Tunnel status indicates control connectivity but may conceal application-plane impairment explains a different case, for example when an application sees packet loss after changing a VPN's customer equipment but AWS tunnel metrics show Up. In the current topology, the deciding factor is that transit route analysis connects gateway route configuration to observed flow paths; this choice therefore does not explain the specified remedy.

End-user latency includes DNS, internet path, edge, TLS, and origin time explains a different case, for example when an API response is slow only for overseas users despite healthy compute and regional ALB metrics. In the current topology, the deciding factor is that transit route analysis connects gateway route configuration to observed flow paths; this choice therefore does not explain the specified remedy.

Packet mirroring captures selected packet-level details missing from summary flow records explains a different case, for example when an investigation requires knowing whether an EC2 guest received a malformed packet that flow records cannot describe. In the current topology, the deciding factor is that transit route analysis connects gateway route configuration to observed flow paths; this choice therefore does not explain the specified remedy.

A nonprivileged analyst can query authorized events but cannot overwrite evidence might confirm another remediation, for instance when an organization centralizes network logs but data analysts have permission to delete or alter evidence. This question instead requires demonstrating that a deliberate prohibited-path analysis reports no supported reachability. The alternative would not validate the selected network fix.

A correlated timeline identifies a relevant route change before observed flow failures might confirm another remediation, for instance when a SOC wants to distinguish whether a network outage followed a VPC routing update or an application deployment. This question instead requires demonstrating that a deliberate prohibited-path analysis reports no supported reachability. The alternative would not validate the selected network fix.

A test rule update has a corresponding CloudTrail event with actor and timestamp might confirm another remediation, for instance when a SOC needs a historical record of security group changes and the principal who made each change. This question instead requires demonstrating that a deliberate prohibited-path analysis reports no supported reachability. The alternative would not validate the selected network fix.

Backend access logs contain the verified source address for each supported endpoint type might confirm another remediation, for instance when an enterprise must preserve source-client IP for a global TCP service using an accelerator and regional targets. This question instead requires demonstrating that repeated eligible responses are served at edges and blocked HTTP requests do not reach origin. The alternative would not validate the selected network fix.

Cache hit ratio rises and origin request volume falls under equivalent viewer load might confirm another remediation, for instance when a global video publisher has high origin load because viewers repeatedly request the same public media files. This question instead requires demonstrating that repeated eligible responses are served at edges and blocked HTTP requests do not reach origin. The alternative would not validate the selected network fix.

Existing endpoint configuration remains constant while new UDP traffic shifts to a healthy Region might confirm another remediation, for instance when a multiplayer client cannot tolerate DNS change delays during regional failure and uses UDP transport. This question instead requires demonstrating that repeated eligible responses are served at edges and blocked HTTP requests do not reach origin. The alternative would not validate the selected network fix.

Source-IP visibility depends on supported endpoint integrations and forwarding semantics explains a different case, for example when an enterprise must preserve source-client IP for a global TCP service using an accelerator and regional targets. In the current topology, the deciding factor is that geographic access controls and origin selection must align with legal data location requirements; this choice therefore does not explain the specified remedy.

Global Accelerator manages healthy regional endpoint selection independently of customer DNS caches explains a different case, for example when a public application has two regional ALBs and wants traffic to fail away from an entire unhealthy application Region. In the current topology, the deciding factor is that geographic access controls and origin selection must align with legal data location requirements; this choice therefore does not explain the specified remedy.

CloudFront and AWS WAF apply supported layer-seven controls at the edge explains a different case, for example when a web application needs HTTP edge caching and WAF protection but was placed behind a TCP-only NLB. In the current topology, the deciding factor is that geographic access controls and origin selection must align with legal data location requirements; this choice therefore does not explain the specified remedy.

Centralized egress must provide a working bidirectional route chain through stateful NAT explains a different case, for example when a spoke VPC with a default route to Transit Gateway cannot reach the internet through central NAT because the egress VPC lacks the return path. In the current topology, the deciding factor is that a private subnet without public IPs uses NAT for ordinary IPv4 internet egress; this choice therefore does not explain the specified remedy.

IPv6-to-IPv4 reachability requires explicit protocol translation, not just egress-only IPv6 internet access explains a different case, for example when a VPC with IPv6-only workloads must reach IPv4-only endpoints while NAT64 support is not configured. In the current topology, the deciding factor is that a private subnet without public IPs uses NAT for ordinary IPv4 internet egress; this choice therefore does not explain the specified remedy.

VPC sharing separates ownership of shared network constructs from participant workloads explains a different case, for example when an AWS organization has a shared VPC but a participant account cannot edit the subnet route table it does not own. In the current topology, the deciding factor is that a private subnet without public IPs uses NAT for ordinary IPv4 internet egress; this choice therefore does not explain the specified remedy.

An aged sample remains available to authorized auditors after the required interval might confirm another remediation, for instance when a log pipeline uses short retention even though regulators require investigation records after employee departure. This question instead requires demonstrating that records show source, destination, ports, action, and expected time ranges. The alternative would not validate the selected network fix.

A recorded route change contains actor, timestamp, and request context in protected logs might confirm another remediation, for instance when an organization wants retained proof of networking API configuration changes across AWS accounts. This question instead requires demonstrating that records show source, destination, ports, action, and expected time ranges. The alternative would not validate the selected network fix.

