You save $69.98
An EventBridge rule invokes a Lambda function whenever a security group rule is modified. The function corrects a finding by modifying the same security group but has no idempotency key or rule-scope guard; each correction emits another matching event and repeat invocations continue. What automation failure mode threatens the network?
Network remediation needs scoped event patterns and idempotent handlers when its own API changes can trigger later events.
More concurrency can amplify repeated mutations triggered by the handler’s own API events.
An extra matching rule does not break the existing recursive event chain.
Wider permissions increase blast radius without stopping repeated triggers.
An online retail site accepts user requests on ALB HTTP port 80 but security policy requires redirecting them to HTTPS port 443 on the same host, preserving the requested path and query string. What listener action should be configured?
An explicit redirect moves the viewer to HTTPS while preserving the intended URL components.
Forwarding the original plaintext request does not enforce client-side HTTPS.
A raw TCP load balancer does not provide an HTTP redirect action.
DNS caching does not turn HTTP requests into HTTPS redirects.
A platform team is required by its audited deployment process to store PLAIN CLOUDFORMATION templates, not CDK source code, in a versioned repository. The same VPC design must deploy in several Regions with account-specific CIDRs and IDs supplied at deployment; proposed changes must be previewed before execution. What implementation best meets all constraints?
Native CloudFormation parameters keep environment-dependent values out of the shared template, and change sets preview resource replacements and changes before execution. The process explicitly requires plain templates, not CDK source.
Hardcoded environment identifiers cause resource collisions and violate the requirement for account-specific parameters.
Change sets preview updates but do not provide reproducible environment bindings or prevent per-account template divergence.
CDK can produce viable IaC generally, but this audited pipeline explicitly disallows CDK source and requires one native parameterized template as its controlled input.
A private hosted zone corp.example.com is associated with a workload VPC but does not contain an A record for api.corp.example.com. The public hosted zone has the API record. VPC instances querying the default Resolver receive NXDOMAIN rather than the public answer. What explains the behavior?
Resolver searches the associated private namespace and returns its response rather than trying the public hosted zone for a missing name.
Split-horizon public and private zones can coexist with different record contents.
DNSSEC is not why the record is absent from the matching private zone.
A private hosted zone missing an ordinary A record is not repaired by ALB health checks.
An engineer deploys a private NAT gateway and points its egress route toward an internet gateway expecting ordinary public IPv4 internet access. What mechanism prevents that design from behaving like a public NAT gateway?
The two NAT gateway connectivity modes have different egress scope; simply adding an IGW next hop does not convert one into the other.
Private NAT gateways do not change type or receive public addressing automatically.
The limitation is public internet egress architecture, not a general TCP incapability.
DNS publication cannot change NAT gateway address-translation mode.
A third-party application should access exactly one private TCP service without obtaining network routes to internal application subnets.
Which technical explanation best accounts for the network behavior described?
PrivateLink allows authorized VPC consumers to access a published endpoint service without broad VPC peering or transitive network reachability. A direct check is to use PrivateLink endpoint service permissions and consumer endpoint policies or security groups for scoped service connectivity and observe the corresponding path.
AWS WAF inspects supported HTTP request attributes at layer seven and can count, block or challenge requests according to web ACL rules. That is a valid account of aws waf managed and rate-limiting rules, but it does not explain the privatelink least-privilege service boundary behavior in the scenario.
Transit Gateway attachment association and propagation control which routed prefixes each network segment can reach, independent of VPC security-group rules. That is a valid account of cross-account transit gateway route segmentation, but it does not explain the privatelink least-privilege service boundary behavior in the scenario.
AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats. That is a valid account of aws shield and resilient ddos posture, but it does not explain the privatelink least-privilege service boundary behavior in the scenario.
Multiple AWS accounts need the same approved VPC subnet and routing pattern but engineers currently copy manual console steps.
Which technical explanation best accounts for the network behavior described?
Declarative infrastructure templates create repeatable network resources while parameters and outputs separate environment-specific values from resource definitions. A direct check is to use parameterized AWS CloudFormation templates or a supported IaC framework with validated network mappings and change-set review and observe the corresponding path.
