[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"lesson-aws-certified-cloudops-engineer-associate-networking-content-delivery-network-protection-and-cost-optimizing-network-costs-en":4,"next-aws-certified-cloudops-engineer-associate-networking-content-delivery-network-protection-and-cost-optimizing-network-costs-en":19,"prev-aws-certified-cloudops-engineer-associate-networking-content-delivery-network-protection-and-cost-optimizing-network-costs-en":821},null,{"locked":5,"reason":6,"meta":7,"item":3},true,"paywall",{"title":8,"description":9,"isFree":10,"estimatedMinutes":11,"difficulty":12,"learningObjectives":13},"Optimizing Network Costs","Network charges are not a resource you provisioned, they are a consequence of the path your packets take. This lesson covers the 3 shapes of network charge, how to read them in the bill, and the arithmetic behind NAT gateways, VPC endpoints, cross-AZ traffic, and Transit Gateway.",false,27,"intermediate",[14,15,16,17,18],"Separate the 3 shapes of network charge: hourly resource charges, per-GB processing charges, and per-GB data transfer charges","Identify network spend in the Cost and Usage Report from the usage type on each line item","Calculate the break-even point between a NAT gateway and a VPC endpoint for a given monthly volume","Explain why same-AZ, cross-AZ, cross-Region, and internet-bound traffic are priced differently and which direction is billed","Choose the right tool to find network spend: Cost Explorer, the Cost and Usage Report, VPC flow logs, and Cost Anomaly Detection",{"locked":10,"reason":3,"meta":20,"item":30},{"title":21,"description":22,"isFree":5,"estimatedMinutes":23,"difficulty":12,"learningObjectives":24},"Troubleshooting VPC Connectivity","A connection inside a VPC can fail at seven different places, and guessing wastes the outage. This lesson gives you an ordered walk down the path plus Reachability Analyzer, the tool that reads the whole path for you.",26,[25,26,27,28,29],"Apply an ordered source-to-destination walk to any VPC connectivity failure instead of checking components at random","Distinguish a security group failure from a network ACL failure from a route table failure by the symptom each one produces","Use Reachability Analyzer to test a path from configuration, and read its explanation codes","Identify the cases where Reachability Analyzer cannot answer the question and a live test is required","Recognize the failures that present as network problems but are caused by DNS, MTU, or source/destination check",{"id":31,"title":21,"body":32,"description":22,"difficulty":12,"estimatedMinutes":23,"extension":720,"infographics":721,"isFree":5,"learningObjectives":736,"meta":737,"navigation":5,"path":738,"quiz":739,"seo":818,"stem":819,"__hash__":820},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/05-network-troubleshooting/01-troubleshooting-vpc-connectivity.md",{"type":33,"value":34,"toc":711},"minimark",[35,39,42,47,50,55,102,105,108,112,115,167,174,178,181,188,199,363,366,387,391,394,538,547,551,554,595,602,606,609,623,629,635,641,645,704,707],[36,37,38],"p",{},"An application server in a private subnet cannot open a connection to an RDS instance in the same VPC. The database is running, the credentials are unchanged, and the connection just times out. You have four suspects and no evidence: a security group, a network ACL, a route table, and the possibility that the database is not listening at all.",[36,40,41],{},"Most engineers start clicking through the console in whatever order the tabs happen to be in. That works eventually. It also burns the first twenty minutes of an outage on components that were never involved. The skill this lesson teaches is not memorizing more services. It is walking the path in the order a packet walks it, so that the first thing you find wrong is actually the thing that broke.",[43,44,46],"h2",{"id":45},"the-path-has-an-order-and-so-should-you","The path has an order, and so should you",[36,48,49],{},"A packet leaving an EC2 instance passes through a fixed sequence of gates. Every one of them can deny it, and each denial looks identical from the application: a timeout. So work