Stateful outbound SG permissions define which new connections a workload can initiate explains a different case, for example when an audit finds highly permissive outbound SG rules on EC2 instances holding sensitive financial data. In the current topology, the deciding factor is that stateful network inspection requires route-based redirection and bidirectional path consistency; this choice therefore does not explain the specified remedy.

Continuous controls can identify network security drift beyond initial deployment checks explains a different case, for example when an organization wants automated discovery of broad SSH security-group rules across its accounts. In the current topology, the deciding factor is that stateful network inspection requires route-based redirection and bidirectional path consistency; this choice therefore does not explain the specified remedy.

AWS WAF evaluates HTTP-layer attributes and rule actions on supported web entry points explains a different case, for example when an internet-facing application must block malicious HTTP request signatures but preserve normal API calls. In the current topology, the deciding factor is that stateful network inspection requires route-based redirection and bidirectional path consistency; this choice therefore does not explain the specified remedy.

Central rule definitions do not help VPCs where the association or network path is missing explains a different case, for example when a DNS outage affects only a few VPCs after centralized forwarding rule changes. In the current topology, the deciding factor is that hybrid DNS requests require network reachability to the Resolver endpoint as well as forwarding rules; this choice therefore does not explain the specified remedy.

Conditional forwarding should match intended namespaces rather than redirect all DNS explains a different case, for example when an EC2 instance needs corporate DNS resolution but a broad forwarding rule also intercepts public domain lookups. In the current topology, the deciding factor is that hybrid DNS requests require network reachability to the Resolver endpoint as well as forwarding rules; this choice therefore does not explain the specified remedy.

PrivateLink DNS must map the desired service name to reachable consumer endpoint ENI addresses explains a different case, for example when an internal API is exposed by PrivateLink but consumers resolve its hostname to a public ALB. In the current topology, the deciding factor is that hybrid DNS requests require network reachability to the Resolver endpoint as well as forwarding rules; this choice therefore does not explain the specified remedy.

Repeated eligible responses are served at edges and blocked HTTP requests do not reach origin might confirm another remediation, for instance when a web application needs HTTP edge caching and WAF protection but was placed behind a TCP-only NLB. This question instead requires demonstrating that existing endpoint configuration remains constant while new UDP traffic shifts to a healthy Region. The alternative would not validate the selected network fix.

A/B mobile image variants remain distinct while tracking-only requests share cache objects might confirm another remediation, for instance when a news publisher wants different images cached by device class but never by irrelevant tracking parameters. This question instead requires demonstrating that existing endpoint configuration remains constant while new UDP traffic shifts to a healthy Region. The alternative would not validate the selected network fix.

A test from restricted locations is denied or reaches a permitted regional origin might confirm another remediation, for instance when a media business has regional data residency rules for viewers and cannot send all users to one origin. This question instead requires demonstrating that existing endpoint configuration remains constant while new UDP traffic shifts to a healthy Region. The alternative would not validate the selected network fix.

New approved AWS prefixes are learned or explicitly installed and test packets reach them might confirm another remediation, for instance when a customer VPN uses static routing while the team expects automatic failover after network changes. This question instead requires demonstrating that tunnel counters rise for intended traffic and end-to-end probes succeed. The alternative would not validate the selected network fix.

Route tables select the preferred link and revert on primary failure might confirm another remediation, for instance when a connection uses two Direct Connect links and business policy requires a preferred active path rather than equal splitting. This question instead requires demonstrating that tunnel counters rise for intended traffic and end-to-end probes succeed. The alternative would not validate the selected network fix.

Both tunnels establish and one continues traffic during a planned tunnel shutdown might confirm another remediation, for instance when an enterprise provisions a VPN but only one of its provided tunnel endpoint configurations is deployed. This question instead requires demonstrating that tunnel counters rise for intended traffic and end-to-end probes succeed. The alternative would not validate the selected network fix.

Assuming the VPC owner can automatically modify every participant security group can fail can be a real consequence when an enterprise wants to apply security group rules across accounts but forgets that shared-VPC resources are owned by participants. Here the relevant failure is that coarse geographic rules without testing can deny legitimate travelers or global partners. The alternative names a different failure mode and does not best account for the stated condition.

Manually creating unrelated web ACL rules in each account can produce configuration drift can be a real consequence when a company wants standardized AWS WAF policies across hundreds of managed accounts and distributions. Here the relevant failure is that coarse geographic rules without testing can deny legitimate travelers or global partners. The alternative names a different failure mode and does not best account for the stated condition.

A standalone WAF on one application ALB does not filter arbitrary outbound TCP connections can be a real consequence when an organization needs central domain and IP reputation filtering for outbound workloads in many AWS accounts. Here the relevant failure is that coarse geographic rules without testing can deny legitimate travelers or global partners. The alternative names a different failure mode and does not best account for the stated condition.

DNS can use TCP for larger responses or retry scenarios as well as UDP explains a different case, for example when a new on-premises BIND server is allowed to send queries to Route 53 Resolver inbound endpoint over UDP but TCP responses time out. In the current topology, the deciding factor is that weighted records influence proportions of DNS responses, not guaranteed individual HTTP requests; this choice therefore does not explain the specified remedy.

DNSSEC validation requires a trusted signed chain from parent delegation to child data explains a different case, for example when a public zone uses DNSSEC but the registrar does not publish the required DS record. In the current topology, the deciding factor is that weighted records influence proportions of DNS responses, not guaranteed individual HTTP requests; this choice therefore does not explain the specified remedy.

