You save $69.98
Two Transit Gateways are peered across AWS Regions. The peering attachment shows Available in both Regions, but no packets reach remote VPC prefixes. Operators assume the remote routes will be dynamically advertised over the peering. Which routing fact must they address?
Transit Gateway peering attachments do not automatically propagate routes across Regions. The operators must enter the remote CIDR paths and also confirm the VPC return routes.
The presumed automatic propagation is precisely the unavailable behavior for peering. Changing ordinary propagation settings cannot replace the requisite static routes to the peering attachment.
CloudFront is for HTTP content distribution rather than arbitrary private routed packets between VPC CIDRs in different AWS Regions.
A DNS record maps names to addresses but cannot create an inter-Region Transit Gateway forwarding route or make a CIDR reachable.
A publisher distributes one private, large S3-hosted installer through CloudFront OAC to a command-line HTTP client that supports ordinary GET query parameters but does not retain cookies. The download must expire after 15 minutes without exposing the origin. Which viewer authorization mechanism meets those constraints?
CloudFront signed URLs authorize a time-bounded object request without depending on a cookie jar. Origin access control independently maintains private CloudFront-to-S3 access.
Signed cookies require the viewer to send an authorized cookie; this client cannot retain or send one as configured.
OAC limits origin access, not individual viewer authorization or timed expiry of public CloudFront URLs.
An S3 presigned URL could grant time-bound S3 access but bypasses the required CloudFront delivery path and its private-origin design.
A security organization has 90 AWS accounts. Its central team wants all future in-scope CloudFront distributions to inherit a standard WAF policy without engineers manually editing each new distribution. Several test accounts should be excluded. Which governance service should manage the scope?
Firewall Manager supports organization-level policy scope and can evaluate newly added in-scope resources against central security policies while respecting explicit account exclusions.
Manual SNS messages do not enforce consistent security settings or automatically assess future deployments. The goal explicitly requires centralized policy application across accounts.
CloudFront is a global edge service and does not inherit a VPC security group simply because an account belongs to an organization.
DNS query logs provide name-lookup visibility; they do not deploy or enforce application-layer WAF rules on newly created CloudFront distributions.
A CI/CD pipeline in a dedicated tooling account must update a subnet route table in a production account. Security prohibits long-lived production access keys and requires temporary, scoped network-change permissions with CloudTrail attribution. Which cross-account identity method meets the requirements?
Cross-account IAM role assumption provides temporary credentials constrained by trust and permission policies. CloudTrail can associate the resulting network changes with the assumed role session.
Root credentials carry excessive authority and long-lived exposure, expressly prohibited by the requirements. Storing them in pipeline variables does not convert them into scoped temporary authorization.
Organization-wide public edit access contradicts least privilege and cannot represent the approved single route-table operation with tightly controlled role permissions.
ACM issues certificates for supported TLS identities but does not grant EC2 route table API actions or substitute for IAM STS authorization.
A security-group ingress rule was briefly opened to 0.0.0.0/0. Investigators must identify the IAM role that made the AuthorizeSecurityGroupIngress call and the timestamp of the API operation. Which AWS log source is primary?
CloudTrail records supported control-plane calls and caller identity, unlike network-flow summaries of subsequent packets.
Flow records do not establish who invoked the AWS security-group API.
Authoritative DNS requests cannot attribute the EC2 management operation.
Backend readiness telemetry does not include IAM principal information for security-rule changes.
A company hosts a root website at example.org behind an Application Load Balancer. The DNS owner wants the root name, not www.example.org, and has been told a conventional CNAME cannot coexist with apex SOA/NS records. Which Route 53 record should be created?
A Route 53 alias can map an apex name to a supported AWS load balancer target without violating conventional CNAME placement constraints. Clients still resolve usable IP responses.
A private hosted zone only answers within associated private networks. It would not make the public internet domain root resolve to a publicly accessible ALB.
A normal CNAME at a zone apex conflicts with required authoritative records. The scenario specifically requires keeping the apex, so a subdomain CNAME is not sufficient.
TXT records publish text metadata and are not used as the address answer for ordinary HTTP clients resolving the root service name. They cannot act as load balancer aliases.
A multinational company has standardized on a vendor virtual firewall and wants scalable inline packet inspection across many VPCs.
Which technical explanation best accounts for the network behavior described?
