You save $69.98
A multiplayer identity service sends several TCP connections per logged-in customer through Global Accelerator. With listener affinity None, connections from one source IP can reach different regional endpoints because their source ports differ. The service needs best-effort same-endpoint routing by client IP. What setting addresses this?
Source-IP affinity hashes on the client address rather than all five tuple fields; health events can still shift destinations.
Weight adjustments do not tie distinct client connections to a shared endpoint.
Resolver caching does not change the accelerator listener affinity algorithm.
Disabling checks sacrifices resilience and does not implement source-address affinity.
A Transit Gateway in eu-west-1 peers with another in us-east-1. A deployment replaced the inter-Region peering attachment ID, but a static route in the EU attachment table still targets the deleted ID. What operations repair is necessary?
Cross-Region Transit Gateway peering relies on explicit static routes referencing the valid attachment ID.
Caching cannot direct packets through a deleted transit attachment.
TGW peering does not automatically exchange remote routes through BGP.
Transport tuning cannot override a stale network route target.
A security review finds that a permissive stateful rule appears to take precedence over a later restrictive inspection rule.
Which technical explanation best accounts for the network behavior described?
Network Firewall processing depends on stateless defaults and stateful rule evaluation behavior, so policy precedence must match the intended inspection model. A direct check is to review AWS Network Firewall stateless and stateful rule evaluation order and apply tested explicit-deny and allowlist policies and observe the corresponding path.
AWS WAF inspects supported HTTP request attributes at layer seven and can count, block or challenge requests according to web ACL rules. That is a valid account of aws waf managed and rate-limiting rules, but it does not explain the aws network firewall policy precedence behavior in the scenario.
AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats. That is a valid account of aws shield and resilient ddos posture, but it does not explain the aws network firewall policy precedence behavior in the scenario.
Security groups are stateful at resource interfaces, while network ACLs are stateless subnet filters evaluated separately for each traffic direction. That is a valid account of security groups versus network acl layers, but it does not explain the aws network firewall policy precedence behavior in the scenario.
A custom application experiences intermittent TLS handshake stalls. Flow records show ACCEPT and average byte counts, while the service team suspects retransmissions and out-of-order TCP segments on a supported EC2 ENI. What additional observation best tests that hypothesis?
Packet copies can expose retransmits and ordering that aggregated flow metadata cannot show.
Longer aggregate intervals further conceal individual packet behavior.
Authoritative DNS changes do not reveal TCP sequence numbers.
A network accept action is not evidence of application-layer handshake completion.
A company uses ZONAL public NAT gateways, not Regional NAT mode, because a regulated egress design requires distinct AZ-local elastic IPs. Its private subnet in AZ-B sends internet traffic through the only NAT gateway in AZ-A, creating a cross-AZ dependency and data-transfer costs. Which change best satisfies the explicitly zonal egress design?
An AZ-local zonal NAT gateway removes AZ-B's dependence on the AZ-A gateway and supports separate availability-zone failure domains under the explicitly required zonal egress model.
Two gateways still located in AZ-A do not eliminate AZ-B's cross-zone failure and traffic path.
An internet gateway does not automatically give private instances public-addressed outbound access; the cross-AZ NAT dependency remains.
Private NAT is intended for private-address translation, not direct public-internet egress through an AZ-local EIP as required here.
A consumer application needs private access to a partner's endpoint service without internet egress or broad VPC peering.
Which technical explanation best accounts for the network behavior described?
PrivateLink interface endpoints expose private ENI addresses to approved service consumers; DNS and endpoint security policies determine usable connectivity. A direct check is to create the interface VPC endpoint in appropriate subnets, approve the service connection and configure endpoint DNS and security groups and observe the corresponding path.
A public NAT gateway translates outbound private IPv4 flows using public subnet connectivity but does not make private instances directly internet-addressable. That is a valid account of nat gateway route and az resilience, but it does not explain the interface vpc endpoint privatelink consumer configuration behavior in the scenario.
