as S3, while interface endpoints expose private service addresses through endpoint ENIs. That is a valid account of vpc endpoint private versus public service reachability, but it does not explain the transit gateway route propagation drift behavior in the scenario.
PrivateLink connectivity depends on accepted service endpoints and healthy provider backends without granting consumer VPCs general routes. That is a valid account of privatelink endpoint lifecycle restoration, but it does not explain the transit gateway route propagation drift behavior in the scenario.
Route aggregation reduces route-table entry counts, but an overly broad summary may route destinations not actually owned by the advertising site. That is a valid account of hybrid route summarization and overlap response, but it does not explain the transit gateway route propagation drift behavior in the scenario.
During a staged service rollout, a team needs Route 53 to direct roughly 10% of DNS responses to a canary endpoint and 90% to the established endpoint. No client affinity or exact request counts are guaranteed. Which routing policy matches this controlled split?
Weighted routing makes approximate proportional DNS answer choices according to the configured weights.
Latency routing selects by measured location/latency rather than a 10/90 rollout weight.
Failover is health-primary/secondary driven, not a controlled two-target traffic share.
Multivalue responses do not implement a prescribed 10/90 selection ratio.
A security team wants an actionable notification when a network metric crosses an agreed threshold for a sustained interval.
Which technical explanation best accounts for the network behavior described?
CloudWatch alarms evaluate metric periods and thresholds while EventBridge and notification integrations can dispatch timely security response signals. A direct check is to configure CloudWatch metric filters or native metrics, an appropriate alarm and a controlled notification or response target and observe the corresponding path.
Flow logs emit metadata such as IP addresses, ports, bytes and ACCEPT/REJECT action for supported network flows, not raw packet bodies. That is a valid account of vpc flow logs for security investigations, but it does not explain the cloudwatch alarm and security response integration behavior in the scenario.
CloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads. That is a valid account of cloudtrail network api audit, but it does not explain the cloudwatch alarm and security response integration behavior in the scenario.
Traffic Mirroring copies supported packet traffic to a capture destination, whereas flow logs provide aggregate network metadata. That is a valid account of vpc traffic mirroring security packet evidence, but it does not explain the cloudwatch alarm and security response integration behavior in the scenario.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