the sequence, not your intuition.",[51,52],"infographic",{"alt":53,"slug":54},"A left-to-right diagram of a packet path from a source instance to a destination, with 7 numbered checkpoints on the line in order: source security group, source network ACL, source route table, the intermediate gateway, destination network ACL, destination security group, and the resource policy, with a return arrow above the line.","vpc-connectivity-ordered-walk",[56,57,58,66,72,78,84,90,96],"ol",{},[59,60,61,65],"li",{},[62,63,64],"strong",{},"Source security group, outbound."," Does an egress rule allow the destination address and port? Default groups allow all outbound, so this is only a suspect in a locked-down environment. When it is the cause, it is because someone replaced the default egress rule and forgot a port.",[59,67,68,71],{},[62,69,70],{},"Source subnet network ACL, outbound."," Does an outbound rule allow the request, and does an inbound rule allow the reply on ephemeral ports? Network ACLs are stateless, so both directions are separate questions.",[59,73,74,77],{},[62,75,76],{},"Source route table."," Is there a route whose destination CIDR contains the target address, and does its target exist and work? No route means the packet is dropped before any firewall is consulted.",[59,79,80,83],{},[62,81,82],{},"The intermediate."," NAT gateway, internet gateway, VPC endpoint, peering connection, or transit gateway. Each has its own failure modes, and each was covered in the earlier topics of this domain.",[59,85,86,89],{},[62,87,88],{},"Destination subnet network ACL, inbound."," Same stateless pair of questions from the far side.",[59,91,92,95],{},[62,93,94],{},"Destination security group, inbound."," Does an ingress rule allow the source, whether by CIDR or by referencing the source's security group?",[59,97,98,101],{},[62,99,100],{},"The resource policy."," An endpoint policy, an S3 bucket policy, or a service-side policy can reject a request whose packets arrived perfectly. This one produces an error rather than a timeout, which is a useful signal on its own.",[36,103,104],{},"Then walk the return path. That sounds like a formality until you meet the failure it catches: the request is accepted, the destination replies, and the reply is denied by an outbound network ACL rule that nobody thought about because the application only ever initiates in one direction.",[36,106,107],{},"The reason this order pays is that each gate hides the ones behind it. If the route table has no match, the security group at the far end could be wide open or closed and you would never know. Checking in path order means the first denial you find is the one that matters, and everything after it is noise.",[43,109,111],{"id":110},"read-the-symptom-before-you-read-the-config","Read the symptom before you read the config",[36,113,114],{},"Three of the failures above produce distinguishable symptoms if you look at the right thing.",[116,117,118,131],"table",{},[119,120,121],"thead",{},[122,123,124,128],"tr",{},[125,126,127],"th",{},"Symptom",[125,129,130],{},"What it usually means",[132,133,134,143,151,159],"tbody",{},[122,135,136,140],{},[137,138,139],"td",{},"Connection times out with no response at all",[137,141,142],{},"A security group, a network ACL, or a missing route silently dropped the packet",[122,144,145,148],{},[137,146,147],{},"Connection refused immediately",[137,149,150],{},"The packet arrived and the destination host sent a TCP RST, so nothing in the network blocked it and the service is not listening on that port",[122,152,153,156],{},[137,154,155],{},"Connects, then hangs on large transfers",[137,157,158],{},"Path MTU problem, not a permission problem",[122,160,161,164],{},[137,162,163],{},"Immediate 403 or AccessDenied from the service",[137,165,166],{},"The network path is fine and an IAM, bucket, or endpoint policy denied the call",[36,168,169,170,173],{},"That second row deserves its own sentence, because it saves entire investigations. ",[62,171,172],{},"A \"connection refused\" error means the network worked."," The SYN reached the host, the host had nothing listening on that port, and it answered honestly. No