Unauthorized principals are denied destructive calls even from approved subnets might confirm another remediation, for instance when an internal API uses a private endpoint but allows every company user to invoke destructive service operations. This question instead requires demonstrating that negative packets are dropped and a corresponding firewall alert is retained. The alternative would not validate the selected network fix.

New eligible resources receive the expected managed protection under the central policy might confirm another remediation, for instance when a company wants standardized AWS WAF policies across hundreds of managed accounts and distributions. This question instead requires demonstrating that negative packets are dropped and a corresponding firewall alert is retained. The alternative would not validate the selected network fix.

Permitted initiated sessions return successfully without unrelated new inbound access might confirm another remediation, for instance when a network engineer opens all ephemeral ports inbound in a security group believing return packets require explicit permits. This question instead requires demonstrating that negative packets are dropped and a corresponding firewall alert is retained. The alternative would not validate the selected network fix.

Set scoped retention and protected cross-account delivery for network telemetry would address a different scenario, such as when a log pipeline uses short retention even though regulators require investigation records after employee departure. The present issue requires create CloudWatch alarms on supported Site-to-Site VPN tunnel state metrics because the network path and control point are different; the alternative does not directly meet this requirement.

Use VPC Reachability Analyzer to examine the configuration path for the source and destination would address a different scenario, such as when a network engineer wants automated proof that a security group and route table permit an intended VPC path. The present issue requires create CloudWatch alarms on supported Site-to-Site VPN tunnel state metrics because the network path and control point are different; the alternative does not directly meet this requirement.

Collect Transit Gateway flow logs with attachment identifiers where supported would address a different scenario, such as when a shared-services VPC receives unexpected traffic and must correlate which transit attachment it came from. The present issue requires create CloudWatch alarms on supported Site-to-Site VPN tunnel state metrics because the network path and control point are different; the alternative does not directly meet this requirement.

Design load balancer availability with enabled zones, healthy targets, and cross-zone considerations would address a different scenario, such as when a multi-AZ target group shows one AZ unavailable when all targets there become unhealthy. The present issue requires review the ALB idle timeout against legitimate application transfer patterns because the network path and control point are different; the alternative does not directly meet this requirement.

Select compatible load balancer TLS termination or passthrough and certificate-validation placement would address a different scenario, such as when a service must authenticate incoming HTTPS clients at a proxy without terminating encryption at the wrong tier. The present issue requires review the ALB idle timeout against legitimate application transfer patterns because the network path and control point are different; the alternative does not directly meet this requirement.

Use an Application Load Balancer with appropriate listener rules and AWS WAF association would address a different scenario, such as when a web application needs path routing, HTTP host rules, and WAF inspection for incoming requests. The present issue requires review the ALB idle timeout against legitimate application transfer patterns because the network path and control point are different; the alternative does not directly meet this requirement.

Attaching a firewall VPC alone does not force other attachments to traverse it can be a real consequence when a company wants security appliances in one inspection VPC but discovers spoke traffic can bypass the appliance. Here the relevant failure is that peering two transit gateways does not automatically propagate every VPC route across Regions. The alternative names a different failure mode and does not best account for the stated condition.

Hardcoding provider IP addresses bypasses endpoint lifecycle and can break replacement can be a real consequence when an enterprise tries to make private endpoints in many accounts resolve consistently while preserving independent service accounts. Here the relevant failure is that peering two transit gateways does not automatically propagate every VPC route across Regions. The alternative names a different failure mode and does not best account for the stated condition.

Assuming shared VPCs imply all participant accounts share IAM privileges can weaken governance can be a real consequence when many application accounts share centrally owned subnet infrastructure but require isolated resource ownership. Here the relevant failure is that peering two transit gateways does not automatically propagate every VPC route across Regions. The alternative names a different failure mode and does not best account for the stated condition.

Packet-path validation confirms encrypted payloads across the required transport hop might confirm another remediation, for instance when a company must encrypt sensitive hybrid application traffic even though it uses a private Direct Connect circuit. This question instead requires demonstrating that bGP route advertisements produce the documented active and backup path preference. The alternative would not validate the selected network fix.

Trace tests show the largest permitted packet traverses the overlay without blackholing might confirm another remediation, for instance when a company has a 1 Gbps Direct Connect and sees packet drops only when sending oversized frames across a VPN overlay. This question instead requires demonstrating that bGP route advertisements produce the documented active and backup path preference. The alternative would not validate the selected network fix.

Overlay BGP neighbors form and selected branch prefixes reach their AWS destinations might confirm another remediation, for instance when a distributed branch solution needs SD-WAN appliance integration with Transit Gateway using overlay tunnels. This question instead requires demonstrating that bGP route advertisements produce the documented active and backup path preference. The alternative would not validate the selected network fix.

Choose AWS PrivateLink service exposure with interface endpoints rather than broad routed connectivity would address a different scenario, such as when two teams have overlapping VPC CIDRs but must consume one narrowly defined service privately. The present issue requires redesign using explicit A-to-C peering or a suitable Transit Gateway transit architecture because the network path and control point are different; the alternative does not directly meet this requirement.

