You save $69.98
A proprietary TCP backend behind a Network Load Balancer uses IP-type target registration. The security team discovers the backend sees NLB node IPs instead of real client addresses. Targets are reachable in the supported same-VPC topology. Which change can restore source address visibility without changing the application protocol?
For TCP/TLS IP-type targets the preservation attribute can retain source addresses when networking conditions permit.
An HTTP-layer ALB is not a drop-in protocol-transparent replacement for this binary TCP listener.
DNS name mapping does not restore source addresses observed at the target.
Timeout controls do not provide client IP preservation.
A private-content distribution requires HTTPS from viewers to CloudFront and must prevent plaintext origin requests to a custom origin.
Which AWS networking configuration best addresses this specific requirement?
CloudFront has separate viewer-to-edge and edge-to-origin transport settings; encrypting one segment does not automatically encrypt both. The proposed change can be checked by whether tLS tests show valid HTTPS from browsers and encrypted origin fetches without an unexpected HTTP fallback.
This configuration addresses acm private ca internal mutual trust, not the cloudfront https viewer and origin settings requirement. ACM Private CA issues private certificates under an organization-controlled certificate hierarchy, distinct from public ACM trust issuance.
This configuration addresses route 53 dnssec chain-of-trust protection, not the cloudfront https viewer and origin settings requirement. DNSSEC uses cryptographic signatures and a parent-child chain of trust so validating resolvers can detect altered DNS records.
This configuration addresses alb acm certificate managed tls, not the cloudfront https viewer and origin settings requirement. ALB TLS listeners can terminate client connections using certificates stored in ACM, separating public certificate lifecycle from backend instance provisioning.
An internal EC2-to-database connection is failing after a subnet route change. The architecture review board wants a configuration-based path analysis that does not send production packets or require the database process to be running. What tool best meets the request?
The analyzer models supported AWS network configuration and identifies path blockers without transmitting live application traffic.
A stress test violates the explicit no-production-packets constraint.
Mirroring collects observed packets; it cannot model a nonexistent connection from configuration alone.
DNS alias data is insufficient to model the specified private network path.
A central DNS VPC has an outbound Resolver rule for corp.internal targeting a datacenter server. The datacenter server forwards the same suffix back to an inbound Resolver endpoint in that same VPC. Intermittent SERVFAIL and looping queries appear. What design fault should be removed?
Both resolvers forward the same query to each other instead of reaching an authoritative answer.
Priorities cannot fix a resolver loop if both systems keep forwarding reciprocally.
More endpoints on the same cycle do not provide authority for the suffix.
Edge HTTP error caching does not repair DNS recursion.
Network Manager's topology view shows two healthy Transit Gateways connected by peering, but private traffic between attached VPCs still fails. An operator assumes the connected topology line proves packets can traverse the link. Which assumption is incorrect?
The map describes relationships and operational visibility; actual forwarding depends on attachment associations and route-table contents.
Viewing topology does not change route tables.
Transport attachment state does not evaluate application interface security policy.
Connection health cannot establish per-prefix reachability.
A security-conscious network team needs separate Transit Gateway route tables to isolate production VPCs from lab accounts.
Which technical explanation best accounts for the network behavior described?
Transit Gateway forwards packets based on the attachment's associated route table, while propagation adds routes to selected tables rather than all tables. A direct check is to configure Transit Gateway route-table associations, propagations and appropriate VPC subnet routes for explicitly permitted attachments and observe the corresponding path.
A public NAT gateway translates outbound private IPv4 flows using public subnet connectivity but does not make private instances directly internet-addressable. That is a valid account of nat gateway route and az resilience, but it does not explain the transit gateway association and propagation tables behavior in the scenario.
PrivateLink interface endpoints expose private ENI addresses to approved service consumers; DNS and endpoint security policies determine usable connectivity. That is a valid account of interface vpc endpoint privatelink consumer configuration, but it does not explain the transit gateway association and propagation tables behavior in the scenario.
VPC peering has no transitive routing and requires both VPCs to route toward the peering connection for successful bidirectional traffic. That is a valid account of vpc peering bilateral route update, but it does not explain the transit gateway association and propagation tables behavior in the scenario.
A CloudFront distribution requires HTTPS from viewers, but its custom-origin protocol policy remains HTTP-only. User sessions arrive encrypted at the edge and then traverse the edge-to-origin leg in plaintext. What gap remains in the confidentiality design?
CloudFront viewer HTTPS does not automatically encrypt a custom-origin HTTP leg; the origin protocol policy must independently enforce TLS.
ALB TLS listeners can terminate client connections using certificates stored in ACM, separating public certificate lifecycle from backend instance provisioning. That explains the separate alb acm certificate managed tls issue, not this demonstrated cloudfront https viewer and origin settings failure.
This is a risk in vpn encryption over direct connect: Direct Connect is a dedicated network connection but does not universally encrypt payloads; IPsec or TLS adds cryptographic confidentiality when configured. It does not account for the cloudfront https viewer and origin settings fault stated in this incident.
DNSSEC uses cryptographic signatures and a parent-child chain of trust so validating resolvers can detect altered DNS records. That explains the separate route 53 dnssec chain-of-trust protection issue, not this demonstrated cloudfront https viewer and origin settings failure.
A non-HTTP multiplayer TCP service runs behind healthy NLB endpoints in two AWS Regions. Clients require two stable GLOBAL anycast ingress IPs that remain unchanged as traffic moves between Regions. Regional IP allowlists and DNS TTL-based failover are not sufficient. Which service architecture meets the ingress requirement?
Global Accelerator supplies stable global anycast ingress addresses and health-directed routing across supported regional application endpoints without relying on clients refreshing regional DNS answers.
Regional NLB addresses are stable within their own entry paths but do not satisfy the two unchanged global anycast addresses.
DNS resolution can be cached by clients and resolvers, so DNS failover does not provide the specified fixed global ingress IPs.
CloudFront caching is not a transparent global anycast load-balancing replacement for an arbitrary long-lived raw TCP protocol.
An internet-facing API is covered by AWS Shield Standard, yet its login path receives a flood of syntactically valid HTTPS POST requests from many distributed clients. Why is an additional application-aware control needed?
Volumetric network protection and application-specific rate or behavior rules address distinct layers of abuse.
BGP control-plane state is unrelated to HTTP login abuse classification.
Private DNS zones cannot enforce request-aware WAF rules on an internet endpoint.
Backend health is not a per-client login rate limit.
An HPC cluster has EFA network interfaces on each node, but MPI collective operations remain as slow as ordinary TCP. The application might be using the sockets provider rather than an EFA-capable libfabric provider. Which evidence actually proves the intended EFA dataplane was selected?
EFA interface attachment alone does not force an application's MPI transport selection. Actual provider usage and an inter-node benchmark test the intended behavior.
Hardware capability is not proof that the application selected EFA transport.
Ordinary IP reachability and placement do not demonstrate OS-bypass EFA communication.
Storage transfer throughput does not show that MPI uses EFA for inter-node messages.
A security team uses VPC Flow Logs as audit evidence. For an interval containing heavy network traffic, some log records have status SKIPDATA. What does this mean for conclusions about missing flows?
SKIPDATA indicates incomplete log capture for that period under supported VPC Flow Logs collection limitations.
Record-delivery status does not describe the allow/deny decision for every flow.
TLS encryption is not the reason for the published collection status.
DNS records cannot replace absent VPC flow telemetry.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
