You save $69.98
A public web API is experiencing application-layer requests with malicious HTTP patterns despite a healthy load balancer.
Which observation would most directly demonstrate the required network outcome?
Controlled benign requests succeed while simulated matching malicious patterns are logged and blocked under the selected rules. That is relevant because aWS WAF inspects supported HTTP request attributes at layer seven and can count, block or challenge requests according to web ACL rules.
This would validate cross-account transit gateway route segmentation. The case instead needs evidence for aws waf managed and rate-limiting rules: Controlled benign requests succeed while simulated matching malicious patterns are logged and blocked under the selected rules.
This would validate aws network firewall centralized filtering. The case instead needs evidence for aws waf managed and rate-limiting rules: Controlled benign requests succeed while simulated matching malicious patterns are logged and blocked under the selected rules.
This would validate aws shield and resilient ddos posture. The case instead needs evidence for aws waf managed and rate-limiting rules: Controlled benign requests succeed while simulated matching malicious patterns are logged and blocked under the selected rules.
A customer consumes one TCP service over PrivateLink using an interface VPC endpoint. The network team needs to prove that general IP routing into the provider's other application subnets has NOT been granted. Which access-control test establishes the intended boundary?
PrivateLink provides service-level access through an endpoint and does not require general routed reachability to the provider VPC.
That expands reachability beyond the private service boundary.
Provider health alone cannot prove the consumer has scoped access.
Public name publication cannot establish a PrivateLink isolation boundary.
A central security account holds an AWS Config aggregator for network compliance, but a new workload account has never enabled recording. Its VPCs appear absent from the report despite using the same AWS Organization. What should governance check?
Aggregation can summarize only supported configuration observations produced and permitted by source accounts and Regions.
An aggregator does not generate missing historical configuration evidence on its own.
Public application exposure is unrelated to Config compliance recording.
DNS authority does not enroll a workload account in Config recording.
A network engineer has a working Direct Connect connection and must reach multiple VPCs behind one Transit Gateway. The engineer attempts to attach a private virtual interface directly to the Transit Gateway, but the configuration does not support the expected association. What should be provisioned?
The transit interface and gateway association pattern is intended for Direct Connect reachability to Transit Gateway networks.
A private VIF does not attach directly to a Transit Gateway in that manner.
Public VIFs are not the requested private TGW attachment path.
Internet gateways are not Direct Connect transit VIF peers.
An internal NLB has one healthy target group spread unevenly across three Availability Zones. Clients reaching the least-populated zone face connection bottlenecks because the load balancer’s nodes do not send traffic to healthy targets in other zones. Which feature should be evaluated?
Cross-zone forwarding allows a node to use healthy targets in other zones, subject to configuration and pricing considerations.
Removing remote capacity worsens the imbalance.
NLB TCP listeners do not use ALB HTTP-header conditions for redistribution.
Lifecycle notices do not control load-balancer cross-zone target selection.
A SaaS company must route HTTPS requests by host name and URL path to separate application target groups.
Which AWS networking configuration best addresses this specific requirement?
The ALB makes layer-seven HTTP routing decisions after TLS handling and can direct different request paths to distinct backend groups. The proposed change can be checked by whether requests for each documented host and path reach the correct healthy backend and the public certificate validates in a browser.
This configuration addresses cross-zone load balancing and target distribution, not the alb layer-seven route and tls requirement. Cross-zone choices determine whether load balancer nodes can distribute traffic to healthy targets beyond the node's own zone, subject to product-specific defaults.
This configuration addresses nlb static ip and tcp passthrough, not the alb layer-seven route and tls requirement. Network Load Balancer operates primarily at layer four and can expose stable per-zone IP addresses while forwarding TCP or UDP connections to targets.
This configuration addresses gateway load balancer inline inspection, not the alb layer-seven route and tls requirement. Gateway Load Balancer uses a network-transparent appliance insertion pattern with GENEVE encapsulation and target health management.
A worldwide ticketing site uses Global Accelerator with groups in Frankfurt and Tokyo. A release engineer sets the Tokyo traffic dial to 20, expecting exactly 20% of every global user connection to visit Tokyo. Which correction describes the dial accurately?
A regional traffic dial is applied to traffic assigned to that group; end-user geography and health also affect the global mix.
A dial does not establish a global distribution quota across all endpoint groups.
It controls network admission, not compute utilization.
Global Accelerator has no CloudFront cache-hit policy to tune.
An IPsec VPN to a Transit Gateway has an established BGP adjacency and advertises 172.28.0.0/16. Yet the TGW table used by the application has a more-specific blackhole entry for 172.28.10.0/24. Requests to that branch subnet fail. Which targeted action fixes the effective forwarding route?
Longest-prefix routing selects the more-specific blackhole instead of the healthy learned aggregate. Correct the actual match in the associated TGW route table.
The observed problem is a more-specific route drop, not tunnel authentication.
DNS settings cannot override a matching TGW blackhole route.
Another transport path cannot forward traffic matched by the existing blackhole entry.
An enterprise changed an on-premises router image and now some Direct Connect advertised prefixes periodically disappear.
Which observation would most directly demonstrate the required network outcome?
Monitoring shows stable established BGP sessions and consistent intended prefix reachability throughout an observation window. That is relevant because direct Connect private routing depends on stable BGP advertisements and allowed prefix policy in addition to the physical cross-connect.
This would validate hybrid route summarization and overlap response. The case instead needs evidence for direct connect bgp session health maintenance: Monitoring shows stable established BGP sessions and consistent intended prefix reachability throughout an observation window.
This would validate transit gateway route propagation drift. The case instead needs evidence for direct connect bgp session health maintenance: Monitoring shows stable established BGP sessions and consistent intended prefix reachability throughout an observation window.
This would validate aws gateway route-priority and static-route validation. The case instead needs evidence for direct connect bgp session health maintenance: Monitoring shows stable established BGP sessions and consistent intended prefix reachability throughout an observation window.
A custom TLS service behind an NLB requires the backend application itself to terminate and validate each end-to-end client TLS session. The team proposes an NLB TLS listener that terminates TLS at the load balancer. What should be configured instead to preserve backend termination?
TCP passthrough preserves the client-to-target TLS handshake, whereas a TLS listener terminates the incoming session at the load balancer.
TLS listeners terminate the client-side connection and change the trust boundary.
That abandons the required application-level TLS termination.
DNS health monitoring does not provide the backend’s cryptographic client session.
The central network account shared a Transit Gateway but another account's VPC attachment is pending and unable to pass traffic.
Which observation would most directly demonstrate the required network outcome?
The consumer attachment is accepted and available, its routes are permitted, and the source VPC can reach only approved prefixes. That is relevant because resource sharing and attachment authorization are separate from route-table configuration; each stage must be complete before transit is usable.
This would validate nat gateway route and az resilience. The case instead needs evidence for aws ram share and attachment acceptance: The consumer attachment is accepted and available, its routes are permitted, and the source VPC can reach only approved prefixes.
This would validate transit gateway cross-region static routing. The case instead needs evidence for aws ram share and attachment acceptance: The consumer attachment is accepted and available, its routes are permitted, and the source VPC can reach only approved prefixes.
This would validate interface vpc endpoint privatelink consumer configuration. The case instead needs evidence for aws ram share and attachment acceptance: The consumer attachment is accepted and available, its routes are permitted, and the source VPC can reach only approved prefixes.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