Design inter-Region Transit Gateway peering with routes on both gateways and attachments would address a different scenario, such as when a multi-region service requires selected cross-region VPC connectivity without moving packets over ordinary public internet routes. The present issue requires redesign using explicit A-to-C peering or a suitable Transit Gateway transit architecture because the network path and control point are different; the alternative does not directly meet this requirement.

Use VPC sharing through AWS RAM with supported participant-account resources would address a different scenario, such as when many application accounts share centrally owned subnet infrastructure but require isolated resource ownership. The present issue requires redesign using explicit A-to-C peering or a suitable Transit Gateway transit architecture because the network path and control point are different; the alternative does not directly meet this requirement.

Automatically propagating every attachment into one shared table may defeat intended separation can be a real consequence when a shared Transit Gateway route table receives propagated spokes but a sensitive subnet must never see the audit VPC. Here the relevant failure is that an expanded route table does not repair two destinations using the same address block. The alternative names a different failure mode and does not best account for the stated condition.

Making everyone a Transit Gateway administrator increases unintended topology changes can be a real consequence when a central networking account wants to accept VPC attachments from member accounts without granting them full gateway administration. Here the relevant failure is that an expanded route table does not repair two destinations using the same address block. The alternative names a different failure mode and does not best account for the stated condition.

An endpoint resource alone does not force every public hostname onto private addresses can be a real consequence when an interface endpoint exists but its private DNS alias is disabled and applications still resolve a public service address. Here the relevant failure is that an expanded route table does not repair two destinations using the same address block. The alternative names a different failure mode and does not best account for the stated condition.

TLS listener design determines which component possesses the private key and sees plaintext explains a different case, for example when a service must authenticate incoming HTTPS clients at a proxy without terminating encryption at the wrong tier. In the current topology, the deciding factor is that an ALB makes layer-seven routing decisions on HTTP request attributes; this choice therefore does not explain the specified remedy.

Application Load Balancer listeners can distribute HTTP traffic among target groups by weight explains a different case, for example when a blue-green API deployment needs weighted HTTP routing to two target groups for a controlled release. In the current topology, the deciding factor is that an ALB makes layer-seven routing decisions on HTTP request attributes; this choice therefore does not explain the specified remedy.

Gateway Load Balancer uses GENEVE to distribute network flows to security appliance targets explains a different case, for example when a fleet of virtual firewalls must receive traffic with flow symmetry and transparent appliance insertion. In the current topology, the deciding factor is that an ALB makes layer-seven routing decisions on HTTP request attributes; this choice therefore does not explain the specified remedy.

Use Transit Gateway route tables and symmetric inspection routing with appliance-mode considerations would address a different scenario, such as when a company wants security appliances in one inspection VPC but discovers spoke traffic can bypass the appliance. The present issue requires use Transit Gateway with segmented attachments and route tables because the network path and control point are different; the alternative does not directly meet this requirement.

Use VPC sharing through AWS RAM with supported participant-account resources would address a different scenario, such as when many application accounts share centrally owned subnet infrastructure but require isolated resource ownership. The present issue requires use Transit Gateway with segmented attachments and route tables because the network path and control point are different; the alternative does not directly meet this requirement.

Redesign using explicit A-to-C peering or a suitable Transit Gateway transit architecture would address a different scenario, such as when a company wants three VPCs connected through VPC peering and expects traffic from A to reach C by traversing B. The present issue requires use Transit Gateway with segmented attachments and route tables because the network path and control point are different; the alternative does not directly meet this requirement.

A blocked ping alone cannot distinguish security policy from application failure can be a real consequence when a security reviewer needs a repeatable audit that production VPC paths cannot reach a prohibited subnet. Here the relevant failure is that internet edge logs alone omit privately routed east-west transit between VPCs. The alternative names a different failure mode and does not best account for the stated condition.

A static weekly report may detect excessive permissions too late can be a real consequence when a security team wants automatic alerting on permissive security-group changes in sensitive VPCs. Here the relevant failure is that internet edge logs alone omit privately routed east-west transit between VPCs. The alternative names a different failure mode and does not best account for the stated condition.

Resolver query logging cannot necessarily reveal the administrator who changed rule association can be a real consequence when an AWS account has no trace of who modified a Route 53 Resolver forwarding rule during a DNS incident. Here the relevant failure is that internet edge logs alone omit privately routed east-west transit between VPCs. The alternative names a different failure mode and does not best account for the stated condition.

One correctly configured route table does not prove every subnet follows inspection can be a real consequence when a cloud egress inspection design allows application traffic to bypass a Network Firewall route in one availability zone. Here the relevant failure is that a resource shared to every principal can create unexpected transit attachment requests. The alternative names a different failure mode and does not best account for the stated condition.

An instance without a public IP can still have unintended paths or future exposure after changes can be a real consequence when a security architect discovers an internet gateway route on a workload subnet that should be isolated from the public internet. Here the relevant failure is that a resource shared to every principal can create unexpected transit attachment requests. The alternative names a different failure mode and does not best account for the stated condition.

A one-time manual security review cannot catch all later permissive rule changes can be a real consequence when an organization wants automated discovery of broad SSH security-group rules across its accounts. Here the relevant failure is that a resource shared to every principal can create unexpected transit attachment requests. The alternative names a different failure mode and does not best account for the stated condition.