Packet-path validation confirms encrypted payloads across the required transport hop might confirm another remediation, for instance when a company must encrypt sensitive hybrid application traffic even though it uses a private Direct Connect circuit. This question instead requires demonstrating that approved on-premises prefixes reach connected VPC routes without public internet hops. The alternative would not validate the selected network fix.

Trace tests show the largest permitted packet traverses the overlay without blackholing might confirm another remediation, for instance when a company has a 1 Gbps Direct Connect and sees packet drops only when sending oversized frames across a VPN overlay. This question instead requires demonstrating that approved on-premises prefixes reach connected VPC routes without public internet hops. The alternative would not validate the selected network fix.

BGP route advertisements produce the documented active and backup path preference might confirm another remediation, for instance when an enterprise wants routing priority between two BGP peers without changing every application subnet. This question instead requires demonstrating that approved on-premises prefixes reach connected VPC routes without public internet hops. The alternative would not validate the selected network fix.

Network interface allocation can be limited by available subnet addresses and service quotas explains a different case, for example when a subnet has enough addresses on paper but ECS tasks cannot create ENIs in one availability zone. In the current topology, the deciding factor is that load-balancer health and client name resolution both affect which service receives packets; this choice therefore does not explain the specified remedy.

Network path failures require examining each packet-filter and endpoint layer explains a different case, for example when an EC2 instance drops UDP while TCP works and a team assumes the security group must be the only blocker. In the current topology, the deciding factor is that load-balancer health and client name resolution both affect which service receives packets; this choice therefore does not explain the specified remedy.

Load balancer request distribution depends on backend health and lifecycle coordination explains a different case, for example when an internal ALB becomes slow only during an autoscaling event and new targets receive requests before initialization. In the current topology, the deciding factor is that load-balancer health and client name resolution both affect which service receives packets; this choice therefore does not explain the specified remedy.

Enable VPC Flow Logs at the required VPC, subnet, or ENI scope and protected destination would address a different scenario, such as when a VPC networking team needs metadata about accepted and rejected connections for an incident baseline. The present issue requires use VPC Traffic Mirroring with a supported capture target and scoped filters because the network path and control point are different; the alternative does not directly meet this requirement.

Use VPC Reachability Analyzer to examine the configuration path for the source and destination would address a different scenario, such as when a network engineer wants automated proof that a security group and route table permit an intended VPC path. The present issue requires use VPC Traffic Mirroring with a supported capture target and scoped filters because the network path and control point are different; the alternative does not directly meet this requirement.

Collect repeated synthetic measurements and link metrics across representative routes and times would address a different scenario, such as when a business needs a defensible hybrid network baseline for latency, packet loss, and utilization before adding Direct Connect. The present issue requires use VPC Traffic Mirroring with a supported capture target and scoped filters because the network path and control point are different; the alternative does not directly meet this requirement.

TLS termination at a load balancer does not automatically encrypt every backend hop explains a different case, for example when an application uses an ALB with HTTPS listeners but must ensure encryption continues to backend instances. In the current topology, the deciding factor is that gateway Load Balancer uses GENEVE to distribute network flows to security appliance targets; this choice therefore does not explain the specified remedy.

TLS listener design determines which component possesses the private key and sees plaintext explains a different case, for example when a service must authenticate incoming HTTPS clients at a proxy without terminating encryption at the wrong tier. In the current topology, the deciding factor is that gateway Load Balancer uses GENEVE to distribute network flows to security appliance targets; this choice therefore does not explain the specified remedy.

Load balancer target health must test readiness rather than authentication-protected business pages explains a different case, for example when a batch service runs healthy processes but fails ALB health checks because the probe path requires a user login. In the current topology, the deciding factor is that gateway Load Balancer uses GENEVE to distribute network flows to security appliance targets; this choice therefore does not explain the specified remedy.

Validate dynamic routing preference and backup advertisements before fault injection would address a different scenario, such as when the Direct Connect physical port is down but the application must automatically use an existing backup VPN. The present issue requires check the customer gateway ASN, configured peer addresses and permitted TCP BGP sessions because the network path and control point are different; the alternative does not directly meet this requirement.

Configure both AWS-provided tunnels with monitored backup operation would address a different scenario, such as when an enterprise provisions a VPN but only one of its provided tunnel endpoint configurations is deployed. The present issue requires check the customer gateway ASN, configured peer addresses and permitted TCP BGP sessions because the network path and control point are different; the alternative does not directly meet this requirement.

Review IPsec security associations, protected networks, and return-route/filter policy would address a different scenario, such as when an on-premises firewall permits IPSec negotiation but blocks encapsulated user traffic after tunnel setup. The present issue requires check the customer gateway ASN, configured peer addresses and permitted TCP BGP sessions because the network path and control point are different; the alternative does not directly meet this requirement.

CloudTrail management events do not contain TCP packet payload evidence can be a real consequence when an internal review needs proof that the same TCP conversation was observed at an inspection point during a suspected incident. Here the relevant failure is that an aggregate blocked-request graph cannot reveal the responsible request rule. The alternative names a different failure mode and does not best account for the stated condition.

