You save $69.98
A CloudFormation change set for a production network stack proposes replacing an existing NAT gateway as well as adding a new private subnet route. The change request authorized only the route. What should the engineer do before executing?
Change sets expose proposed resource replacement before execution. An unauthorized NAT replacement is a material network change, so the template should be corrected and regenerated before production.
CloudFormation can replace resources when property changes require it, potentially changing network behavior. It does not guarantee a service-transparent swap of a NAT gateway.
Flow Logs provide network traffic metadata, not an approval gate that blocks infrastructure replacement. The disclosed replacement must be addressed in the planned CloudFormation update.
DNS alias routing does not provide a way to preserve or refer to a NAT gateway replacement in a VPC private subnet route table.
An active VPC peering connection joins 10.10.0.0/16 and 10.20.0.0/16. The first VPC's private subnet route table points at the peering connection for 10.20.0.0/16, but the second VPC's subnet route table has only its local route. Security groups and NACLs allow the test flow. What is missing?
VPC peering requires suitable routes on both sides. Since the forward path already targets the active peering connection and packet policies allow traffic, adding the reciprocal route on the second subnet enables replies to return to 10.10.0.0/16.
CloudFront provides application content distribution, not layer-three bidirectional routing between the two private subnets. Replacing peering would remove rather than repair the intended connectivity and would miss the required response path.
An inbound Resolver endpoint is used for DNS queries entering a VPC from a connected network. The case concerns two VPC IP routes and explicitly identifies a missing return-route entry.
Direct Connect route propagation addresses certain hybrid gateway routing paths, not a VPC peering connection between the specified subnet CIDRs. It would not create the return entry to the peering attachment.
Private application workers run in two Availability Zones but both subnet route tables send default IPv4 egress through a public NAT gateway in only one zone. A tabletop exercise requires a single-zone outage not to strand workers in the surviving zone. Which topology change is best within the current zonal NAT design?
Each zonal NAT gateway is redundant within its Availability Zone but dependent on that zone. A same-zone gateway and route for each private subnet avoids losing outbound egress in the surviving zone when the other zone fails.
An internet gateway is not a NAT replacement for private instances that intentionally lack public IPv4 addresses. Pointing a private subnet at it would not provide the required translated outbound connectivity.
Assigning public addresses changes the security and exposure model; it defeats the stated private-worker requirement. It also does not preserve the existing managed egress design.
VPC peering does not support transitive routing through another VPC's NAT gateway in the requested manner. The goal is local zonal redundancy, not creating a new cross-VPC default path.
A bank uses a MACsec-capable dedicated Direct Connect port. Security policy says the physical cross-connect must never forward plaintext if the MACsec handshake or key agreement fails. Which encryption-mode setting enforces that guarantee?
The must_encrypt mode fails closed if MACsec negotiation cannot establish encryption on the cross-connect. That directly meets the explicit no-cleartext requirement.
Should_encrypt can fall back to unencrypted communication when MACsec negotiation fails. That violates the bank’s requirement even though it may improve availability.
CloudFront HTTPS applies to its viewer web connections and does not encrypt arbitrary Ethernet frames across the dedicated Direct Connect physical cross-connect.
Flow Logs provide network traffic metadata but do not change link encryption behavior or block plaintext frames when MACsec key agreement fails.
A new corporate WAN connects to AWS through Direct Connect. On the private VIF, the customer router advertises only 10.60.0.0/16, but a finance application resides behind 10.70.0.0/16 and is unreachable from AWS. The physical link and BGP session are healthy. Which change should be investigated first?
A healthy BGP session can exchange only configured routes. If the finance prefix is absent from the permitted advertisements, AWS lacks that desired return path regardless of link status.
ALB health checks can determine backend readiness but cannot create a route to an on-premises CIDR absent from BGP on the hybrid network.
DNS TTL does not generate a missing BGP advertisement. Applications might resolve their hostnames but still have no routed path to the finance subnet.
CloudFront origin registration governs HTTP content fetching, not advertisements between the customer WAN and a Direct Connect private virtual interface.
A merger introduces a datacenter subnet that overlaps an existing AWS VPC CIDR, causing ambiguous return routing.
Which technical explanation best accounts for the network behavior described?
Routing uses destination prefixes to choose paths; overlapping address spaces make private packets ambiguous without deliberate isolation or translation. A direct check is to inventory and allocate non-overlapping address ranges or intentionally design supported translation boundaries before enabling hybrid routes and observe the corresponding path.
