You save $69.98
An enterprise has 60 VPCs across accounts and cannot maintain an expanding full mesh of pairwise VPC peering links.
Which technical explanation best accounts for the network behavior described?
Transit Gateway can route between VPC attachments according to association and propagation rules, unlike non-transitive VPC peering. A direct check is to design a regional Transit Gateway hub-and-spoke topology, with separated route tables and controlled cross-account attachments and observe the corresponding path.
Private hosted zones and Resolver rules can make selected internal names resolvable in associated VPCs without implying blanket network reachability. That is a valid account of hybrid multi-account dns boundary, but it does not explain the transit gateway hub and spoke versus peering mesh behavior in the scenario.
Transit Gateway peering joins separate regional gateway routing domains, and the peering attachment does not automatically propagate all remote routes. That is a valid account of cross-region transit gateway peering, but it does not explain the transit gateway hub and spoke versus peering mesh behavior in the scenario.
Central egress uses attachment routes and stateful appliances to inspect traffic on both directions before leaving through approved egress points. That is a valid account of multi-account egress inspection design, but it does not explain the transit gateway hub and spoke versus peering mesh behavior in the scenario.
A security VPC sends outbound traffic through AWS Network Firewall. A stateful deny rule for a prohibited TLS hostname was deployed. Which specific evidence shows that this rule, rather than a security group, caused the connection block?
The inspected flow, rule identifier and actual route path tie the denial to the requested stateful firewall policy.
A VPC-level reject does not identify which Network Firewall stateful rule caused the failure.
Configured policy alone does not show that production packets reached the rule.
Success on an unrelated path does not validate the specified TLS hostname deny rule.
A business-critical public application already has AWS Shield Standard. Its owner needs the additional supported protection features and DDoS response coordination offered by Shield Advanced. Which upgrade meets that request?
Shield Advanced adds managed DDoS protections and response options beyond the automatic baseline Shield Standard capabilities.
DNS ownership records do not provide volumetric DDoS mitigation or managed response.
Security groups cannot provide the requested managed protection tier.
Connection timing cannot supply additional DDoS protection features.
Two VPCs within the same Region exchange large volumes of private data. Their network design currently routes all traffic through a Transit Gateway; there is a small stable pair of VPCs and no transitive segmentation requirement for this path. The team wants to compare data-processing costs. What alternative deserves evaluation?
A simple pairwise connection may avoid transit data-processing charges when the architecture does not need hub-and-spoke routing.
Public egress would add cost and complexity to a private regional connection.
Additional attachments do not remove transit data-processing of the same traffic.
DNS caching affects lookups, not private data-transfer billing paths.
A supplier needs TCP access to one NLB-backed private service. Instead of offering a PrivateLink endpoint service, the network team adds full VPC peering and routes the supplier's VPC CIDR toward production and management subnets. Security groups still restrict individual ports, but the supplier now has IP-level paths beyond the service. What is the direct least-privilege exposure?
VPC peering and explicit routes can make broader subnets routable, whereas a PrivateLink endpoint service exposes the designated service rather than a general routed path. SG rules may still restrict access, so this is increased exposure, not guaranteed compromise.
VPC peering does not disable SG enforcement or automatically authorize every port; the risk is broader route exposure subject to controls.
Peering routes operate on network prefixes and do not impose a single-service ARN boundary.
VPC peering is not transitive; the concrete exposure is expanded direct routed reachability to the explicitly routed internal subnets.
A company writes public DNS records inside a new Route 53 hosted zone for its existing registered domain but leaves the registrar's NS delegation pointed at the retired DNS provider. External resolvers never ask Route 53 for those records. Which failure stems from publishing inside an undelegated zone?
Until the parent zone delegates to the Route 53 assigned name servers, external resolvers continue querying the old authority and never see the new records.
That outcome depends on route 53 resolver outbound endpoint and rules, whose mechanism is different: Outbound Resolver rules forward matching VPC DNS queries through configured endpoints to designated corporate name servers. The reported defect concerns route 53 public hosted zone delegation.
Route 53 alias records can target AWS resources while meeting zone-apex DNS constraints and tracking appropriate service target naming. That explains the separate route 53 alias record for load balancer issue, not this demonstrated route 53 public hosted zone delegation failure.