security group produces that error, because a security group denial produces silence. When an application logs connection refused, stop looking at the VPC and go look at whether the process is running and bound to the address you think it is.",[43,175,177],{"id":176},"reachability-analyzer-reads-the-whole-path-for-you","Reachability Analyzer reads the whole path for you",[36,179,180],{},"Walking seven gates by hand across two accounts takes real time. Reachability Analyzer does it in one call.",[36,182,183,184,187],{},"The important thing to understand about it is what it actually looks at. ",[62,185,186],{},"It builds a model of your network configuration and reasons over that model. It does not send packets and it does not touch the data plane."," So it can tell you that a security group would drop this traffic, and it can tell you the exact hop-by-hop path a permitted packet would take, without any traffic existing at all. That is why it works on a resource that is completely broken, and why it works before you deploy anything real.",[36,189,190,191,194,195,198],{},"You define a ",[62,192,193],{},"path",": a source, a destination, and optionally a protocol, a destination port, and intermediate components to include or exclude. Then you run an ",[62,196,197],{},"analysis"," on that path. Supported sources and destinations are EC2 instances, internet gateways, network interfaces, transit gateways, transit gateway attachments, virtual private gateways, VPC endpoint services, VPC endpoints, and VPC peering connections, plus a plain IP address as a destination.",[200,201,206],"pre",{"className":202,"code":203,"language":204,"meta":205,"style":205},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","# 1. Define the path once\naws ec2 create-network-insights-path \\\n  --source i-0a1b2c3d4e5f67890 \\\n  --destination i-09876fedcba543210 \\\n  --destination-port 3306 \\\n  --protocol tcp\n\n# 2. Run an analysis against it, as often as you like\naws ec2 start-network-insights-analysis \\\n  --network-insights-path-id nip-0abc123def456789a\n\n# 3. Read the verdict and the explanations\naws ec2 describe-network-insights-analyses \\\n  --network-insights-analysis-ids nia-0abc123def456789a \\\n  --query 'NetworkInsightsAnalyses[0].[NetworkPathFound,Explanations]'\n","bash","",[207,208,209,218,236,248,259,271,280,286,292,304,313,318,324,336,347],"code",{"__ignoreMap":205},[210,211,214],"span",{"class":212,"line":213},"line",1,[210,215,217],{"class":216},"sutJx","# 1. Define the path once\n",[210,219,221,225,229,232],{"class":212,"line":220},2,[210,222,224],{"class":223},"sbgvK","aws",[210,226,228],{"class":227},"s_sjI"," ec2",[210,230,231],{"class":227}," create-network-insights-path",[210,233,235],{"class":234},"s_hVV"," \\\n",[210,237,239,243,246],{"class":212,"line":238},3,[210,240,242],{"class":241},"stzsN","  --source",[210,244,245],{"class":227}," i-0a1b2c3d4e5f67890",[210,247,235],{"class":234},[210,249,251,254,257],{"class":212,"line":250},4,[210,252,253],{"class":241},"  --destination",[210,255,256],{"class":227}," i-09876fedcba543210",[210,258,235],{"class":234},[210,260,262,265,269],{"class":212,"line":261},5,[210,263,264],{"class":241},"  --destination-port",[210,266,268],{"class":267},"srdBf"," 3306",[210,270,235],{"class":234},[210,272,274,277],{"class":212,"line":273},6,[210,275,276],{"class":241},"  --protocol",[210,278,279],{"class":227}," tcp\n",[210,281,283],{"class":212,"line":282},7,[210,284,285],{"emptyLinePlaceholder":5},"\n",[210,287,289],{"class":212,"line":288},8,[210,290,291],{"class":216},"# 2. Run an analysis against it, as often as you like\n",[210,293,295,297,299,302],{"class":212,"line":294},9,[210,296,224],{"class":223},[210,298,228],{"class":227},[210,300,301],{"class":227}," start-network-insights-analysis",[210,303,235],{"class":234},[210,305,307,310],{"class":212,"line":306},10,[210,308,309],{"class":241},"  --network-insights-path-id",[210,311,312],{"class":227}," nip-0abc123def456789a\n",[210,314,316],{"class":212,"line":315},11,[210,317,285],{"emptyLinePlaceholder":5},[210,319,321],{"class":212,"line":320},12,[210,322,323],{"class":216},"# 3. Read the verdict and the explanations\n",[210,325,327,329,331,334],{"class":212,"line":326},13,[210,328,224],{"class":223},[210,330,228],{"class":227},[210,332,333],{"class":227}," describe-network-insights-analyses",[210,335,235],{"class":234},[210,337,339,342,345],{"class":212,"line":338},14,[210,340,341],{"class":241},"  --network-insights-analysis-ids",[210,343,344],{"class":227}," nia-0abc123def456789a",[210,346,235],{"class":234},[210,348,350,353,357,360],{"class":212,"line":349},15,[210,351,352],{"class":241},"  --query",[210,354,356],{"class":355},"sjJ54"," '",[210,358,359],{"class":227},"NetworkInsightsAnalyses[0].