You save $69.98
A VPC added a secondary CIDR for container growth. A newly connected on-premises campus already uses a subnet overlapping that secondary CIDR. Some return traffic is delivered to the VPC local route instead of the campus path. What operational issue must be handled?
Identical or overlapping private prefixes cannot be reliably distinguished by normal destination-based route lookup.
More copies of an ambiguous route do not create unique destinations.
CDN caching does not reconcile private IP address collisions.
HTTP redirects do not restore the underlying IP addressing plan.
A public application has active endpoints in two AWS Regions. Users in Africa currently route to the more distant US endpoint due to a simple record set, even though the Europe endpoint has lower measured network latency and is healthy. Which Route 53 routing policy best matches automatic region-appropriate DNS answers?
Latency routing selects a configured region based on measured network performance to Route 53’s regional infrastructure, subject to record health.
A fixed answer cannot dynamically select a lower-latency eligible Region.
Zero weights do not express performance-based routing preference.
A private zone is not authoritative to global public recursive resolvers.
An ALB hosts a public web API. Security must rate-limit POST /login per actual client behind a trusted reverse proxy while leaving static GET assets unaffected. Which AWS WAF design is appropriate?
The rule must select login requests and count by the approved client-identity field rather than the shared proxy address.
That merges many users into one source and does not enforce the intended per-client rate.
Security groups do not classify HTTP method, path or client request rate.
Redirects do not implement rate aggregation and client-based abuse controls.
An incident responder needs a tamper-resistant year-long store of network configuration changes and flow records. A team proposes putting all logs in a mutable S3 bucket accessible to every workload admin. Which governance architecture reduces the risk?
Long-lived audit evidence needs protection from routine workload administrators who could otherwise delete or alter stored records.
Unrestricted deletion violates the year-long evidence requirement.
A screenshot cannot replace continuous audit and traffic records.
Public DNS is not an authenticated, confidential, durable network evidence archive.
A privately hosted billing service has low-latency DNS records in two Regions. A VPC uses Route 53 Resolver outbound forwarding into a separate VPC’s inbound endpoint, where the private zone is associated. Which location determines the private zone’s latency routing choice?
The associated private Resolver processes the forwarded query based on its VPC Region rather than the originating outbound endpoint.
This private hosted-zone latency decision uses the Resolver location, not the external browser city.
Registrar location is unrelated to latency policy selection in the private zone.
CloudFront cache topology does not determine private hosted-zone answer selection.
A TGW attachment was moved from Route Table A to Route Table B for a segmentation change. A VPN prefix is still propagated into Table A, but the new Table B does not contain that prefix. Why do flows originating on the moved attachment fail?
Attachment association controls the effective source-side routing table; propagation into another table does not make those routes globally usable.
TGW tables are not globally merged for a source attachment.
A route-table association change does not require a regional restart.
DNS does not select the TGW source attachment's associated route table.
A software vendor needs to offer a private TCP endpoint to dozens of consumer VPCs while avoiding a fully routed network mesh.
Which technical explanation best accounts for the network behavior described?
AWS PrivateLink offers a private service endpoint across VPC boundaries without granting general layer-three routing to the provider network. A direct check is to design a VPC endpoint service backed by a Network Load Balancer and require approved consumers to use interface endpoints and observe the corresponding path.
AWS RAM shares eligible resource associations across accounts while resource-owner routing policy and each consumer's VPC routes remain separate responsibilities. That is a valid account of aws ram controlled networking resource share, but it does not explain the privatelink service-consumer pattern behavior in the scenario.
Private hosted zones and Resolver rules can make selected internal names resolvable in associated VPCs without implying blanket network reachability. That is a valid account of hybrid multi-account dns boundary, but it does not explain the privatelink service-consumer pattern behavior in the scenario.
Transit Gateway can route between VPC attachments according to association and propagation rules, unlike non-transitive VPC peering. That is a valid account of transit gateway hub and spoke versus peering mesh, but it does not explain the privatelink service-consumer pattern behavior in the scenario.
Two VPCs have an active peering connection but EC2 hosts cannot exchange private traffic.
Which AWS networking configuration best addresses this specific requirement?
VPC peering has no transitive routing and requires both VPCs to route toward the peering connection for successful bidirectional traffic. The proposed change can be checked by whether network probes succeed both ways across the peering link and routing tables contain the correct peer CIDRs without unintended third-party access.
This configuration addresses transit gateway cross-region static routing, not the vpc peering bilateral route update requirement. Transit Gateway inter-Region peering does not automatically propagate remote attachment prefixes; route-table entries identify the peering path.
This configuration addresses nat gateway route and az resilience, not the vpc peering bilateral route update requirement. A public NAT gateway translates outbound private IPv4 flows using public subnet connectivity but does not make private instances directly internet-addressable.
This configuration addresses interface vpc endpoint privatelink consumer configuration, not the vpc peering bilateral route update requirement. PrivateLink interface endpoints expose private ENI addresses to approved service consumers; DNS and endpoint security policies determine usable connectivity.
A VPC Traffic Mirroring source is correctly configured, but packet sensors see no mirrored data. The target subnet's custom network ACL drops the VXLAN encapsulation transport used by the capture target. Which evidence identifies the capture-path fault?
A functioning mirror source is insufficient if the encapsulated copied packets cannot reach the target.
Source flow status does not demonstrate successful mirrored packet delivery.
Disk capacity is independent of network transport to the packet collector.
The mirror copy uses an additional network path and encapsulation that must be permitted.
A partner firewall allowlists one static address of a Network Load Balancer enabled in two Availability Zones. The service uses a separate NLB address in each zone, and the partner sometimes resolves the second address. What acceptance test validates its complete static-IP integration?
NLB provides zone-specific entry addresses. Verifying only one address can miss the partner's restriction on the other.
A partial DNS result cannot show the partner can reach every advertised zonal address.
Outbound EC2 access does not validate external inbound partner allowlisting.
Target health cannot prove the external firewall permits the additional NLB entry address.
A compliance team wants immutable change evidence and alerts when internet-facing network exposure violates an approved baseline.
Which technical explanation best accounts for the network behavior described?
AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts. A direct check is to deploy AWS Config recording and appropriate managed or custom network compliance rules with aggregation where required and observe the corresponding path.
Declarative infrastructure templates create repeatable network resources while parameters and outputs separate environment-specific values from resource definitions. That is a valid account of cloudformation parameterized vpc deployment, but it does not explain the aws config network compliance conformance behavior in the scenario.
EventBridge can route management events to automation targets while CloudTrail records the underlying API activity and IAM restricts what automation may alter. That is a valid account of eventbridge-driven network remediation, but it does not explain the aws config network compliance conformance behavior in the scenario.
Change sets show intended resource additions, replacements and deletions before execution; route changes can be tested against known connectivity intent. That is a valid account of route-table change set safe rollout, but it does not explain the aws config network compliance conformance behavior in the scenario.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
