You save $69.98
A company has a public CloudFront distribution serving private S3 documents. Auditors found users can bypass CloudFront and fetch objects from S3 endpoints, avoiding the edge access rules. What closes this bypass without disabling CloudFront?
Origin Access Control permits CloudFront to sign S3 requests while the bucket policy denies direct unauthorized reads.
HTTPS protects transport but public S3 reads still evade CloudFront controls.
DNS placement does not change S3 object authorization.
An ALB rule does not constrain access to the S3 origin.
The datacenter's corporate DNS server can reach a private application over Direct Connect but cannot resolve its AWS private hosted-zone name. The team created only the private zone and no Route 53 Resolver inbound endpoint for on-premises queries. What hybrid DNS assumption caused this?
The private hosted zone does not accept on-premises DNS traffic without a reachable Route 53 Resolver inbound endpoint and correct forwarding setup.
Outbound Resolver rules forward matching VPC DNS queries through configured endpoints to designated corporate name servers. That explains the separate route 53 resolver outbound endpoint and rules issue, not this demonstrated route 53 resolver inbound endpoint for hybrid dns failure.
This is a risk in route 53 weighted failover and health checks: Route 53 routing policies choose eligible DNS record answers according to their weights or failover order, while health checks exclude records marked unhealthy. It does not account for the route 53 resolver inbound endpoint for hybrid dns fault stated in this incident.
That outcome depends on route 53 alias record for load balancer, whose mechanism is different: Route 53 alias records can target AWS resources while meeting zone-apex DNS constraints and tracking appropriate service target naming. The reported defect concerns route 53 resolver inbound endpoint for hybrid dns.
Two teams import one shared CDK network construct, but it introduces a permissive security-group ingress rule. There is no construct validation or change review, and the next pipeline deploy will apply it to dozens of accounts at once. What automation blast radius is the main concern?
A shared unvalidated construct spreads one permissive rule into every consuming deployment, multiplying the blast radius of a single code defect.
This is a risk in multi-account network automation role boundaries: STS role assumption grants temporary credentials limited by role trust and permissions, separating pipeline identity from persistent account-level root access. It does not account for the aws cdk secure network constructs fault stated in this incident.
That outcome depends on aws config network compliance conformance, whose mechanism is different: AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts. The reported defect concerns aws cdk secure network constructs.
EventBridge can route management events to automation targets while CloudTrail records the underlying API activity and IAM restricts what automation may alter. That explains the separate eventbridge-driven network remediation issue, not this demonstrated aws cdk secure network constructs failure.
A company wants its VPC Resolver DNS Firewall to block a high-risk hostname and respond with NXDOMAIN so client software treats it as an unknown domain. The existing block rule uses the NODATA response mode. What should be changed?
The Block action supports configured response semantics; NXDOMAIN indicates that the queried domain does not exist.
Alert permits resolution instead of enforcing the requested denial.
External DNS changes do not control the VPC DNS Firewall block response.
Network egress routing does not set DNS Firewall response codes.
An ALB marks every new container target unhealthy although users can connect directly to the application on port 8080. The target-group health check is still probing /health on port 80, which the containers do not listen on. What should be changed?
ALB health checks must reach a port and path where the target answers with an expected healthy response.
DNS caching cannot make an incorrect target-group probe succeed.
An Application Load Balancer does not use UDP listeners to test HTTP targets.
Appliance mode affects routed flow symmetry and is unrelated to the ALB probe misconfiguration.
After a branch router upgrade, its Direct Connect private VIF BGP session repeatedly resets while the physical circuit stays UP. Thousands of new /32s were advertised and the customer router logs a maximum-prefix breach. Which response addresses the routing cause?
A configured prefix limit can reset an otherwise healthy BGP peer when the advertised count exceeds the accepted threshold.
Compute quota is unrelated to a peer's received-prefix policy.
Physical link state and BGP session health are separate.
DNS delegation does not control BGP prefix-limit policy.
A data center migration requires dedicated fiber-based connectivity while maintaining an independent backup path during link maintenance.
Which AWS networking configuration best addresses this specific requirement?
Direct Connect provides a dedicated physical network path for AWS resources, while its private VIF and gateway controls determine private VPC reachability. The proposed change can be checked by whether two independent path tests demonstrate private prefix reachability and routing continuity when the primary Direct Connect circuit is disabled.
This configuration addresses transit vif for multiple transit gateways, not the direct connect private connectivity and redundancy requirement. Transit VIFs connect a Direct Connect gateway to associated Transit Gateways, distinct from private VIF designs that access virtual private gateways.
This configuration addresses hybrid cidr overlap prevention, not the direct connect private connectivity and redundancy requirement. Routing uses destination prefixes to choose paths; overlapping address spaces make private packets ambiguous without deliberate isolation or translation.
This configuration addresses ipsec encryption over direct connect, not the direct connect private connectivity and redundancy requirement. Direct Connect provides a dedicated transport path but does not inherently encrypt all payloads, so confidentiality must be provided separately when policy requires it.
A broad EventBridge rule triggers a Lambda function after every security-group management change. The function deletes all inbound rules, including specifically approved private database ports, without checking the change against policy. What is the direct operational risk?
Event-driven remediation must target the actual unauthorized change with an allowlist, scoped IAM permissions and evidence of the original rule, not indiscriminate deletion.
No automatic rollback is implied by a broad EventBridge event or Lambda invocation.
Security-group management does not configure hybrid BGP route prefixes.
Changing security-group rules cannot change the underlying network interface or NAT gateway type.
A Site-to-Site VPN requires a scheduled pre-shared key rotation after a supplier offboarding. The operations team updates the AWS tunnel option, but the customer router still uses the previous key and the next IKE rekey fails. What change is missing?
Both peers need compatible authentication material; changing only one side breaks the tunnel during negotiation or rekey.
DNS cache behavior does not reconcile peer authentication secrets.
Endpoint authorization cannot replace a VPN tunnel’s negotiated PSK.
Application logging retention does not repair mismatched IKE credentials.
A Route 53 public hosted zone has query logging enabled. Its CloudWatch log group shows far fewer queries than the website receives from repeat customers. A recursive resolver’s cache hit ratio is high. Why do the counts differ?
A resolver can answer many clients from its cached record during the TTL without generating a new authoritative query.
Authoritative DNS logs are not web request access logs.
Public authoritative DNS query logging does not depend on the website VPC flow log configuration.
The high resolver cache hit ratio already explains low authoritative query volume.
A platform team must allow selected organization accounts to join a hub network while requiring resource-owner attachment governance.
Which technical explanation best accounts for the network behavior described?
Resource sharing and attachment authorization are separate from route-table configuration; each stage must be complete before transit is usable. A direct check is to share the eligible Transit Gateway through AWS RAM, process required resource-owner acceptance and finish controlled association/propagation and observe the corresponding path.
Transit Gateway forwards packets based on the attachment's associated route table, while propagation adds routes to selected tables rather than all tables. That is a valid account of transit gateway association and propagation tables, but it does not explain the aws ram share and attachment acceptance behavior in the scenario.
PrivateLink interface endpoints expose private ENI addresses to approved service consumers; DNS and endpoint security policies determine usable connectivity. That is a valid account of interface vpc endpoint privatelink consumer configuration, but it does not explain the aws ram share and attachment acceptance behavior in the scenario.
Transit Gateway inter-Region peering does not automatically propagate remote attachment prefixes; route-table entries identify the peering path. That is a valid account of transit gateway cross-region static routing, but it does not explain the aws ram share and attachment acceptance behavior in the scenario.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