DNS-based failover quality depends on application-aware endpoint health evidence explains a different case, for example when a Route 53 failover record references a health check that tests only the landing page while the API path is broken. In the current topology, the deciding factor is that weighted records influence proportions of DNS responses, not guaranteed individual HTTP requests; this choice therefore does not explain the specified remedy.

BGP session establishment requires compatible ASN and network peer configuration explains a different case, for example when an on-premises site sends traffic to AWS over VPN but the customer router rejects expected BGP adjacency. In the current topology, the deciding factor is that hybrid failover depends on BGP route convergence and an independent alternative path; this choice therefore does not explain the specified remedy.

Physical circuit readiness alone does not complete layer-three route exchange with AWS gateways explains a different case, for example when an approved Direct Connect connection is provisioned but private prefixes do not appear in the data center BGP table. In the current topology, the deciding factor is that hybrid failover depends on BGP route convergence and an independent alternative path; this choice therefore does not explain the specified remedy.

Dynamic routing convergence requires failure detection and withdrawing unusable next hops explains a different case, for example when a disaster recovery exercise shows VPN routes remain pinned to a removed data center after an appliance failure. In the current topology, the deciding factor is that hybrid failover depends on BGP route convergence and an independent alternative path; this choice therefore does not explain the specified remedy.

A public VIF with unrelated public routes cannot reach the internal transit attachment can be a real consequence when a data center connects to a shared Transit Gateway through a Direct Connect gateway and the route table lacks the VPC destination. Here the relevant failure is that a regional Direct Connect attachment alone does not imply reachability to every distant VPC. The alternative names a different failure mode and does not best account for the stated condition.

Manually hiding the failed appliance without removing its routes can create persistent black holes can be a real consequence when a disaster recovery exercise shows VPN routes remain pinned to a removed data center after an appliance failure. Here the relevant failure is that a regional Direct Connect attachment alone does not imply reachability to every distant VPC. The alternative names a different failure mode and does not best account for the stated condition.

An IPsec-up tunnel does not guarantee the required subnet route is installed can be a real consequence when one Site-to-Site VPN tunnel is healthy but a peer refuses incoming routes because of a prefix filter. Here the relevant failure is that a regional Direct Connect attachment alone does not imply reachability to every distant VPC. The alternative names a different failure mode and does not best account for the stated condition.

Direct Connect alone provides private transport rather than inherent IP payload encryption explains a different case, for example when a company must encrypt sensitive hybrid application traffic even though it uses a private Direct Connect circuit. In the current topology, the deciding factor is that prefix overlap and route preference can silently divert traffic to unintended networks; this choice therefore does not explain the specified remedy.

Transit Gateway Connect supports SD-WAN overlay connectivity through the supported attachment model explains a different case, for example when a distributed branch solution needs SD-WAN appliance integration with Transit Gateway using overlay tunnels. In the current topology, the deciding factor is that prefix overlap and route preference can silently divert traffic to unintended networks; this choice therefore does not explain the specified remedy.

AWS Site-to-Site VPN connections normally supply two tunnels for availability explains a different case, for example when a company needs a redundant Site-to-Site VPN and both standard tunnels terminate on customer gateway devices. In the current topology, the deciding factor is that prefix overlap and route preference can silently divert traffic to unintended networks; this choice therefore does not explain the specified remedy.

A single Direct Connect circuit creates a physical connectivity single point of failure can be a real consequence when a bank needs predictable private connectivity into AWS with an internet VPN failover during circuit outage. Here the relevant failure is that selecting a private VIF does not by itself authorize routing to all AWS public IP services. The alternative names a different failure mode and does not best account for the stated condition.

A healthy physical Direct Connect port does not prove route advertisements are accepted can be a real consequence when an on-premises router cannot reach AWS advertised networks because its peer omits required customer prefixes. Here the relevant failure is that selecting a private VIF does not by itself authorize routing to all AWS public IP services. The alternative names a different failure mode and does not best account for the stated condition.

Creating two VIFs on one router does not eliminate shared physical failure can be a real consequence when two on-premises data centers require dedicated diverse private circuits to critical AWS Regions. Here the relevant failure is that selecting a private VIF does not by itself authorize routing to all AWS public IP services. The alternative names a different failure mode and does not best account for the stated condition.

Assuming TCP passthrough performs application-layer client certificate validation can be incorrect can be a real consequence when a service must authenticate incoming HTTPS clients at a proxy without terminating encryption at the wrong tier. Here the relevant failure is that a normal HTTP ALB is not a drop-in transparent inspection hop for arbitrary IP packets. The alternative names a different failure mode and does not best account for the stated condition.

Manually editing generated ALB listeners outside the controller may be overwritten can be a real consequence when an EKS platform needs Kubernetes Ingress-driven creation of an ALB across cluster namespaces. Here the relevant failure is that a normal HTTP ALB is not a drop-in transparent inspection hop for arbitrary IP packets. The alternative names a different failure mode and does not best account for the stated condition.

Increasing instance CPU cannot fix a shorter intermediary idle timeout can be a real consequence when a long-running upload behind an ALB is cut off after idle periods although the target process stays alive. Here the relevant failure is that a normal HTTP ALB is not a drop-in transparent inspection hop for arbitrary IP packets. The alternative names a different failure mode and does not best account for the stated condition.