Assuming static VPN routing detects every remote CIDR change can blackhole traffic can be a real consequence when a customer VPN uses static routing while the team expects automatic failover after network changes. Here the relevant failure is that a public VIF with unrelated public routes cannot reach the internal transit attachment. The alternative names a different failure mode and does not best account for the stated condition.

A VPC route toward the branch alone cannot deliver response packets back on premises can be a real consequence when a remote branch cannot reach AWS because its advertised VPC return prefix is absent from the corporate router. Here the relevant failure is that a public VIF with unrelated public routes cannot reach the internal transit attachment. The alternative names a different failure mode and does not best account for the stated condition.

Manually hiding the failed appliance without removing its routes can create persistent black holes can be a real consequence when a disaster recovery exercise shows VPN routes remain pinned to a removed data center after an appliance failure. Here the relevant failure is that a public VIF with unrelated public routes cannot reach the internal transit attachment. The alternative names a different failure mode and does not best account for the stated condition.

A single Direct Connect circuit creates a physical connectivity single point of failure can be a real consequence when a bank needs predictable private connectivity into AWS with an internet VPN failover during circuit outage. Here the relevant failure is that operating only one tunnel sacrifices built-in redundancy during endpoint maintenance. The alternative names a different failure mode and does not best account for the stated condition.

Selecting a private VIF does not by itself authorize routing to all AWS public IP services can be a real consequence when a corporate office needs AWS public service endpoints over a dedicated public routing path without private VPC address exchange. Here the relevant failure is that operating only one tunnel sacrifices built-in redundancy during endpoint maintenance. The alternative names a different failure mode and does not best account for the stated condition.

Enabling jumbo frames only on an EC2 instance does not resolve smaller tunnel path MTU can be a real consequence when a company has a 1 Gbps Direct Connect and sees packet drops only when sending oversized frames across a VPN overlay. Here the relevant failure is that operating only one tunnel sacrifices built-in redundancy during endpoint maintenance. The alternative names a different failure mode and does not best account for the stated condition.

Least-privilege automation credentials reduce blast radius of a compromised pipeline explains a different case, for example when a deployment job has broad administrator rights just to create one VPC endpoint and associated route entries. In the current topology, the deciding factor is that network resources are often provisioned asynchronously and require status validation; this choice therefore does not explain the specified remedy.

Compliance evaluation should drive timely notification or controlled auto-remediation explains a different case, for example when an AWS Config rule finds unauthorized changes in VPC route tables but nobody learns about them until audit time. In the current topology, the deciding factor is that network resources are often provisioned asynchronously and require status validation; this choice therefore does not explain the specified remedy.

Policy-as-code can detect unsafe route definitions before infrastructure is provisioned explains a different case, for example when a team wants a new VPC module to expose only approved prefixes rather than permitting default routes to any peer. In the current topology, the deciding factor is that network resources are often provisioned asynchronously and require status validation; this choice therefore does not explain the specified remedy.

Use physically diverse Direct Connect connections and redundancy designs meeting the resiliency target would address a different scenario, such as when two on-premises data centers require dedicated diverse private circuits to critical AWS Regions. The present issue requires plan consistent end-to-end MTU and MSS handling across tunnel encapsulation because the network path and control point are different; the alternative does not directly meet this requirement.

Configure both VPN tunnels and track routing or static route policy for failover would address a different scenario, such as when a company needs a redundant Site-to-Site VPN and both standard tunnels terminate on customer gateway devices. The present issue requires plan consistent end-to-end MTU and MSS handling across tunnel encapsulation because the network path and control point are different; the alternative does not directly meet this requirement.

Design nonoverlapping CIDRs and precise advertised prefixes across hybrid BGP boundaries would address a different scenario, such as when an on-premises route is summarized too broadly and overlaps multiple cloud address ranges. The present issue requires plan consistent end-to-end MTU and MSS handling across tunnel encapsulation because the network path and control point are different; the alternative does not directly meet this requirement.

AWS Site-to-Site VPN connections normally supply two tunnels for availability explains a different case, for example when a company needs a redundant Site-to-Site VPN and both standard tunnels terminate on customer gateway devices. In the current topology, the deciding factor is that a public VIF exchanges suitable public routes to AWS public endpoints rather than arbitrary private VPC prefixes; this choice therefore does not explain the specified remedy.

Direct Connect high availability depends on independent locations and devices, not merely two VLANs explains a different case, for example when two on-premises data centers require dedicated diverse private circuits to critical AWS Regions. In the current topology, the deciding factor is that a public VIF exchanges suitable public routes to AWS public endpoints rather than arbitrary private VPC prefixes; this choice therefore does not explain the specified remedy.

Prefix overlap and route preference can silently divert traffic to unintended networks explains a different case, for example when an on-premises route is summarized too broadly and overlaps multiple cloud address ranges. In the current topology, the deciding factor is that a public VIF exchanges suitable public routes to AWS public endpoints rather than arbitrary private VPC prefixes; this choice therefore does not explain the specified remedy.

Approved test ports work and disallowed connection attempts are rejected might confirm another remediation, for instance when a government workload must prove that only approved ports cross an external VPN into a regulated VPC. This question instead requires demonstrating that privileged URL requests are denied to untrusted clients and normal paths work. The alternative would not validate the selected network fix.

