You save $69.98
A CloudWatch alarm reliably enters ALARM during a simulated firewall-deny spike but sends no notification. Its SNS email subscription has never been confirmed. What should be corrected to make the incident alert usable?
An ALARM state and a working subscriber delivery path are distinct; the pending subscription is the demonstrated blocker.
Suppressing the alarm hides the problem rather than correcting delivery.
Removing the signal cannot make a pending subscriber receive alerts.
DNS record names do not confirm SNS subscriptions.
A global non-cacheable TCP service has users far from its primary AWS Region and needs consistent connection paths.
Which technical explanation best accounts for the network behavior described?
Global Accelerator routes eligible TCP or UDP traffic onto the AWS global network and supports static anycast ingress and health-based endpoint routing. A direct check is to evaluate Global Accelerator for suitable application traffic and configure health-aware regional endpoints with measured traffic policies and observe the corresponding path.
Elastic Network Adapter supports enhanced network performance on compatible instance types, while achievable bandwidth also depends on instance size. That is a valid account of eni performance instance network capability, but it does not explain the global accelerator latency and failover optimization behavior in the scenario.
A gateway endpoint can route supported S3 traffic inside AWS without passing that traffic through a NAT gateway's per-GB processing path. That is a valid account of nat gateway data-processing cost reduction, but it does not explain the global accelerator latency and failover optimization behavior in the scenario.
Elastic Fabric Adapter offers specialized OS-bypass networking for supported HPC workloads; it is not a generic internet-facing load balancer. That is a valid account of elastic fabric adapter hpc placement, but it does not explain the global accelerator latency and failover optimization behavior in the scenario.
A site publicly publishes DNSSEC-signed records after migrating its domain to Route 53. Its registrar still delegates to the former authoritative name servers, which serve unsigned stale records. What should the operator verify as part of completing the secure DNS cutover?
The DNSSEC-signed child zone must actually be the zone that recursive resolvers reach through parent delegation.
TTL changes in an undelegated zone cannot redirect recursive resolvers.
Bypassing DNSSEC verification is not a controlled migration fix.
Private VPC Resolver endpoints are not the public authoritative DNS delegation mechanism.
A burstable instance runs a continuous 18-hour telemetry stream. Network throughput begins high but becomes limited after sustained operation, even though CPU and security rules remain healthy. What performance characteristic should the team verify before increasing application concurrency?
Short burst performance may exceed the sustainable capacity available during a long-running constant workload.
A burst test can mask sustained network allowance constraints.
DNS search domains do not change the instance’s permitted network bandwidth.
CDN metrics cannot raise packet throughput of this telemetry instance.
An IPv6-only private EC2 workload must reach approved public IPv6 services while rejecting unsolicited inbound internet-initiated sessions. The subnet has native IPv6 networking. Which gateway design is appropriate for outbound-only IPv6 internet access?
An egress-only internet gateway supports outbound-initiated IPv6 communication while disallowing inbound initiation through that route.
Ordinary IPv4 NAT is not the generic IPv6 egress-only gateway mechanism.
A normal internet path plus no filtering would weaken the required inbound restriction.
DNS records do not implement stateful outbound-only IPv6 packet forwarding.
A DNS team needs to monitor attempted exfiltration domains queried by VPC instances and correlate the DNS Firewall action with a specific rule group. VPC Flow Logs show only IP connections. What telemetry should be retained?
Resolver query logging supplies query names and matched firewall policy metadata that packet-flow summaries do not include.
Flow records generally do not identify the domain name or DNS Firewall rule group responsible for a decision.
CDN traffic measurements do not represent internal Resolver filtering actions.
Routing adjacency state cannot attribute blocked DNS domains.
A public Route 53 weighted-routing rollout sends 10% of traffic to a canary API. The canary becomes unavailable, but its weighted record has no associated health check and clients cache DNS answers for the configured TTL. Which failure is most directly exposed by this design?
Without a matching health check, a weighted record can remain eligible despite an endpoint failure; cached answers further limit immediate recovery.
Canary failure does not invalidate a separate primary endpoint's TLS certificate.
Unhealthy weights and caching do not change the record's public/private hosted zone.
A single unmonitored weighted member does not inherently shut down the entire hosted zone.
An engineering team rotates Route 53 DNSSEC signing keys. The child zone publishes the new DNSKEY and signs records, but the parent registrar still publishes a DS digest for a removed old key. Validating recursive resolvers return SERVFAIL. Which repair restores the trust chain?
A stale parent DS creates a mismatch between parent trust and the child keys even when the records remain signed.
Removing service addresses does not repair the DS/DNSKEY cryptographic mismatch.
Private DNS endpoints do not fix public validating resolvers’ chain of trust.
Longer caching does not make a mismatched DS cryptographically valid.
A public login endpoint behind an ALB receives high volumes of valid-looking POST requests. The WAF has SQL injection signatures but no login-specific rate rule. Which security gap permits sustained credential-stuffing-like request bursts to pass?
Signature matching and rate enforcement are different WAF decisions; the attack described is abusive traffic volume to a sensitive path, not necessarily SQL injection syntax.
Signature detection cannot be assumed to impose a separate request-rate policy.
NACLs filter network-layer rules, not HTTP path rates.
DNS alias routing supplies neither application rate enforcement nor TLS policy on its own.
An interface VPC endpoint for a private partner service is Available, but the client application still resolves the partner’s public hostname to its public address. The partner has configured private DNS support for its endpoint service and ownership validation. What consumer-side step needs attention?
Interface endpoint private DNS can map the supported service name to endpoint ENI addresses for consumers.
Gateway endpoints for S3 do not provide private name resolution for the partner endpoint service.
Public DNS and direct provider IPs bypass the intended private endpoint path.
Using internet NAT is the opposite of the required private name-to-endpoint resolution.
A PrivateLink provider changes NLB targets. Connections remain accepted, but the new target-group health check probes a TCP port the service does not listen on. What is the immediate restoration action?
A healthy endpoint connection still requires healthy provider targets, and the configured readiness probe is rejecting them.
Endpoint approval does not make the new backend's health check succeed.
DNS caching is not the demonstrated backend health problem.
Network peering is unnecessary for this private service and does not fix target health.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
