You save $69.98
VPC-A and VPC-B have an accepted peering connection, and their security groups and NACLs permit TCP 5432. The subnet in VPC-A has a 10.20.0.0/16 route to the peer; VPC-B’s app subnet lacks a return route for VPC-A 10.10.0.0/16. What is the minimal fix?
VPC peering requires valid routes in each direction. VPC-B has no specific return next hop to A, so adding its missing peer route directly restores the documented path.
Peering is not transitive, and enabling a third peer does not automatically install or relay the missing route between the original two VPCs.
A public DNS record might reveal a private address but cannot create a return route across private peering or correct the VPC-B subnet table.
An internet gateway is for eligible internet traffic; it does not substitute for the established private peering connection when returning a 10.10.0.0/16 destination.
An AWS Transit Gateway attachment to a new VPC shows Available, but approved workloads cannot reach the new 10.83.0.0/16 prefix. The source attachment’s associated route table lacks the prefix, and another unrelated gateway table already has it. What should operations inspect and correct?
Transit Gateway route lookup uses the table associated with the ingress attachment. A prefix visible only in a different table cannot serve this source traffic until authorized there.
CloudFront is a web content distribution service rather than an arbitrary private packet router. It cannot populate the gateway route table or resolve missing CIDR propagation.
Backend HTTP health checks do not install missing transit routes. A healthy application can remain unreachable when the source gateway table lacks its network prefix.
A DNS TXT record publishes text but does not install a layer-three forwarding path through Transit Gateway attachments for an RFC1918 address range.
A Direct Connect private VIF shows link Up and BGP Down. The network team verified matching neighbor addresses and ASNs, but router logs show failed BGP MD5 authentication after a key rotation. Which action directly restores the peering?
Direct Connect BGP peers can use an MD5 authentication key. A mismatch prevents the routing adjacency despite healthy optical link and peer address configuration; matching secrets repairs that control.
Security groups affect workload traffic after network routing is established; they do not authenticate a Direct Connect BGP TCP session between customer and AWS routers.
VPC CIDR capacity and EC2 instance state are not the BGP authentication problem described by router logs. Changing them cannot make the neighbors accept one another.
CloudFront logging observes HTTP edge requests, not BGP peer handshake authentication on a private Direct Connect virtual interface used by the datacenter.
A CloudFront distribution serves a banking app from a custom HTTPS origin. Viewer-to-edge HTTPS is already required, but a security test shows CloudFront fetching personal data from the origin over plaintext HTTP. Which configuration should the team correct?
CloudFront viewer transport and origin transport are separately configured. Setting the custom origin protocol to require HTTPS prevents plaintext edge-to-origin retrieval of sensitive objects.
TLS on the viewer-to-edge segment does not automatically extend to the custom origin. The observed HTTP origin leg remains unencrypted despite the viewer padlock.
The viewer certificate controls the client-facing handshake; moving it cannot change the separate CloudFront origin protocol selection responsible for HTTP upstream requests.
Longer caching may reduce origin fetch frequency but does not encrypt any future cache miss. It is not a confidentiality control for the origin connection.
A proprietary TCP application performs mutual TLS on backend EC2 hosts. Compliance requires those hosts to validate client certificates and retain their private keys; a network team has proposed an NLB TLS listener to terminate connections. Which listener mode preserves the requirement?
An NLB TCP listener forwards the encrypted connection without handling its TLS handshake, letting the backend accept and authenticate the client certificate directly.
An NLB TLS listener terminates the front-end TLS session. It cannot preserve the original end-to-end client certificate exchange for backend-only mutual authentication.
CloudFront cache settings distinguish web content representations but cannot implement mutual TLS handshake handling for a proprietary direct TCP service.
DNS health checks test configured endpoint health and do not participate in individual TLS handshakes or authenticate client certificates to EC2 backend hosts.
A governance review must compare AWS Organizations member account network protections against a central Firewall Manager policy.
Which technical explanation best accounts for the network behavior described?