Direct Connect provides a dedicated physical network path for AWS resources, while its private VIF and gateway controls determine private VPC reachability. That is a valid account of direct connect private connectivity and redundancy, but it does not explain the hybrid cidr overlap prevention behavior in the scenario.
Site-to-Site VPN encrypts IP traffic over the internet using IPsec, with redundant tunnels and optional dynamic BGP route exchange. That is a valid account of site-to-site vpn encrypted hybrid baseline, but it does not explain the hybrid cidr overlap prevention behavior in the scenario.
Transit VIFs connect a Direct Connect gateway to associated Transit Gateways, distinct from private VIF designs that access virtual private gateways. That is a valid account of transit vif for multiple transit gateways, but it does not explain the hybrid cidr overlap prevention behavior in the scenario.
An incident response team already has VPC Flow Logs, but needs to identify the contents of a malformed TCP handshake and verify a suspected retransmission in a supported EC2 instance. Retention policy permits controlled short-term packet capture. What adds the missing evidence?
Traffic Mirroring copies filtered ENI packets to a monitoring target for protocol analysis. With an approved capture scope and a supported source instance, it provides the packet detail absent from flow metadata.
A NetworkPacketsIn alarm might show traffic-volume changes, but it cannot reveal the handshake fields, ordering, or retransmissions that the investigator must inspect during the affected client connection.
Flow Logs aggregate metadata; altering their aggregation interval does not turn them into packet-body or TCP-option captures. The incident requires inspecting the segments themselves, not a higher-volume flow summary.
CloudTrail documents control-plane API calls and identity, which can help investigate configuration changes but does not record this instance's TCP handshake sequence or per-segment packet options.
A new application VPC in a second AWS account must resolve an existing private hosted-zone record for api.corp.internal. The zone owner has approved the request but has only created a VPC association authorization. DNS still returns NXDOMAIN in the consumer account. What final step is required?
Cross-account authorization allows an association but does not perform it. The consumer VPC must still be explicitly associated so its VPC Resolver can see the private namespace.
Moving records public would violate the requirement that api.corp.internal remain private and is not needed for associated VPC-to-VPC name resolution.
A Direct Connect public VIF accesses AWS public services, not the missing cross-account private hosted-zone association for EC2 DNS queries inside the consumer VPC.
CloudFront invalidations purge cached HTTP objects and cannot alter Route 53 Resolver private-zone associations or repair NXDOMAIN responses from the VPC resolver.
A multi-account security team needs to detect new security groups that allow SSH from 0.0.0.0/0 after deployment, including console-made changes. It wants historical configuration states and consistent compliance findings, not just deployment-time template linting. Which AWS service is appropriate?
AWS Config records resource configuration state and evaluates supported compliance rules, catching later manual drift beyond the original infrastructure template. Cross-account aggregation supports central review.
Direct Connect public VIF is a networking path to AWS public IP services, not a continuous evaluator of VPC security-group ingress policies.
ALB health checks measure backend application readiness, not whether security groups in multiple accounts permit inappropriate port 22 ingress.
A deployment template only controls resources created through that pipeline; manual console edits can change security groups later without being detected by a one-time parameter.
A Network Firewall in one inspection VPC receives outbound traffic through its us-east-1a endpoint. Return packets use a route to a different firewall endpoint in us-east-1b, and its stateful signatures never see a complete TCP handshake. Which routing property must be repaired?
Network Firewall stateful inspection expects symmetric routing through the same endpoint for a session. Splitting forward and reverse directions across endpoints breaks connection state and application inspection.
A DNS alias influences hostname resolution and does not choose the per-packet Network Firewall endpoint on the return path between subnets.
Removing signatures destroys the security objective and cannot restore missing state synchronization caused by route asymmetry. CPU metrics are not a packet inspection control.
CloudFront signed URLs authorize HTTP object access at the edge, not stateful inspection paths for private network TCP segments.
VPC-A and VPC-B have an accepted peering connection, and their security groups and NACLs permit TCP 5432. The subnet in VPC-A has a 10.20.0.0/16 route to the peer; VPC-B’s app subnet lacks a return route for VPC-A 10.10.0.0/16. What is the minimal fix?
VPC peering requires valid routes in each direction. VPC-B has no specific return next hop to A, so adding its missing peer route directly restores the documented path.
Peering is not transitive, and enabling a third peer does not automatically install or relay the missing route between the original two VPCs.
A public DNS record might reveal a private address but cannot create a return route across private peering or correct the VPC-B subnet table.
An internet gateway is for eligible internet traffic; it does not substitute for the established private peering connection when returning a 10.10.0.0/16 destination.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
