You save $69.98
Two AWS Regions have healthy peered Transit Gateways. Only the approved 10.80.0.0/16 and 10.90.0.0/16 VPC networks should communicate. The engineer must prove the static inter-Region TGW routes AND the VPC-facing return route exist. Which result is sufficient?
TGW peering does not propagate remote routes automatically. Explicit peer-prefix routes in the respective TGW tables, correct VPC routes, and bidirectional probes jointly establish the intended path.
Peering health and a single forward route leave the response path absent in Region B.
A subnet route to the local TGW does not tell the TGW how to forward across the peering link.
Propagation within a regional route domain is not automatic TGW-peering propagation and cannot verify cross-Region reachability.
Multiple organizational accounts must continuously detect subnets with unauthorized public access routes.
Which observation would most directly demonstrate the required network outcome?
A deliberately noncompliant test network resource is flagged and the approved remediation produces a compliant state with history retained. That is relevant because aWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts.
This would validate multi-account network automation role boundaries. The case instead needs evidence for aws config network compliance conformance: A deliberately noncompliant test network resource is flagged and the approved remediation produces a compliant state with history retained.
This would validate eventbridge-driven network remediation. The case instead needs evidence for aws config network compliance conformance: A deliberately noncompliant test network resource is flagged and the approved remediation produces a compliant state with history retained.
This would validate route-table change set safe rollout. The case instead needs evidence for aws config network compliance conformance: A deliberately noncompliant test network resource is flagged and the approved remediation produces a compliant state with history retained.
A shared Transit Gateway belongs to a networking account that normally approves each application VPC attachment. A policy change enables automatic acceptance while AWS RAM sharing grants access to a broad set of member accounts; an unauthorized test account creates an attachment without review. What governance risk follows?
AWS RAM participation and Transit Gateway attachment acceptance settings must be scoped to approved principals and connectivity policy.
Unrestricted forwarding would increase, not constrain, the impact of unapproved participation.
Organization membership does not by itself express this network team’s authorized attachment policy.
Adding routes for an unauthorized attachment does not address approval governance.
An enterprise is moving from a site-specific Direct Connect connection to multiple campuses. The team plans to aggregate two physical links in a link aggregation group but one link terminates at a different Direct Connect location. Why is the proposed LAG invalid?
Link aggregation cannot bond ports through geographically separate Direct Connect facilities as one Ethernet LAG.
The problem is the mismatched physical location, not a mandatory public VIF.
Encryption choices do not convert geographically separate facilities into one LAG.
DNS zone association is unrelated to physical link aggregation eligibility.
A low-latency service uses a proprietary TCP protocol and expects AWS load balancing without HTTP-specific inspection.
Which technical explanation best accounts for the network behavior described?
Network Load Balancer operates primarily at layer four and can expose stable per-zone IP addresses while forwarding TCP or UDP connections to targets. A direct check is to select a Network Load Balancer with the required static-address and listener configuration and register compatible target groups and observe the corresponding path.
The ALB makes layer-seven HTTP routing decisions after TLS handling and can direct different request paths to distinct backend groups. That is a valid account of alb layer-seven route and tls, but it does not explain the nlb static ip and tcp passthrough behavior in the scenario.
Cross-zone choices determine whether load balancer nodes can distribute traffic to healthy targets beyond the node's own zone, subject to product-specific defaults. That is a valid account of cross-zone load balancing and target distribution, but it does not explain the nlb static ip and tcp passthrough behavior in the scenario.
A target group's health-check configuration determines which registered backends receive normal traffic, independent of instance-level health alone. That is a valid account of load balancer health check dependencies, but it does not explain the nlb static ip and tcp passthrough behavior in the scenario.
A compliance team wants immutable change evidence and alerts when internet-facing network exposure violates an approved baseline.
Which AWS networking configuration best addresses this specific requirement?
AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts. The proposed change can be checked by whether a deliberately noncompliant test network resource is flagged and the approved remediation produces a compliant state with history retained.
This configuration addresses eventbridge-driven network remediation, not the aws config network compliance conformance requirement. EventBridge can route management events to automation targets while CloudTrail records the underlying API activity and IAM restricts what automation may alter.
This configuration addresses cloudformation parameterized vpc deployment, not the aws config network compliance conformance requirement. Declarative infrastructure templates create repeatable network resources while parameters and outputs separate environment-specific values from resource definitions.