[NetworkPathFound,Explanations]",[210,361,362],{"class":355},"'\n",[36,364,365],{},"Three operational facts about it are worth carrying:",[367,368,369,375,381],"ul",{},[59,370,371,374],{},[62,372,373],{},"You are charged per analysis run",", not per path, so the path object is free to keep and re-run after every change. That is what makes it useful as a regression check and not just an incident tool.",[59,376,377,380],{},[62,378,379],{},"Source and destination must be in the same Region",", and in the same VPC or in VPCs connected by peering or a transit gateway. They may be in different accounts in the same AWS Organizations organization if you enable trusted access.",[59,382,383,386],{},[62,384,385],{},"Analyses are deleted automatically 120 days after creation."," If a result is evidence for an audit, export it.",[43,388,390],{"id":389},"explanation-codes-name-the-guilty-component","Explanation codes name the guilty component",[36,392,393],{},"When a path is not reachable, the analysis returns one or more explanation codes. You do not need to memorize the full list, but recognizing the families turns a wall of output into a one-line diagnosis.",[116,395,396,406],{},[119,397,398],{},[122,399,400,403],{},[125,401,402],{},"Code",[125,404,405],{},"What it is telling you",[132,407,408,418,428,438,448,458,468,478,488,498,508,518,528],{},[122,409,410,415],{},[137,411,412],{},[207,413,414],{},"NO_ROUTE_TO_DESTINATION",[137,416,417],{},"The route table has no applicable route to the destination",[122,419,420,425],{},[137,421,422],{},[207,423,424],{},"MORE_SPECIFIC_ROUTE",[137,426,427],{},"A route exists but a longer prefix match sends the traffic elsewhere",[122,429,430,435],{},[137,431,432],{},[207,433,434],{},"SUBNET_ACL_RESTRICTION",[137,436,437],{},"The subnet's network ACL does not admit the traffic in that direction",[122,439,440,445],{},[137,441,442],{},[207,443,444],{},"ENI_SG_RULES_MISMATCH",[137,446,447],{},"The security group has no inbound or outbound rule that applies",[122,449,450,455],{},[137,451,452],{},[207,453,454],{},"SG_HAS_NO_RULES",[137,456,457],{},"The security group has no rules at all",[122,459,460,465],{},[137,461,462],{},[207,463,464],{},"ENI_SOURCE_DEST_CHECK_RESTRICTION",[137,466,467],{},"Source/destination check is rejecting forwarded traffic",[122,469,470,475],{},[137,471,472],{},[207,473,474],{},"ELBV2_NO_TARGETS_IN_AZ",[137,476,477],{},"The load balancer has no targets in the Availability Zone in question",[122,479,480,485],{},[137,481,482],{},[207,483,484],{},"TGW_ATTACH_MISSING_TGW_RTB_ASSOCIATION",[137,486,487],{},"The transit gateway attachment is not associated with any route table",[122,489,490,495],{},[137,491,492],{},[207,493,494],{},"TGW_ROUTE_AZ_RESTRICTION",[137,496,497],{},"The transit gateway is not registered in the Availability Zone the traffic starts from",[122,499,500,505],{},[137,501,502],{},[207,503,504],{},"PCX_REQUIRES_ADDRESS_IN_VPC_CIDR",[137,506,507],{},"The peering connection cannot carry an address outside the peer VPC's CIDR",[122,509,510,515],{},[137,511,512],{},[207,513,514],{},"FIREWALL_RULES_RESTRICTION",[137,516,517],{},"A matching Network Firewall rule blocked it",[122,519,520,525],{},[137,521,522],{},[207,523,524],{},"DISCONNECTED_VPCS",[137,526,527],{},"The two VPCs are not connected by any supported resource at all",[122,529,530,535],{},[137,531,532],{},[207,533,534],{},"NO_PATH",[137,536,537],{},"No path was found, commonly because of an unsupported feature such as IPv6",[36,539,540,541,543,544,546],{},"Two of those codes teach something beyond