You save $69.98
AWS Network Firewall emits a stream of deny logs for a suspected credential-stuffing incident. The company has no CloudWatch alarm, notification destination or on-call owner and nobody responds until users complain. What monitoring gap allows the sustained event to go unnoticed?
Stored firewall denies without a staffed alarm and notification channel can accumulate while the attack or service outage goes unaddressed.
This is a risk in cloudtrail network api audit: CloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads. It does not account for the cloudwatch alarm and security response integration fault stated in this incident.
Flow logs emit metadata such as IP addresses, ports, bytes and ACCEPT/REJECT action for supported network flows, not raw packet bodies. That explains the separate vpc flow logs for security investigations issue, not this demonstrated cloudwatch alarm and security response integration failure.
This is a risk in network firewall flow and alert log delivery: Managed firewall logging exposes inspected flow outcomes and alert events, while VPC Flow Logs alone do not explain stateful intrusion-rule matches. It does not account for the cloudwatch alarm and security response integration fault stated in this incident.
A VPN customer gateway currently advertises only one route to AWS over one of two established IPsec tunnels. When that tunnel is shut down for maintenance, BGP never converges on the second tunnel. What should be corrected before the next outage drill?
The second tunnel cannot provide routed failover unless its neighbor and route exchange are actually operational.
Removing redundancy worsens the maintenance failure and does not establish a healthy alternate peer.
Session cookies do not restore hybrid routing on the backup tunnel.
A public egress path is not the approved private branch-to-VPC connection.
A production VPN forwards all AWS-to-datacenter traffic through one tunnel even though a second tunnel is available.
Which observation would most directly demonstrate the required network outcome?
During a controlled primary-tunnel shutdown, approved traffic recovers over the alternate tunnel and BGP routing converges. That is relevant because site-to-Site VPN supplies redundant tunnels, but failover depends on compatible dynamic routing and healthy peer sessions for both tunnel paths.
This would validate hybrid path mtu and fragmentation. The case instead needs evidence for redundant vpn tunnels with bgp failover: During a controlled primary-tunnel shutdown, approved traffic recovers over the alternate tunnel and BGP routing converges.
This would validate transit virtual interface to transit gateway. The case instead needs evidence for redundant vpn tunnels with bgp failover: During a controlled primary-tunnel shutdown, approved traffic recovers over the alternate tunnel and BGP routing converges.
This would validate direct connect failover to vpn route selection. The case instead needs evidence for redundant vpn tunnels with bgp failover: During a controlled primary-tunnel shutdown, approved traffic recovers over the alternate tunnel and BGP routing converges.
A software vendor deploys a corrected CSS bundle at /assets/site.css behind CloudFront, but clients keep receiving the cached old file until TTL expiry. Releases can change asset references in the generated HTML. Which rollout gives deterministic new-byte access without relying on widespread invalidation?
A different object path produces a different cache key so subsequent requests fetch the new version without waiting for old TTLs.
A longer TTL prolongs old content availability.
A universal Not Modified response cannot make the cache retrieve the new bytes.
DNS address changes do not differentiate two versions of the same cached object path.
A Network Load Balancer has cross-zone load balancing disabled. Its targets are all healthy in Zone A, but the load balancer is enabled in Zones A and B. Clients sometimes connect through the Zone B entry address. Which availability risk is directly created by this placement?
With cross-zone disabled, each enabled zone needs eligible targets to serve its local NLB entry path; healthy capacity in another zone does not necessarily substitute.
NLB target selection does not provision unrelated S3 origins.
Cross-zone target eligibility does not alter the application listener's TLS configuration.
A lack of eligible Zone B targets affects that entry path; it does not automatically mark healthy Zone A targets unhealthy.
A CloudWatch alarm monitors firewall deny counts on an intermittently reported custom metric. The security team treats missing datapoints as `notBreaching`, so the alarm remains OK through long telemetry gaps that coincide with suspected blocked traffic. What monitoring-assurance risk does that choice introduce?
CloudWatch alarm state depends on real evaluated datapoints and the configured handling of missing metrics.
Ignoring missing data can preserve the prior state without providing the desired alert assurance.
A higher threshold makes alerts less likely and does not resolve missing telemetry.
A historical metric value cannot establish the state during a later data gap.
After a branch router maintenance, a corporate WAN application's branch-to-AWS Region latency rises. AWS Network Manager still lists the branch and TGW as connected, but operators suspect the dynamic path now traverses a secondary geographic site. What FIRST evidence plan distinguishes a topology/path change from normal application slowness?
The suspected change is a network path selection, not simply application response time. A baseline path comparison plus actual route and link measurements can expose the shifted branch-to-Region forwarding path.
A connected inventory map does not guarantee that the same WAN path or BGP preference is currently selected.
Security-group edits do not identify a changing dynamic WAN route or explain regional path latency.
An intra-VPC probe cannot establish which intersite WAN route carries the affected branch prefix.
A Direct Connect transit VIF and Direct Connect gateway association to a TGW are operational. The datacenter can reach VPC 10.80.0.0/16 but not newly attached VPC 10.81.0.0/16. The DX gateway association allowed-prefix list contains only 10.80.0.0/16. Which change addresses this advertisement gap?
The DX gateway association's allowed prefixes determine which VPC address ranges can be advertised over the transit VIF.
A public VIF is not the private TGW transit path described.
HTTP routing rules cannot authorize hybrid BGP prefix advertisement.
Changing the old VPC does not add the new prefix to the association's permitted list.
An international enterprise wants inter-Region backbone connectivity but must preserve independent Regional route control.
Which technical explanation best accounts for the network behavior described?
Transit Gateway peering joins separate regional gateway routing domains, and the peering attachment does not automatically propagate all remote routes. A direct check is to design Transit Gateway peering attachments with corresponding static routes and clear inter-Region traffic boundaries and observe the corresponding path.
AWS PrivateLink offers a private service endpoint across VPC boundaries without granting general layer-three routing to the provider network. That is a valid account of privatelink service-consumer pattern, but it does not explain the cross-region transit gateway peering behavior in the scenario.
Private hosted zones and Resolver rules can make selected internal names resolvable in associated VPCs without implying blanket network reachability. That is a valid account of hybrid multi-account dns boundary, but it does not explain the cross-region transit gateway peering behavior in the scenario.
Transit Gateway can route between VPC attachments according to association and propagation rules, unlike non-transitive VPC peering. That is a valid account of transit gateway hub and spoke versus peering mesh, but it does not explain the cross-region transit gateway peering behavior in the scenario.
An application VPC requires forwarding for ad.corp.example. Its Route 53 Resolver outbound endpoint is healthy and corporate DNS is reachable, but the forwarding rule is associated only with a different VPC. What outage risk remains for this application?
A rule association is required for an individual VPC to select its outbound forwarding behavior; other VPC associations do not imply this one.
Lack of association affects this VPC; it does not automatically disable use by other correctly associated VPCs.
Missing a forwarding rule does not automatically publish private corporate records.
Resolver rule association does not configure the dedicated circuit's bandwidth.
A large organization charges workloads by AWS networking service. It notices that nightly analytic jobs pull same-Region DynamoDB items through NAT gateways from private EC2 subnets. The application supports DynamoDB gateway endpoints. Which design most directly removes this unnecessary NAT path?
Eligible traffic to the supported service can use the gateway endpoint rather than the NAT data-processing path.
More NAT gateways do not eliminate per-byte processing of the eligible service traffic.
Relaxing application authorization is unsafe and does not solve the network design objective.
Giving workloads public addresses is unnecessary when a gateway endpoint can meet private access needs.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
