You save $69.98
Two Transit Gateways have an AVAILABLE inter-Region peering attachment. Both VPC subnet tables direct remote-CIDR traffic to the local TGW, yet the TGW route tables lack peer-prefix entries. Which architectural property accounts for the outage?
An AVAILABLE peering connection is only the transport relationship. Its route tables must independently know the remote destination prefixes and peering target.
This case uses TGW peering, and VPC peering is not transitively routable.
Security groups filter flows rather than populate TGW peering routes.
DNS resolution and BGP route export do not install static TGW peer routes.
An ALB listener forwards a fraction of /beta requests to two compatible target groups for canary testing. The web application uses local session memory, and users lose their session when subsequent requests bounce between groups. What load-balancer feature addresses this specific weighted-forward problem?
Weighted target-group stickiness can keep a client bound to its selected target group during the experiment.
Cross-zone distribution does not preserve assignment to the same weighted target group.
Health sensitivity does not maintain a user’s target-group choice.
GWLB handles appliance insertion, not sticky HTTP canary forwarding.
A Transit Gateway attachment is Available and its route table contains the correct propagated branch prefix. EC2 workloads in a newly created private subnet cannot reach the branch because that subnet’s VPC route table still sends the branch CIDR to a deleted virtual appliance. What risk does checking only the Transit Gateway tables overlook?
Effective packet forwarding requires the originating subnet route to target the Transit Gateway attachment.
The TGW knows the branch route; the originating subnet is still targeting a deleted appliance.
The attachment is already available and does not need a second acceptance.
Access permissions do not repair the stale routing target.
A centrally managed Firewall Manager policy targets only the `Engineering` organizational unit. A newly acquired account has been moved to the `Retail` OU and its public ALB is not protected, although the account is visible in the organization inventory. Which scope-related risk must the security administrator address?
Firewall Manager policy scope determines which resources and accounts are assessed or remediated.
Stronger policy rules do not affect the Retail OU that the policy never includes.
Visibility does not expand the Firewall Manager resource policy scope.
The uncovered ALB belongs to a different OU, which remains outside the policy.
An existing Application Load Balancer terminates HTTPS for api.example.net and login.example.net and uses host-based listener rules to select different target groups. The team must renew certificates without replacing the ALB or losing name validation. What TLS configuration is required?
An ALB HTTPS listener can select among certificates for multiple names while continuing to use its layer-seven host-routing rules. The deployed listener certificate and renewal validation must cover each hostname.
Backend certificates alone cannot satisfy TLS validation for clients terminating HTTPS at the ALB listener.
An HTTP-only listener cannot itself terminate or validate the required client-to-load-balancer TLS session.
A one-label wildcard certificate does not cover arbitrary nested hostnames; the deployed certificate must match each viewer name.
An operator added a route in one VPC but forgot the reverse path in the peer VPC and now only sees one-way probes.
Which technical explanation best accounts for the network behavior described?
VPC peering has no transitive routing and requires both VPCs to route toward the peering connection for successful bidirectional traffic. A direct check is to add matching non-overlapping destination routes to both associated VPC subnet route tables and verify applicable security rules and observe the corresponding path.
PrivateLink interface endpoints expose private ENI addresses to approved service consumers; DNS and endpoint security policies determine usable connectivity. That is a valid account of interface vpc endpoint privatelink consumer configuration, but it does not explain the vpc peering bilateral route update behavior in the scenario.
Resource sharing and attachment authorization are separate from route-table configuration; each stage must be complete before transit is usable. That is a valid account of aws ram share and attachment acceptance, but it does not explain the vpc peering bilateral route update behavior in the scenario.
Transit Gateway inter-Region peering does not automatically propagate remote attachment prefixes; route-table entries identify the peering path. That is a valid account of transit gateway cross-region static routing, but it does not explain the vpc peering bilateral route update behavior in the scenario.
An origin serves customer manual PDFs that change only once per quarter. A CloudFront distribution forwards every random marketing tracking query parameter into the cache key, generating millions of cache misses for identical object bytes. What is the narrowest optimization?
Equivalent object requests should share a cached representation rather than fragmenting on advertising identifiers.
User-Agent variation would further split identical PDF objects into separate cache entries.
Disabling caching would increase origin load for unchanged manuals.
NAT routing does not reduce the number of distinct CloudFront cached variants.
An application works for tiny responses but stalls for large requests across a hybrid IPsec tunnel.
Which observation would most directly demonstrate the required network outcome?
Large response tests succeed after the targeted correction and packet captures show suitable segment sizes across the entire path. That is relevant because oversized packets may be discarded when encapsulation reduces effective MTU and Path MTU Discovery messages are blocked or misinterpreted.
This would validate flow log reject versus accept interpretation. The case instead needs evidence for path mtu discovery black-hole diagnosis: Large response tests succeed after the targeted correction and packet captures show suitable segment sizes across the entire path.
This would validate reachability analyzer blocked security group diagnosis. The case instead needs evidence for path mtu discovery black-hole diagnosis: Large response tests succeed after the targeted correction and packet captures show suitable segment sizes across the entire path.
This would validate vpc traffic mirroring tls retransmission investigation. The case instead needs evidence for path mtu discovery black-hole diagnosis: Large response tests succeed after the targeted correction and packet captures show suitable segment sizes across the entire path.
A network administrator needs to identify why return traffic behaves differently across security group and network ACL policies.
Which observation would most directly demonstrate the required network outcome?
Approved app-to-database sessions complete with return traffic and explicit unauthorized subnet access is rejected in tests. That is relevant because security groups are stateful at resource interfaces, while network ACLs are stateless subnet filters evaluated separately for each traffic direction.
This would validate aws waf managed and rate-limiting rules. The case instead needs evidence for security groups versus network acl layers: Approved app-to-database sessions complete with return traffic and explicit unauthorized subnet access is rejected in tests.
This would validate aws network firewall policy precedence. The case instead needs evidence for security groups versus network acl layers: Approved app-to-database sessions complete with return traffic and explicit unauthorized subnet access is rejected in tests.
This would validate firewall manager centralized security policy. The case instead needs evidence for security groups versus network acl layers: Approved app-to-database sessions complete with return traffic and explicit unauthorized subnet access is rejected in tests.
A networking account shares a Route 53 private hosted zone with two application VPCs. Both can resolve api.shared.internal to its 10.90.5.10 address, but one application VPC has no route or peering/transit attachment to the service VPC. What network change is still needed?
Private hosted-zone association supplies name resolution, not automatic packet forwarding between otherwise isolated VPC networks.
Repeated name resolution cannot add missing transport routing.
Internet exposure violates the stated controlled private connectivity goal.
TTL does not establish a VPC-to-VPC route.
A CloudWatch alarm reliably enters ALARM during a simulated firewall-deny spike but sends no notification. Its SNS email subscription has never been confirmed. What should be corrected to make the incident alert usable?
An ALARM state and a working subscriber delivery path are distinct; the pending subscription is the demonstrated blocker.
Suppressing the alarm hides the problem rather than correcting delivery.
Removing the signal cannot make a pending subscriber receive alerts.
DNS record names do not confirm SNS subscriptions.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