Permanent unreviewed exclusions can silently remove important workloads from policy can be a real consequence when a regulated business uses Firewall Manager but resource exceptions have no owner or expiration date. Here the relevant failure is that an aggregate blocked-request graph cannot reveal the responsible request rule. The alternative names a different failure mode and does not best account for the stated condition.

Collecting every record is insufficient if users can silently erase the logs can be a real consequence when an organization centralizes network logs but data analysts have permission to delete or alter evidence. Here the relevant failure is that an aggregate blocked-request graph cannot reveal the responsible request rule. The alternative names a different failure mode and does not best account for the stated condition.

Skipping hostname checks permits an attacker-controlled certificate for a different service can be a real consequence when an API uses application TLS but accepts any certificate hostname for connections to a private upstream. Here the relevant failure is that a publicly trusted certificate authority is not a substitute for managing private trust needs. The alternative names a different failure mode and does not best account for the stated condition.

A leaked signing key could allow attackers to mint trusted internal identities can be a real consequence when an organization needs a private TLS certificate for service-to-service connections and considers embedding the CA private key in a container image. Here the relevant failure is that a publicly trusted certificate authority is not a substitute for managing private trust needs. The alternative names a different failure mode and does not best account for the stated condition.

A valid certificate chain alone cannot establish identity if an attacker stole the private key can be a real consequence when an internal service uses mutual TLS but its client certificates are copied into publicly accessible build artifacts. Here the relevant failure is that a publicly trusted certificate authority is not a substitute for managing private trust needs. The alternative names a different failure mode and does not best account for the stated condition.

Traffic converges to the remaining gateway and the obsolete route disappears might confirm another remediation, for instance when a disaster recovery exercise shows VPN routes remain pinned to a removed data center after an appliance failure. This question instead requires demonstrating that new approved AWS prefixes are learned or explicitly installed and test packets reach them. The alternative would not validate the selected network fix.

Approved public endpoint traffic follows the expected Direct Connect public routing path might confirm another remediation, for instance when a company needs public AWS service API access across a Direct Connect public VIF but has not advertised eligible public prefixes. This question instead requires demonstrating that new approved AWS prefixes are learned or explicitly installed and test packets reach them. The alternative would not validate the selected network fix.

Route tables select the preferred link and revert on primary failure might confirm another remediation, for instance when a connection uses two Direct Connect links and business policy requires a preferred active path rather than equal splitting. This question instead requires demonstrating that new approved AWS prefixes are learned or explicitly installed and test packets reach them. The alternative would not validate the selected network fix.

Transit gateway attachment authorization is a governance boundary before route propagation explains a different case, for example when a company wants to prevent untrusted VPCs from attaching to a central Transit Gateway automatically. In the current topology, the deciding factor is that detect-only visibility and packet blocking are different network-control outcomes; this choice therefore does not explain the specified remedy.

Layer-seven geographic filtering can be applied at supported web entry points explains a different case, for example when a production ALB must accept only approved client geographies under documented policy while retaining measured business exceptions. In the current topology, the deciding factor is that detect-only visibility and packet blocking are different network-control outcomes; this choice therefore does not explain the specified remedy.

Centralized egress filtering is effective only when alternative unfiltered exits are removed explains a different case, for example when a company routes all outbound traffic through a transparent proxy but direct routes to the NAT gateway remain available. In the current topology, the deciding factor is that detect-only visibility and packet blocking are different network-control outcomes; this choice therefore does not explain the specified remedy.

Creating a NAT gateway in one VPC does not automatically serve remote VPCs can be a real consequence when a large AWS organization needs egress through centralized networking while preserving per-spoke isolation. Here the relevant failure is that attaching a firewall VPC alone does not force other attachments to traverse it. The alternative names a different failure mode and does not best account for the stated condition.

Hardcoding provider IP addresses bypasses endpoint lifecycle and can break replacement can be a real consequence when an enterprise tries to make private endpoints in many accounts resolve consistently while preserving independent service accounts. Here the relevant failure is that attaching a firewall VPC alone does not force other attachments to traverse it. The alternative names a different failure mode and does not best account for the stated condition.

Sharing the provider account's full route table is not needed for one selected service can be a real consequence when two accounts need to expose a service but organization policy forbids consumer access to provider route tables. Here the relevant failure is that attaching a firewall VPC alone does not force other attachments to traverse it. The alternative names a different failure mode and does not best account for the stated condition.

AWS RAM enables resource sharing without making the spoke account the transit resource owner explains a different case, for example when a central networking account owns a Transit Gateway, but a workload account cannot attach without approved sharing. In the current topology, the deciding factor is that central egress requires matching spoke default routes and return-path routes through approved shared services; this choice therefore does not explain the specified remedy.

Name resolution and service-level authorization must complement endpoint networking rather than imply full-network trust explains a different case, for example when an enterprise tries to make private endpoints in many accounts resolve consistently while preserving independent service accounts. In the current topology, the deciding factor is that central egress requires matching spoke default routes and return-path routes through approved shared services; this choice therefore does not explain the specified remedy.

PrivateLink separates provider service publishing from consumer network route administration explains a different case, for example when two accounts need to expose a service but organization policy forbids consumer access to provider route tables. In the current topology, the deciding factor is that central egress requires matching spoke default routes and return-path routes through approved shared services; this choice therefore does not explain the specified remedy.