STS role assumption grants temporary credentials limited by role trust and permissions, separating pipeline identity from persistent account-level root access. That is a valid account of multi-account network automation role boundaries, but it does not explain the cloudformation parameterized vpc deployment behavior in the scenario.
AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts. That is a valid account of aws config network compliance conformance, but it does not explain the cloudformation parameterized vpc deployment behavior in the scenario.
EventBridge can route management events to automation targets while CloudTrail records the underlying API activity and IAM restricts what automation may alter. That is a valid account of eventbridge-driven network remediation, but it does not explain the cloudformation parameterized vpc deployment behavior in the scenario.
A regulated medical site uses Direct Connect to send sensitive records to AWS. The encryption audit finds traffic uses plaintext application protocols and no IPsec/MACsec transport while the team assumes the private physical circuit itself provides cryptographic confidentiality. What compliance risk follows?
Direct Connect provides dedicated transport but does not inherently encrypt all traffic, so the unprotected data violates the explicit cryptographic requirement.
This is a risk in direct connect private connectivity and redundancy: Direct Connect provides a dedicated physical network path for AWS resources, while its private VIF and gateway controls determine private VPC reachability. It does not account for the ipsec encryption over direct connect fault stated in this incident.
That outcome depends on hybrid cidr overlap prevention, whose mechanism is different: Routing uses destination prefixes to choose paths; overlapping address spaces make private packets ambiguous without deliberate isolation or translation. The reported defect concerns ipsec encryption over direct connect.
BGP route attributes and permitted prefixes influence dynamic route selection, while AWS service-specific routing priorities and Direct Connect behavior impose constraints. That explains the separate bgp route policy for hybrid path preference issue, not this demonstrated ipsec encryption over direct connect failure.
An engineering team wants secure TLS termination on an Application Load Balancer serving multiple domain names.
Which observation would most directly demonstrate the required network outcome?
A trusted HTTPS client validates the server name and certificate chain and a scheduled renewal test avoids an expired listener certificate. That is relevant because aLB TLS listeners can terminate client connections using certificates stored in ACM, separating public certificate lifecycle from backend instance provisioning.
This would validate route 53 dnssec chain-of-trust protection. The case instead needs evidence for alb acm certificate managed tls: A trusted HTTPS client validates the server name and certificate chain and a scheduled renewal test avoids an expired listener certificate.
This would validate vpn encryption over direct connect. The case instead needs evidence for alb acm certificate managed tls: A trusted HTTPS client validates the server name and certificate chain and a scheduled renewal test avoids an expired listener certificate.
This would validate cloudfront https viewer and origin settings. The case instead needs evidence for alb acm certificate managed tls: A trusted HTTPS client validates the server name and certificate chain and a scheduled renewal test avoids an expired listener certificate.
A managed firewall logs repeated denies but no operations alert is triggered when deny rates spike.
Which observation would most directly demonstrate the required network outcome?
A staged test exceeds the documented threshold and creates one actionable alert with contextual metric and resource information. That is relevant because cloudWatch alarms evaluate metric periods and thresholds while EventBridge and notification integrations can dispatch timely security response signals.
This would validate network firewall flow and alert log delivery. The case instead needs evidence for cloudwatch alarm and security response integration: A staged test exceeds the documented threshold and creates one actionable alert with contextual metric and resource information.
This would validate route 53 resolver query logging security visibility. The case instead needs evidence for cloudwatch alarm and security response integration: A staged test exceeds the documented threshold and creates one actionable alert with contextual metric and resource information.
This would validate firewall manager organization compliance audit. The case instead needs evidence for cloudwatch alarm and security response integration: A staged test exceeds the documented threshold and creates one actionable alert with contextual metric and resource information.
A VPN BGP session is established and the Transit Gateway has learned the expected corporate prefix. One VPC's application subnet cannot send packets there because its subnet route table lacks a destination route to the TGW. What evidence verifies the final routing correction?
The subnet-to-TGW route and the TGW-to-VPN learned route are both required; tunnel health alone does not configure VPC subnet routing.
That demonstrates control-plane health, not correction of the missing source route.
An unrelated advertisement does not supply the subnet's intended next hop.
Name resolution does not prove permitted packet routing over the hybrid path.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