Gateway Load Balancer provides appliance load balancing via GENEVE encapsulation and can support central transparent inspection designs. A direct check is to route the required bidirectional traffic through Gateway Load Balancer endpoints and correctly scaled third-party inspection targets and observe the corresponding path.
AWS WAF inspects supported HTTP request attributes at layer seven and can count, block or challenge requests according to web ACL rules. That is a valid account of aws waf managed and rate-limiting rules, but it does not explain the gateway load balancer third-party appliance insertion behavior in the scenario.
AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats. That is a valid account of aws shield and resilient ddos posture, but it does not explain the gateway load balancer third-party appliance insertion behavior in the scenario.
Network Firewall processing depends on stateless defaults and stateful rule evaluation behavior, so policy precedence must match the intended inspection model. That is a valid account of aws network firewall policy precedence, but it does not explain the gateway load balancer third-party appliance insertion behavior in the scenario.
An EC2 application running in a VPC queries api.partner.example repeatedly. Route 53 Resolver query logging is enabled, but only the first lookup appears during a 300-second TTL and later identical lookups are absent. What interpretation best fits documented Resolver behavior?
Route 53 VPC Resolver caches eligible DNS answers for the TTL, and its query logs do not record repeated requests answered from that cache. The described one-log pattern can be normal.
CloudFront presence is unrelated to VPC Resolver caching semantics. DNS query logging and VPC flow logs have different data models and collection behavior.
A DNS cache hit does not require that subsequent packets were denied by an NACL. The application can receive valid answers locally throughout the TTL.
Resolver query logging is a configuration with ongoing collection; it does not have a one-record automatic shutdown behavior for each name after being enabled.
A multi-team IaC repository contains duplicated security-group and subnet code that diverges between service deployments.
Which technical explanation best accounts for the network behavior described?
AWS CDK turns supported imperative-language constructs into deployable CloudFormation infrastructure definitions, enabling standard reusable network patterns. A direct check is to create reusable AWS CDK constructs for network resources with policy validation and synthesize reviewed CloudFormation templates and observe the corresponding path.
AWS Config records supported resource configurations and evaluates them against rules, enabling continuous drift awareness across accounts. That is a valid account of aws config network compliance conformance, but it does not explain the aws cdk secure network constructs behavior in the scenario.
Change sets show intended resource additions, replacements and deletions before execution; route changes can be tested against known connectivity intent. That is a valid account of route-table change set safe rollout, but it does not explain the aws cdk secure network constructs behavior in the scenario.
EventBridge can route management events to automation targets while CloudTrail records the underlying API activity and IAM restricts what automation may alter. That is a valid account of eventbridge-driven network remediation, but it does not explain the aws cdk secure network constructs behavior in the scenario.
An EC2 network interface has a primary address 10.7.2.10 and a secondary address 10.7.2.25. An auditor must identify packets actually destined for the secondary address. A current VPC Flow Log only uses the dstaddr field and reports the primary address. Which additional field captures the original destination?
The pkt-dstaddr field can record the destination address of the packet where dstaddr may show the ENI primary private address. A new format is needed to expose that difference.
Retention only affects how long already collected metadata remains accessible. It cannot make a record report the secondary destination address in a field with different semantics.
Resolver query logs track DNS requests and names, not the destination IP of every packet arriving at an EC2 secondary ENI address.
An Elastic IP changes public address translation for eligible resources, not the precision of the pkt-dstaddr metadata field required by the auditor.
A central inspection VPC routes application egress through AWS Network Firewall. A recent route change sends outbound packets to the firewall endpoint but returns response traffic directly to the workload VPC, bypassing that stateful inspection path. Which concrete security and availability risk does this routing choice create?
A stateful Network Firewall requires the session's packet path to traverse the inspection boundary consistently; routing replies around it breaks state tracking and the egress audit.
This is a risk in privatelink least-privilege service boundary: PrivateLink allows authorized VPC consumers to access a published endpoint service without broad VPC peering or transitive network reachability. It does not account for the aws network firewall centralized filtering fault stated in this incident.
That outcome depends on aws network firewall policy precedence, whose mechanism is different: Network Firewall processing depends on stateless defaults and stateful rule evaluation behavior, so policy precedence must match the intended inspection model. The reported defect concerns aws network firewall centralized filtering.
AWS Shield mitigates supported distributed denial-of-service attack patterns, while layer-seven WAF policies and architecture address different threats. That explains the separate aws shield and resilient ddos posture issue, not this demonstrated aws network firewall centralized filtering failure.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