The proxy can reach HTTPS and unrelated sources cannot open SSH might confirm another remediation, for instance when an EC2-based application needs inbound HTTPS from a trusted proxy but no public SSH connections. This question instead requires demonstrating that privileged URL requests are denied to untrusted clients and normal paths work. The alternative would not validate the selected network fix.

Test requests from documented allowed and denied locations match the reviewed policy might confirm another remediation, for instance when a production ALB must accept only approved client geographies under documented policy while retaining measured business exceptions. This question instead requires demonstrating that privileged URL requests are denied to untrusted clients and normal paths work. The alternative would not validate the selected network fix.

BGP neighbor state and accepted prefixes match the intended VPC networks might confirm another remediation, for instance when an approved Direct Connect connection is provisioned but private prefixes do not appear in the data center BGP table. This question instead requires demonstrating that packet-size probes and application transfers succeed at a supported effective MTU. The alternative would not validate the selected network fix.

Disabling one entire location leaves the secondary hybrid path carrying traffic might confirm another remediation, for instance when a company wants a redundant connection but its two hosted Direct Connect links terminate in the same colocation facility. This question instead requires demonstrating that packet-size probes and application transfers succeed at a supported effective MTU. The alternative would not validate the selected network fix.

Traffic shifts to an active VPN tunnel with correct return routes might confirm another remediation, for instance when the Direct Connect physical port is down but the application must automatically use an existing backup VPN. This question instead requires demonstrating that packet-size probes and application transfers succeed at a supported effective MTU. The alternative would not validate the selected network fix.

A/B mobile image variants remain distinct while tracking-only requests share cache objects might confirm another remediation, for instance when a news publisher wants different images cached by device class but never by irrelevant tracking parameters. This question instead requires demonstrating that backend access logs contain the verified source address for each supported endpoint type. The alternative would not validate the selected network fix.

Clients retain the same advertised addresses when the unhealthy Region loses traffic might confirm another remediation, for instance when a trading client needs static anycast IP addresses and TCP endpoint failover across Regions. This question instead requires demonstrating that backend access logs contain the verified source address for each supported endpoint type. The alternative would not validate the selected network fix.

Response headers and CloudFront metrics show sustained image cache hits might confirm another remediation, for instance when an online shop sees repeated CloudFront origin fetches for images despite stable object contents. This question instead requires demonstrating that backend access logs contain the verified source address for each supported endpoint type. The alternative would not validate the selected network fix.

DNS naming and certificate identity must match regardless of whether the IP is private explains a different case, for example when an application uses private DNS for its service but clients fail TLS validation because the certificate contains only the public hostname. In the current topology, the deciding factor is that global Accelerator improves network routing but does not inherently encrypt arbitrary TCP payloads; this choice therefore does not explain the specified remedy.

Trusting the remote database identity is distinct from simply encrypting connection bytes explains a different case, for example when a company uses encrypted RDS connections but EC2 applications do not validate the RDS server certificate. In the current topology, the deciding factor is that global Accelerator improves network routing but does not inherently encrypt arbitrary TCP payloads; this choice therefore does not explain the specified remedy.

Encrypted tunnel security depends on negotiated cryptographic properties and policy compatibility explains a different case, for example when a Site-to-Site VPN has an old cipher suite that is no longer permitted under corporate cryptographic policy. In the current topology, the deciding factor is that global Accelerator improves network routing but does not inherently encrypt arbitrary TCP payloads; this choice therefore does not explain the specified remedy.

New eligible resources receive the expected managed protection under the central policy might confirm another remediation, for instance when a company wants standardized AWS WAF policies across hundreds of managed accounts and distributions. This question instead requires demonstrating that a simulated traffic event is handled by edge controls without application outage. The alternative would not validate the selected network fix.

Trace evidence shows both directions traverse the protected inspection path might confirm another remediation, for instance when a compliance network requires transparent stateful inspection of every spoke-to-spoke Transit Gateway flow. This question instead requires demonstrating that a simulated traffic event is handled by edge controls without application outage. The alternative would not validate the selected network fix.

Route validation confirms no unauthorized external path from the isolated subnet might confirm another remediation, for instance when a security architect discovers an internet gateway route on a workload subnet that should be isolated from the public internet. This question instead requires demonstrating that a simulated traffic event is handled by edge controls without application outage. The alternative would not validate the selected network fix.

A private S3 gateway route alone does not prevent access to every otherwise allowed bucket can be a real consequence when an internal endpoint for S3 must permit only a specified business bucket although a subnet route to the service is present. Here the relevant failure is that unnecessary broad inbound SG rules allow new unwanted connections, not just replies. The alternative names a different failure mode and does not best account for the stated condition.

Trying to add a nonexistent SG deny rule cannot enforce the required exclusion can be a real consequence when a developer says a security group deny rule should override an earlier allow but SG rules have no explicit deny action. Here the relevant failure is that unnecessary broad inbound SG rules allow new unwanted connections, not just replies. The alternative names a different failure mode and does not best account for the stated condition.

Manually creating unrelated web ACL rules in each account can produce configuration drift can be a real consequence when a company wants standardized AWS WAF policies across hundreds of managed accounts and distributions. Here the relevant failure is that unnecessary broad inbound SG rules allow new unwanted connections, not just replies. The alternative names a different failure mode and does not best account for the stated condition.