You save $69.98
A packet capture is needed to compare TCP sequence numbers and retransmission timing for a supported EC2 ENI. Default VPC Flow Logs show only aggregates. Security authorizes a narrowly scoped out-of-band capture to a protected sensor. Which feature produces the required packet evidence?
Traffic Mirroring replicates eligible ENI packets to a monitoring destination, so analysts can inspect timing and sequence behavior while bounding sensitive capture scope with filters.
Longer retention preserves existing aggregate fields but does not convert flow logs into a packet-capture stream with ordered TCP segments and retransmission details.
CloudTrail records supported AWS management activity and cannot reconstruct per-packet TCP sequence timing for an application already running inside an ENI.
AWS Config evaluates resource configurations rather than capturing transport-layer packet contents. It does not satisfy a specific out-of-band network forensic capture requirement.
A public application receives bursts of 300 HTTP login attempts per minute from individual source IPs. The security team wants to throttle only the /login path while allowing normal /health and static asset requests. Which AWS security rule best matches this layer-seven condition?
AWS WAF rate-based rules count matching HTTP requests over a configured window. A scope-down condition can focus the rate limit on /login without penalizing unrelated site paths.
NACLs evaluate packet addresses and ports, not the HTTP URL path or a client-specific web request threshold. Broad network denial would affect unrelated application requests.
BGP prefix quotas govern route advertisement rather than HTTP login attempt rates. Changing Direct Connect controls cannot enforce per-client application-layer request limits.
CloudFront origin failover handles selected origin errors; it does not classify high-rate login requests or apply the requested scoped abuse mitigation.
A database subnet NACL permits outbound TCP traffic to a remote approved application, but it denies ephemeral inbound reply ports. The EC2 database security group is stateful and correctly allows the application flow. What most directly explains intermittent failures on return traffic?
A subnet NACL evaluates both directions independently and does not remember an established flow. Missing ephemeral reply permissions can drop packets even when the resource security group permits the session.
Security groups are stateful and generally permit established return traffic automatically. This particular denial occurs at the separate stateless subnet filter, not the resource interface state.
DNS zone association selects name-resolution answers and has no mechanism to block established TCP return packets purely because a private namespace exists.
CloudFront is a content-delivery service, and NACLs legitimately filter IP traffic. Replacing the network path would not address the explicit missing stateless return rule.
The networking account owns a Route 53 private hosted zone for shared.internal. A workload VPC in another account must resolve the zone, but its VPC is not associated and no public records are allowed. Which cross-account step is required?
Cross-account private hosted zone use needs explicit authorization by the owner and a VPC association in the consumer account. Routing connectivity alone does not imply DNS visibility.
Public NS delegation would expose or misrepresent an intentionally internal namespace and does not perform a VPC association. Private hosted zones are scoped by associated VPCs.
A transit attachment affects IP routing, not which private DNS hosted zones a VPC Resolver can answer. The stated issue is absent zone association.
Organizational membership can enable governance and sharing workflows but does not silently associate every private hosted zone to all member VPCs. The explicit authorization remains necessary.
Two Direct Connect private VIFs carry the same on-premises CIDR toward an AWS Region. After a router maintenance window, network engineers see a different outbound path even though both BGP sessions are Established. The company intends active/passive behavior. What evidence should guide the next correction?
For Direct Connect private routing, longest prefix, AWS route preference communities, and AS_PATH can influence the selected path after a BGP session is up. Comparing these attributes addresses unexpected active/passive choice instead of assuming peering health guarantees path preference.
ALB health checks determine which application targets receive traffic after packets arrive. The reported discrepancy occurs in the hybrid route chosen between two VIFs, before target health is relevant.
CloudFront cache policy might affect page performance but does not participate in Direct Connect BGP best-path selection for a private hybrid CIDR. It cannot explain why two established VIFs choose a different network path.
Taking down both sessions removes the available private connectivity; AWS does not simply replace their route exchange with equivalent internet advertisements. That would worsen availability and obscure the intended policy difference.
A forensic team captures packet copies from EC2 ENIs using VPC Traffic Mirroring. A proposed design delivers all payloads to an unrestricted third-party internet host and keeps them forever. Which review finding should block this proposal?
Mirrored packets can reveal regulated content, and broad unmanaged export is not equivalent to low-detail flow logging.