Resource sharing and attachment authorization are separate from route-table configuration; each stage must be complete before transit is usable. That is a valid account of aws ram share and attachment acceptance, but it does not explain the interface vpc endpoint privatelink consumer configuration behavior in the scenario.
VPC peering has no transitive routing and requires both VPCs to route toward the peering connection for successful bidirectional traffic. That is a valid account of vpc peering bilateral route update, but it does not explain the interface vpc endpoint privatelink consumer configuration behavior in the scenario.
Developers route routine private S3 API calls through a public NAT even though a gateway endpoint is feasible.
Which observation would most directly demonstrate the required network outcome?
Cost usage data shows reduced NAT bytes for S3 traffic while a private subnet can still access only approved S3 resources. That is relevant because a gateway endpoint can route supported S3 traffic inside AWS without passing that traffic through a NAT gateway's per-GB processing path.
This would validate elastic fabric adapter hpc placement. The case instead needs evidence for nat gateway data-processing cost reduction: Cost usage data shows reduced NAT bytes for S3 traffic while a private subnet can still access only approved S3 resources.
This would validate eni performance instance network capability. The case instead needs evidence for nat gateway data-processing cost reduction: Cost usage data shows reduced NAT bytes for S3 traffic while a private subnet can still access only approved S3 resources.
This would validate ipam and vpc cidr growth planning. The case instead needs evidence for nat gateway data-processing cost reduction: Cost usage data shows reduced NAT bytes for S3 traffic while a private subnet can still access only approved S3 resources.
A Direct Connect migration is complete for two branches, but an AWS transit gateway table shows only the first branch’s /20. The second branch’s BGP advertisement is visible on the customer router, not in the AWS-side VIF learned route list. Where should troubleshooting focus first?
A prefix absent from the AWS BGP received routes must first be traced along the hybrid route exchange path.
An HTTP listener cannot cause a missing BGP route to appear at the VIF.
Database availability does not determine BGP prefix acceptance.
Edge cache TTL is independent of on-premises private route advertisements.
A private subnet uses an Amazon S3 gateway endpoint but its application's requests still traverse a NAT gateway. The subnet route table is not associated with the new endpoint. What corrective action enforces the intended private S3 egress path?
An S3 gateway endpoint affects traffic only for the associated subnet route tables; creating the resource alone is insufficient.
More NAT capacity does not migrate S3 traffic to the private gateway endpoint.
DNS aliasing does not add the gateway endpoint's route-table selection.
Removing workload filtering cannot create the missing subnet route association.
Before a scheduled migration, the network team must prove that a Direct Connect circuit has a usable traffic-capacity baseline AND that its private VIF BGP session is monitored. Which evidence demonstrates both requirements and an actionable alarm?
The Direct Connect bitrate metrics establish link utilization; the virtual-interface BGP status metric measures routing adjacency. An alarm test verifies response to a threshold breach.
An up physical connection is insufficient to establish a utilization baseline or verify the routing-adjacency alarm.
These workload indicators can be healthy while the Direct Connect circuit is saturated or its VIF BGP session is down.
Throughput history supports capacity planning but does not prove BGP monitoring or an actionable routing-alert workflow.
Two AWS Regions have healthy peered Transit Gateways. Only the approved 10.80.0.0/16 and 10.90.0.0/16 VPC networks should communicate. The engineer must prove the static inter-Region TGW routes AND the VPC-facing return route exist. Which result is sufficient?
TGW peering does not propagate remote routes automatically. Explicit peer-prefix routes in the respective TGW tables, correct VPC routes, and bidirectional probes jointly establish the intended path.
Peering health and a single forward route leave the response path absent in Region B.
A subnet route to the local TGW does not tell the TGW how to forward across the peering link.
Propagation within a regional route domain is not automatic TGW-peering propagation and cannot verify cross-Region reachability.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
