You save $69.98
A VPN BGP session is established and the Transit Gateway has learned the expected corporate prefix. One VPC's application subnet cannot send packets there because its subnet route table lacks a destination route to the TGW. What evidence verifies the final routing correction?
The subnet-to-TGW route and the TGW-to-VPN learned route are both required; tunnel health alone does not configure VPC subnet routing.
That demonstrates control-plane health, not correction of the missing source route.
An unrelated advertisement does not supply the subnet's intended next hop.
Name resolution does not prove permitted packet routing over the hybrid path.
A compliance team uses Route 53 Resolver query logs for a private DNS suffix. Repeated calls from the same instance generate only one log record until the name’s TTL expires. Which limitation should be explained in the monitoring design?
Repeated requests may be answered from cached DNS entries and therefore never trigger another query log event.
Cache-served DNS responses do not necessarily produce a new logged query.
Resolver telemetry is not web application content capture.
Resolver query logging can cover specified private VPC and hybrid DNS workloads.
A new Direct Connect transit VIF is configured to reach VPCs attached to a Transit Gateway. The operator assumes the VIF can attach directly to a VPC internet gateway. Which relationship is actually required?
Transit virtual interfaces use a Direct Connect gateway as the intermediate association to the TGW rather than connecting directly to a VPC internet gateway.
Internet gateways do not provide a transit VIF association.
VPC peering is a separate construct and does not replace DX gateway association.
DNS records cannot supply the transit VIF's required network association.
Two regional Transit Gateways have a working inter-Region peering attachment and matching static peer-prefix routes. However, the source EC2 subnet’s route table has no route for the remote VPC CIDR toward its regional Transit Gateway. The gateway team declares the peering configuration complete. What remains the immediate connectivity risk?
Transit Gateway peering routes and VPC subnet routes are separate forwarding decisions; both must be configured.
The TGW tables already have the remote routes; the originating VPC subnet still lacks its next hop.
Permission rules cannot choose a missing subnet route.
The peering link is Available and the failure is before traffic reaches it.
An inspection VPC uses AWS Network Firewall for stateful east-west traffic. Request packets use the endpoint in Availability Zone A; the route for response traffic bypasses that firewall endpoint, and established connections fail. Which routing property must be enforced?
Stateful packet inspection depends on consistent flow state; an asymmetric return path can bypass or mismatch the state.
DNS weighting does not control routed return-packet symmetry within the inspection VPC.
Monitoring settings do not change actual route paths.
Caching static content does not repair east-west stateful inspection routing.
An AWS WAF rate-based rule for POST /login was initially deployed in Count mode. The test log shows rate matches but users continue receiving HTTP 200 responses from the login service. Which observation confirms the rule now enforces the intended abusive-request limit?
Count mode measures matches without stopping a request. The acceptance test must show the desired enforcement action on the sensitive path.
Counting alone does not enforce an abusive-request block.
NACL port rules cannot demonstrate HTTP rate enforcement.
Resource configuration does not prove actual request handling.
An NLB must pass original client connection metadata to a custom service running behind a supported cross-network IP target, but ordinary client-IP preservation is not available in that topology. The service can parse a binary prefix before its protocol frames. What should the team configure?
The binary Proxy Protocol v2 header carries connection metadata independently of the packet source address seen by the target.
A fixed HTTP response neither forwards the proprietary protocol nor conveys client metadata.
DNS records cannot convey per-connection client identity to a target.
Session stickiness affects selection, not metadata representation.
An EC2 client in a VPC reaches S3 through its subnet's S3 gateway endpoint. A datacenter client connected via Direct Connect tries to use that same gateway endpoint transitively and fails. What observation explains the difference without implying S3 itself is down?
S3 gateway endpoints are VPC route targets, not generally usable from an on-premises network as a transit hop.
Name resolution alone does not determine endpoint routing across the hybrid connection.
Transport connectivity does not make a gateway endpoint transitively accessible.
Resource existence does not change VPC endpoint routing scope.
Two regional Transit Gateways have an active peering attachment. A VPC attachment on one gateway propagates its CIDR locally but the remote gateway has no route for that CIDR. Which deployment step is missing?
Transit Gateway peering attachments do not automatically propagate the other side’s attachment routes.
Inter-Region TGW peering is not a dynamic BGP relationship of that type.
Internet NAT is not the required inter-Region transit route.
Application telemetry cannot supply the missing remote gateway route.
A network administrator shares a Transit Gateway and requests a consumer VPC attachment. The central account has not accepted the pending attachment, and neither gateway route tables nor VPC subnet routes were configured. The project owner counts the invitation as deployed connectivity. What readiness failure is being made?
The attachment remains pending and no route policy exists; a share invitation is not evidence of an accepted, routed and governed network connection.
That outcome depends on interface vpc endpoint privatelink consumer configuration, whose mechanism is different: PrivateLink interface endpoints expose private ENI addresses to approved service consumers; DNS and endpoint security policies determine usable connectivity. The reported defect concerns aws ram share and attachment acceptance.
Transit Gateway inter-Region peering does not automatically propagate remote attachment prefixes; route-table entries identify the peering path. That explains the separate transit gateway cross-region static routing issue, not this demonstrated aws ram share and attachment acceptance failure.
This is a risk in nat gateway route and az resilience: A public NAT gateway translates outbound private IPv4 flows using public subnet connectivity but does not make private instances directly internet-addressable. It does not account for the aws ram share and attachment acceptance fault stated in this incident.
An application requires the zone-apex hostname corp.example to resolve to its ALB. An engineer tries to publish a conventional CNAME at the apex despite the SOA and NS records already living there. What DNS rule makes this arrangement unsafe?
A conventional zone-apex CNAME conflicts with the required apex NS/SOA records; an eligible Route 53 alias record is the appropriate alternative.
That outcome depends on route 53 resolver inbound endpoint for hybrid dns, whose mechanism is different: Inbound Resolver endpoints receive DNS requests from reachable external DNS servers and resolve eligible AWS private namespace records in the associated VPC. The reported defect concerns route 53 alias record for load balancer.
This is a risk in route 53 public hosted zone delegation: A public hosted zone becomes authoritative to external recursive resolvers only when the domain's parent delegation points to its name servers. It does not account for the route 53 alias record for load balancer fault stated in this incident.
That outcome depends on route 53 weighted failover and health checks, whose mechanism is different: Route 53 routing policies choose eligible DNS record answers according to their weights or failover order, while health checks exclude records marked unhealthy. The reported defect concerns route 53 alias record for load balancer.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