Firewall Manager can evaluate whether eligible resources meet organization-wide firewall policy assignments and report noncompliant cases. A direct check is to review Firewall Manager policy scope and resource compliance findings with cross-account aggregation and remediate missing coverage and observe the corresponding path.
CloudWatch alarms evaluate metric periods and thresholds while EventBridge and notification integrations can dispatch timely security response signals. That is a valid account of cloudwatch alarm and security response integration, but it does not explain the firewall manager organization compliance audit behavior in the scenario.
Resolver query logs provide DNS request observations for associated VPC resolution paths, distinct from network-flow and API change logs. That is a valid account of route 53 resolver query logging security visibility, but it does not explain the firewall manager organization compliance audit behavior in the scenario.
CloudTrail records supported AWS management API activity, including the identity and request parameters behind configuration changes, rather than packet payloads. That is a valid account of cloudtrail network api audit, but it does not explain the firewall manager organization compliance audit behavior in the scenario.
A vendor publishes a TCP service using a PrivateLink endpoint service. The consumer account is on the allowed-principals list, but its interface endpoint remains Pending acceptance. The provider explicitly requires manually approved consumers. What operation makes the service reachable?
PrivateLink permissions decide who may request access, while a manual acceptance setting requires the provider to approve each endpoint connection. Pending acceptance prevents service use.
VPC peering creates broad routed connectivity that is unnecessary for a single approved PrivateLink service. It also does not change the pending connection state.
Internet exposure conflicts with the stated private service boundary, and still would not accept the pending PrivateLink endpoint request managed by the provider.
DNS routing can help clients find endpoints after connection setup, but does not perform the provider-side acceptance action needed for a pending endpoint.
A global news site repeatedly serves the same large images from a single AWS Region, resulting in heavy origin bandwidth and slow downloads abroad. The images are public and cacheable with a well-defined update policy. What distribution change should be evaluated?
Edge caching can reduce repeated origin fetches and improve remote viewer latency for cacheable content.
Unnecessary cache fragmentation reduces the benefit of edge reuse.
Removing global delivery cannot satisfy remote viewer access and latency.
End users do not need dedicated private hybrid circuits for public image caching.
A network governance function should notify operators when a production security group is modified through an EC2 API call. The event must include the API actor and trigger a scoped response without continuously polling the account. Which event pattern is suitable?
CloudTrail captures supported management API activity and actor identity; EventBridge can route matching service events to an appropriate event-driven notification or controlled response workflow.
Direct Connect BGP status shows private routing adjacencies and cannot identify who changed an EC2 ingress rule or when the API operation happened.
DNS hosted-zone association does not monitor or emit security-group management API events. It cannot supply the required identity-aware event-driven remediation trigger.
CloudFront viewer HTTP requests occur independently of EC2 security-group API changes and would create noisy irrelevant triggers rather than configuration-specific alerts.
A national enterprise advertises all internal prefixes over a Direct Connect gateway association to a Transit Gateway. An acquired subsidiary’s disallowed address space now appears in reachable routes. What architecture control should constrain the advertised reachability?
Gateway association prefixes and transit route policy must express the intended hybrid address boundary rather than blindly including all networks.
DNS caching does not filter BGP-advertised destination prefixes.
Instance metadata controls do not govern Direct Connect gateway route announcements.
A NAT appliance will not restrict which prefixes are reachable across the dedicated hybrid path.
Two Transit Gateways are peered across AWS Regions. The peering attachment shows Available in both Regions, but no packets reach remote VPC prefixes. Operators assume the remote routes will be dynamically advertised over the peering. Which routing fact must they address?
Transit Gateway peering attachments do not automatically propagate routes across Regions. The operators must enter the remote CIDR paths and also confirm the VPC return routes.
The presumed automatic propagation is precisely the unavailable behavior for peering. Changing ordinary propagation settings cannot replace the requisite static routes to the peering attachment.
CloudFront is for HTTP content distribution rather than arbitrary private routed packets between VPC CIDRs in different AWS Regions.
A DNS record maps names to addresses but cannot create an inter-Region Transit Gateway forwarding route or make a CIDR reachable.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