That outcome depends on route 53 weighted failover and health checks, whose mechanism is different: Route 53 routing policies choose eligible DNS record answers according to their weights or failover order, while health checks exclude records marked unhealthy. The reported defect concerns route 53 public hosted zone delegation.
Security wants to know which VPC workloads queried a known malicious domain without exposing every DNS payload to public tools.
Which technical explanation best accounts for the network behavior described?
Resolver query logs provide DNS request observations for associated VPC resolution paths, distinct from network-flow and API change logs. A direct check is to enable Route 53 Resolver query logging for the appropriate VPCs and send protected records to an approved analysis destination and observe the corresponding path.
Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches. That is a valid account of network firewall flow and alert log delivery, but it does not explain the route 53 resolver query logging security visibility behavior in the scenario.
Flow logs emit metadata such as IP addresses, ports, bytes and ACCEPT/REJECT action for supported network flows, not raw packet bodies. That is a valid account of vpc flow logs for security investigations, but it does not explain the route 53 resolver query logging security visibility behavior in the scenario.
CloudWatch alarms evaluate metric periods and thresholds while EventBridge and notification integrations can dispatch timely security response signals. That is a valid account of cloudwatch alarm and security response integration, but it does not explain the route 53 resolver query logging security visibility behavior in the scenario.
A shared-services transit gateway shows a rising count of packets-lost-blackhole after an attachment route update. No-route loss counters remain flat. Which monitoring conclusion best reflects those specific metrics?
A blackhole route loss counter points to an explicit discard rather than a missing matching route.
A separate no-route loss counter would more directly indicate absent route entries.
A gateway routing discard happens below TLS certificate validation.
Transit blackhole loss is a routing control, not a security-group reject verdict.
A network engineer has approved a dedicated Direct Connect port and received a letter of authorization but has not completed the colocation cross-connect.
Which observation would most directly demonstrate the required network outcome?
Connection, VIF and BGP state report healthy and an approved on-premises prefix reaches the intended private VPC target bidirectionally. That is relevant because direct Connect connectivity depends on the physical handoff and correct virtual-interface BGP parameters; a physical optical link alone does not establish routed VPC access.
This would validate direct connect failover to vpn route selection. The case instead needs evidence for direct connect physical provisioning and bgp bring-up: Connection, VIF and BGP state report healthy and an approved on-premises prefix reaches the intended private VPC target bidirectionally.
This validates the backup VPN, not the planned Direct Connect optical handoff or its own BGP session. It is not proof that the unfinished Direct Connect port works.
Paperwork and a configured VIF cannot replace the physical cross-connect. DOWN link state proves the Direct Connect circuit has not been brought up.
An uneven application target fleet has all healthy targets in one Availability Zone but client connections enter multiple zones.
Which technical explanation best accounts for the network behavior described?
Cross-zone choices determine whether load balancer nodes can distribute traffic to healthy targets beyond the node's own zone, subject to product-specific defaults. A direct check is to review supported cross-zone load balancing settings and target registration across Availability Zones, then test traffic with the intended configuration and observe the corresponding path.
A target group's health-check configuration determines which registered backends receive normal traffic, independent of instance-level health alone. That is a valid account of load balancer health check dependencies, but it does not explain the cross-zone load balancing and target distribution behavior in the scenario.
Gateway Load Balancer uses a network-transparent appliance insertion pattern with GENEVE encapsulation and target health management. That is a valid account of gateway load balancer inline inspection, but it does not explain the cross-zone load balancing and target distribution behavior in the scenario.
Network Load Balancer operates primarily at layer four and can expose stable per-zone IP addresses while forwarding TCP or UDP connections to targets. That is a valid account of nlb static ip and tcp passthrough, but it does not explain the cross-zone load balancing and target distribution behavior in the scenario.
A company has a public CloudFront distribution serving private S3 documents. Auditors found users can bypass CloudFront and fetch objects from S3 endpoints, avoiding the edge access rules. What closes this bypass without disabling CloudFront?
Origin Access Control permits CloudFront to sign S3 requests while the bucket policy denies direct unauthorized reads.
HTTPS protects transport but public S3 reads still evade CloudFront controls.
DNS placement does not change S3 object authorization.
An ALB rule does not constrain access to the S3 origin.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