Traffic Mirroring can provide packet-level contents, not only domain summaries.
Monitoring endpoints can expose data if they are not properly restricted.
Network security groups do not govern downstream packet archive lifecycle.
A domain has Route 53 DNSSEC signing enabled. After an emergency key replacement, validating resolvers return SERVFAIL while nonvalidating resolvers can fetch the A record. The registrar still publishes a DS value for the old key. What corrects the broken trust chain?
A stale parent DS can point to key material that no longer signs the zone; validators reject that broken chain. Correcting parent delegation trust material restores verifiable signatures.
A record TTL controls caching of address data, not cryptographic consistency between parent DS and child DNSKEY and RRSIG records. Cache changes cannot repair the trust chain.
Weighted DNS determines which eligible response may be returned, but validating resolvers still enforce DNSSEC authenticity. It does not bypass a mismatched DS for a signed delegation.
Removing child signatures while preserving a parent DS that asserts a secure delegation leaves validators expecting a valid chain. It worsens rather than fixes authentication failure.
AWS is performing routine maintenance on one of a company’s two Site-to-Site VPN tunnels. Both BGP peers are configured, but the customer gateway sets a permanent higher local preference for the tunnel being maintained, overriding AWS MED guidance. What should be corrected for intended maintenance failover?
AWS can advertise a lower MED on the alternate tunnel during endpoint updates. Higher-priority customer local preference must not countermand that choice if maintenance failover is expected.
Increasing preference toward the affected tunnel strengthens the existing wrong path choice and can leave traffic directed at a tunnel that is temporarily unavailable.
CloudFront path behaviors route HTTP requests to origins. They cannot influence customer gateway BGP local preference or choose the surviving IPsec tunnel.
An ALB handles web application traffic, not the IPsec tunnel BGP routing policy on the customer gateway device. It would not address the route preference.
A Route 53 public hosted zone has DNSSEC signing enabled, but validating public resolvers fail authenticity checks after the domain registrar's DS record was replaced with a stale DS value that no longer matches the active key-signing key. The DNS records and name servers are otherwise reachable. What should the administrator restore?
DNSSEC validation relies on the delegation chain from the parent zone to the signed child. An incorrect DS record prevents validating resolvers from authenticating the signed zone despite normal DNS server reachability.
Security groups govern instance and interface packet flow, but the user reports a signed public-zone chain-of-trust failure, not blocked network traffic to an application in a VPC.
Resolver outbound endpoints forward private VPC DNS questions to external resolvers. They are unrelated to the public parent-zone DNSSEC DS record used by validating internet resolvers.
ALB TLS certificates identify HTTPS endpoints, which is a separate protocol from DNSSEC record signing. A self-signed application certificate would not fix the registrar's DNSSEC delegation chain.
A research laboratory operates a dedicated Direct Connect connection and needs assurance that planned maintenance of its main BGP session will move private routing to its second independent link. Operators want an AWS-supported controlled failure exercise. Which service feature should they use?
The Direct Connect Resiliency Toolkit supports a controlled BGP failover test that validates routing through a redundant connection. It tests the stated failure while preserving designed connectivity.
CloudFront invalidation purges cached web content and cannot withdraw a Direct Connect BGP session or demonstrate alternate private VIF reachability during router maintenance.
Stopping workloads tests application availability and compute resilience, not hybrid route failover; it may cause outage without exercising the intended BGP path transition.
Deleting the gateway would disrupt the routing architecture rather than simulate one path failure. It also risks losing the configuration needed for a valid recovery exercise.
A CloudFormation change set for a production network stack proposes replacing an existing NAT gateway as well as adding a new private subnet route. The change request authorized only the route. What should the engineer do before executing?
Change sets expose proposed resource replacement before execution. An unauthorized NAT replacement is a material network change, so the template should be corrected and regenerated before production.
CloudFormation can replace resources when property changes require it, potentially changing network behavior. It does not guarantee a service-transparent swap of a NAT gateway.
Flow Logs provide network traffic metadata, not an approval gate that blocks infrastructure replacement. The disclosed replacement must be addressed in the planned CloudFormation update.
DNS alias routing does not provide a way to preserve or refer to a NAT gateway replacement in a VPC private subnet route table.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