This configuration addresses multi-account network automation role boundaries, not the aws config network compliance conformance requirement. STS role assumption grants temporary credentials limited by role trust and permissions, separating pipeline identity from persistent account-level root access.
A provider replaced the on-premises router and the AWS VPN now shows tunnel transport up with its BGP session down.
Which AWS networking configuration best addresses this specific requirement?
BGP peers must agree on neighbor addressing and expected autonomous systems before they can exchange dynamic routes over the encrypted tunnel. The proposed change can be checked by whether the BGP session reaches the established state, expected prefixes appear and the cloud-to-datacenter test succeeds.
This configuration addresses hybrid path mtu and fragmentation, not the customer gateway bgp asn coordination requirement. Different media and IPsec encapsulation consume packet overhead; Path MTU Discovery or adjusted TCP MSS prevents oversized packets from being silently lost.
This configuration addresses transit virtual interface to transit gateway, not the customer gateway bgp asn coordination requirement. A transit VIF uses the Direct Connect gateway to reach a Transit Gateway; a private VIF is associated with virtual private gateway connectivity instead.
This configuration addresses redundant vpn tunnels with bgp failover, not the customer gateway bgp asn coordination requirement. Site-to-Site VPN supplies redundant tunnels, but failover depends on compatible dynamic routing and healthy peer sessions for both tunnel paths.
A company uses one Direct Connect dedicated connection for critical private VPC traffic. It needs resilience to a complete failure of that colocation facility, not just a second cross-connect on the same device. Which additional path should it design?
True location resilience requires a different physical facility or independent transport, not merely redundant ports in the same shared site.
Multiple logical VIFs share the same physical connection and location.
Additional throughput does not add path diversity.
Public DNS monitoring cannot supply independent private circuit connectivity.
A branch-to-VPC path through a Transit Gateway goes dark after route propagation changes. The security team wants to distinguish packet drops caused by absent routes from packet drops caused by a blackhole route entry. Which log format is most informative?
The transit-specific record can distinguish different forwarding drop causes instead of relying on aggregate instance accept/reject data.
An edge CDN does not inspect private transit route lookup failures.
Authentication logs may show symptoms but not gateway route-drop counters.
DNS trust failures do not distinguish two transit gateway discard reasons.
A SaaS company must route HTTPS requests by host name and URL path to separate application target groups.
Which technical explanation best accounts for the network behavior described?
The ALB makes layer-seven HTTP routing decisions after TLS handling and can direct different request paths to distinct backend groups. A direct check is to use an Application Load Balancer with HTTPS listeners, managed certificates, host/path listener rules and healthy target groups and observe the corresponding path.
A target group's health-check configuration determines which registered backends receive normal traffic, independent of instance-level health alone. That is a valid account of load balancer health check dependencies, but it does not explain the alb layer-seven route and tls behavior in the scenario.
Network Load Balancer operates primarily at layer four and can expose stable per-zone IP addresses while forwarding TCP or UDP connections to targets. That is a valid account of nlb static ip and tcp passthrough, but it does not explain the alb layer-seven route and tls behavior in the scenario.
Gateway Load Balancer uses a network-transparent appliance insertion pattern with GENEVE encapsulation and target health management. That is a valid account of gateway load balancer inline inspection, but it does not explain the alb layer-seven route and tls behavior in the scenario.
A domain registrar holds a DS record pointing to an old KSK after the public hosted zone starts signing with a new key. Validating recursive resolvers fail while nonvalidating tools can sometimes retrieve the underlying DNS records. What DNSSEC operational failure is being demonstrated?
DNSSEC validation requires the parent DS to match the active zone-signing trust chain; stale parent material can break secure resolution.
That outcome depends on route 53 resolver inbound endpoint deployment, whose mechanism is different: An inbound resolver accepts queries from outside the VPC and resolves the associated private namespace without publishing the records to the public internet. The reported defect concerns dnssec public-zone validation and signing.
This is a risk in cross-account private hosted zone association: Private hosted-zone DNS answers are scoped to associated VPCs; cross-account use requires explicit authorization and association. It does not account for the dnssec public-zone validation and signing fault stated in this incident.
That outcome depends on split-horizon dns precedence troubleshooting, whose mechanism is different: VPC Resolver selects eligible private namespaces and forwarding rules based on match and association; public records need not be consulted when a matching private zone exists. The reported defect concerns dnssec public-zone validation and signing.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