Attachment state and route views match the approved network topology might confirm another remediation, for instance when a hybrid transit network has many attachments and needs a central view of route reachability and network events. This question instead requires demonstrating that records show source, destination, ports, action, and expected time ranges. The alternative would not validate the selected network fix.

Encapsulation headers reduce usable payload MTU even when underlying links support jumbo frames explains a different case, for example when a company has a 1 Gbps Direct Connect and sees packet drops only when sending oversized frames across a VPN overlay. In the current topology, the deciding factor is that bGP path selection uses advertised prefixes and applicable attributes at each decision point; this choice therefore does not explain the specified remedy.

Transit Gateway Connect supports SD-WAN overlay connectivity through the supported attachment model explains a different case, for example when a distributed branch solution needs SD-WAN appliance integration with Transit Gateway using overlay tunnels. In the current topology, the deciding factor is that bGP path selection uses advertised prefixes and applicable attributes at each decision point; this choice therefore does not explain the specified remedy.

A public VIF exchanges suitable public routes to AWS public endpoints rather than arbitrary private VPC prefixes explains a different case, for example when a corporate office needs AWS public service endpoints over a dedicated public routing path without private VPC address exchange. In the current topology, the deciding factor is that bGP path selection uses advertised prefixes and applicable attributes at each decision point; this choice therefore does not explain the specified remedy.

Review prefix specificity, path policy and approved route advertisements would address a different scenario, such as when a VPN route from a customer site suddenly loses preference to a newly advertised overlapping longer prefix. The present issue requires inspect both peer route tables and stateful/stateless security filters because the network path and control point are different; the alternative does not directly meet this requirement.

Map subnet default routes and migrate to the approved centralized egress next hop would address a different scenario, such as when a company retires a public NAT egress path but monitoring shows applications still using it. The present issue requires inspect both peer route tables and stateful/stateless security filters because the network path and control point are different; the alternative does not directly meet this requirement.

Align BGP and VPC route choices for consistent forward and return paths would address a different scenario, such as when a local firewall routes database traffic via Direct Connect but the AWS VPC return route points to VPN. The present issue requires inspect both peer route tables and stateful/stateless security filters because the network path and control point are different; the alternative does not directly meet this requirement.

CDN cache behavior and origin latency need separate measurements to localize performance bottlenecks explains a different case, for example when a customer says a CloudFront distribution is slow but has no edge cache or origin performance baseline. In the current topology, the deciding factor is that transit Gateway-level flow telemetry can identify attachment context absent from local application logs; this choice therefore does not explain the specified remedy.

VPC Flow Logs capture flow metadata rather than full application payloads explains a different case, for example when a VPC networking team needs metadata about accepted and rejected connections for an incident baseline. In the current topology, the deciding factor is that transit Gateway-level flow telemetry can identify attachment context absent from local application logs; this choice therefore does not explain the specified remedy.

Layer-seven access logs and target metrics expose request outcomes beyond basic network flows explains a different case, for example when a multi-region API owner wants to distinguish ALB client errors from backend target failures. In the current topology, the deciding factor is that transit Gateway-level flow telemetry can identify attachment context absent from local application logs; this choice therefore does not explain the specified remedy.

Accelerated VPN can use AWS global network to reduce some internet-path variability explains a different case, for example when a remote office experiences internet variability to the selected AWS VPN region and wants improved entry routing. In the current topology, the deciding factor is that direct Connect gateway enables supported private routing connectivity to eligible gateways; this choice therefore does not explain the specified remedy.

BGP path selection uses advertised prefixes and applicable attributes at each decision point explains a different case, for example when an enterprise wants routing priority between two BGP peers without changing every application subnet. In the current topology, the deciding factor is that direct Connect gateway enables supported private routing connectivity to eligible gateways; this choice therefore does not explain the specified remedy.

AWS Site-to-Site VPN connections normally supply two tunnels for availability explains a different case, for example when a company needs a redundant Site-to-Site VPN and both standard tunnels terminate on customer gateway devices. In the current topology, the deciding factor is that direct Connect gateway enables supported private routing connectivity to eligible gateways; this choice therefore does not explain the specified remedy.

Move the required explicit subnet deny to an NACL or use compatible firewall policy would address a different scenario, such as when a developer says a security group deny rule should override an earlier allow but SG rules have no explicit deny action. The present issue requires deploy centralized AWS Network Firewall or governed proxy with explicit egress routes because the network path and control point are different; the alternative does not directly meet this requirement.

Require approved RAM principals and Transit Gateway attachment acceptance or controlled network policy would address a different scenario, such as when a company wants to prevent untrusted VPCs from attaching to a central Transit Gateway automatically. The present issue requires deploy centralized AWS Network Firewall or governed proxy with explicit egress routes because the network path and control point are different; the alternative does not directly meet this requirement.

Use minimal stateful SG rules and carefully scope any stateless NACL return ports would address a different scenario, such as when a network engineer opens all ephemeral ports inbound in a security group believing return packets require explicit permits. The present issue requires deploy centralized AWS Network Firewall or governed proxy with explicit egress routes because the network path and control point are different; the alternative does not directly meet this requirement.