You save $69.98
An analyst uses VPC Reachability Analyzer to test a path from an EC2 source ENI to an RDS ENI. It reports a reachable network path, but live application calls still time out. How should that result be interpreted?
Static reachability analysis does not send packets or prove the destination process is accepting connections.
Static routing and filtering analysis cannot certify application protocol completion.
Reachability can model private network components without implying internet routing.
Configuration reachability does not measure real-time transport performance.
A security-conscious network team needs separate Transit Gateway route tables to isolate production VPCs from lab accounts.
Which AWS networking configuration best addresses this specific requirement?
Transit Gateway forwards packets based on the attachment's associated route table, while propagation adds routes to selected tables rather than all tables. The proposed change can be checked by whether the intended attachment route tables show the required prefixes and reachability tests permit production-to-shared services while denying lab-to-production.
This configuration addresses nat gateway route and az resilience, not the transit gateway association and propagation tables requirement. A public NAT gateway translates outbound private IPv4 flows using public subnet connectivity but does not make private instances directly internet-addressable.
This configuration addresses aws ram share and attachment acceptance, not the transit gateway association and propagation tables requirement. Resource sharing and attachment authorization are separate from route-table configuration; each stage must be complete before transit is usable.
This configuration addresses interface vpc endpoint privatelink consumer configuration, not the transit gateway association and propagation tables requirement. PrivateLink interface endpoints expose private ENI addresses to approved service consumers; DNS and endpoint security policies determine usable connectivity.
A centralized VPC Flow Logs archive must remain queryable for one year with controlled encryption and limited access across network accounts. The team wants scalable long-term object storage rather than relying solely on short-lived console views. What delivery pattern best fits?
Central S3 log delivery and retention controls preserve records for later audit while isolating logging access from workload operators.
Local ephemeral history cannot enforce centralized audit retention or controlled access.
Public DNS is not a protected long-term network log archive.
Network flow metadata can reveal internal addressing and traffic patterns and still requires approved protection.
Many VPCs in separate accounts need one controlled internal namespace while preserving isolation between development and production.
Which AWS networking configuration best addresses this specific requirement?
Private hosted zones and Resolver rules can make selected internal names resolvable in associated VPCs without implying blanket network reachability. The proposed change can be checked by whether named test records resolve in approved VPCs, remain unavailable to unapproved VPCs and do not expose records to public DNS.
This configuration addresses transit gateway hub and spoke versus peering mesh, not the hybrid multi-account dns boundary requirement. Transit Gateway can route between VPC attachments according to association and propagation rules, unlike non-transitive VPC peering.
This configuration addresses cross-region transit gateway peering, not the hybrid multi-account dns boundary requirement. Transit Gateway peering joins separate regional gateway routing domains, and the peering attachment does not automatically propagate all remote routes.
This configuration addresses aws ram controlled networking resource share, not the hybrid multi-account dns boundary requirement. AWS RAM shares eligible resource associations across accounts while resource-owner routing policy and each consumer's VPC routes remain separate responsibilities.
A dedicated Direct Connect port is physically UP and the customer router has a BGP neighbor configured. The AWS transit virtual interface expects VLAN 312, while the switch tags all BGP frames with VLAN 321. Which correction is required?
VIF frames must arrive on the correct VLAN before the configured peering exchange can work.
Object-storage access points do not repair a VLAN mismatch.
Subnet internet exposure does not establish the Direct Connect VIF.
VIF adjacency uses Ethernet and BGP rather than DNS cache timing.
A regional disaster recovery design peers a Transit Gateway in North America with one in Europe. The attachment is Active, but neither region advertises the other’s spoke routes across that peering connection. What routing arrangement is required?
Transit Gateway inter-Region peering does not automatically propagate remote attachment routes. Each side needs explicit reachable peer prefix entries.
Cross-Region peering does not supply that automatic prefix propagation.
Internet egress does not replace private transit peering routes.
DNS naming cannot provide missing inter-Region packet routes.
An organization is planning protections for business-critical public endpoints exposed to volumetric DDoS traffic.
Which observation would most directly demonstrate the required network outcome?
A controlled resilience exercise and Shield telemetry demonstrate traffic mitigation and uninterrupted legitimate request handling under the approved plan. That is relevant because aWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats.
This would validate cross-account transit gateway route segmentation. The case instead needs evidence for aws shield and resilient ddos posture: A controlled resilience exercise and Shield telemetry demonstrate traffic mitigation and uninterrupted legitimate request handling under the approved plan.
This would validate security groups versus network acl layers. The case instead needs evidence for aws shield and resilient ddos posture: A controlled resilience exercise and Shield telemetry demonstrate traffic mitigation and uninterrupted legitimate request handling under the approved plan.
This would validate aws waf managed and rate-limiting rules. The case instead needs evidence for aws shield and resilient ddos posture: A controlled resilience exercise and Shield telemetry demonstrate traffic mitigation and uninterrupted legitimate request handling under the approved plan.
A forensics team is asked to identify the exact sequence of TCP retransmissions in an anomalous east-west connection. It has VPC Flow Logs but no packet capture from the affected interface. Which audit limitation is decisive?
Flow Logs show supported flow metadata rather than each individual packet and retransmission event.
Flow action does not describe TCP retransmission sequence.
CloudTrail logs management/API actions, not packet captures.
Application response aggregates do not recreate individual TCP packets.
A cybersecurity group wants to block known malicious DNS domains from VPC workloads, but first measure which internal applications would be disrupted by the proposed blocklist. DNS resolution must continue during the pilot. What DNS Firewall rule action should be used initially?
Alert allows matching queries while recording matching activity, making impact measurable before enforcement.
That denies queries during the impact assessment, contradicting the requirement.
A subnet ACL blocks broad DNS transport instead of logging domain-specific match activity.
Changing routing would interrupt hybrid DNS without assessing the targeted domain names.
A globally distributed network uses a Transit Gateway to connect 30 VPCs. During a route migration the audit team wants to measure packets lost due to no route at the transit gateway, not only accepted flows on application instance ENIs. Which telemetry best captures the gateway-specific loss reason?
Gateway flow records expose transit-level forwarding and loss counters including packets lost when no route is found.
The HTTP logs cannot represent dropped packets for every transit attachment.
CDN metrics do not report Transit Gateway route misses.
DNS request success does not measure gateway packet forwarding failures.
A streaming platform delivers personalized responses through CloudFront. Authentication depends on one request header, but the current cache key ignores it, allowing the same cached variant to be shared between users. Which change addresses cache separation?
CloudFront must vary the cache key on the input that changes the response, or avoid caching sensitive personalized objects.
A shorter TTL still allows cross-user reuse during that hour.
Global Accelerator does not repair an unsafe CloudFront cache key.
A VPC endpoint does not affect edge caching for viewer-specific responses.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