their own message. ",[207,542,424],{}," is the routing lesson restated as a diagnosis: your route is present and correct and still unused, because something longer matched first. And ",[207,545,484],{}," is the association-versus-propagation distinction from the transit gateway lesson showing up as a concrete failure, since an attachment that propagates routes but is associated with nothing has no route table to consult.",[43,548,550],{"id":549},"where-the-model-stops-and-the-packets-start","Where the model stops and the packets start",[36,552,553],{},"Reachability Analyzer is a configuration checker, so it is blind to everything that is not configuration. Knowing its blind spots is what keeps a green result from misleading you.",[367,555,556,562,571,577,583,589],{},[59,557,558,561],{},[62,559,560],{},"It does not consider the health of registered targets."," A load balancer whose targets are all failing health checks will still analyze as reachable.",[59,563,564,567,568,570],{},[62,565,566],{},"It supports only IPv4."," If a resource has both address families, only the IPv4 side is analyzed. An IPv6-only failure shows up as ",[207,569,534],{},".",[59,572,573,576],{},[62,574,575],{},"It has no view of DNS."," If your application resolves a name to the wrong address, the path to the right address is still perfectly reachable.",[59,578,579,582],{},[62,580,581],{},"It stops at transit gateway Connect attachments",", and paths through a Gateway Load Balancer endpoint exclude the Gateway Load Balancer and its targets, which need their own analysis.",[59,584,585,588],{},[62,586,587],{},"Network Firewall support is partial."," It handles stateful and stateless 5-tuple rules, but not domain lists, Suricata rules, rule options, or tag-based resource groups, and it says so in the path details when it meets one.",[59,590,591,594],{},[62,592,593],{},"It says nothing about the application."," A listening process, a TLS handshake, a database that rejects the credentials: all outside the model.",[36,596,597,598,601],{},"So the honest rule is: ",[62,599,600],{},"Reachability Analyzer proves the path is permitted, not that the call will succeed."," When it says not reachable, you have your answer and you can stop. When it says reachable and the application still fails, you have learned something valuable too, which is that the problem is above the network layer, and the next lesson's logs are where you go.",[43,603,605],{"id":604},"the-failures-that-are-not-really-network-failures","The failures that are not really network failures",[36,607,608],{},"Four causes account for a large share of the tickets that arrive labeled \"VPC connectivity\" and never touch a security group.",[36,610,611,614,615,618,619,622],{},[62,612,613],{},"DNS resolving to the wrong thing."," A private hosted zone needs ",[207,616,617],{},"enableDnsSupport"," and ",[207,620,621],{},"enableDnsHostnames"," on the VPC to be usable, and an interface endpoint with private DNS disabled leaves the public service name resolving to a public address that a private subnet cannot reach. The connection fails at the network layer, but the fix is a DNS setting.",[36,624,625,628],{},[62,626,627],{},"Path MTU."," A connection that opens cleanly and then stalls the moment a large payload starts is almost never a permission problem. Handshakes are small and fit anywhere. Tunnels reduce the usable packet size, and if a firewall drops the ICMP fragmentation-needed messages, path MTU discovery cannot tell the sender to send smaller packets, so the transfer just hangs. Check MTU before you check rules whenever the symptom depends on size.",[36,630,631,634],{},[62,632,633],{},"Source/destination check."," Any instance forwarding traffic on behalf of others, such as a NAT instance or an appliance, must have this disabled. Left on, the interface discards forwarded packets and everything about the routing looks correct.",[36,636,637,640],{},[62,638,639],{},"Ephemeral ports on a stateless network ACL."," Covered in full in the security groups lesson, and it keeps reappearing here because it is the single most common reason a network ACL allows the request and kills the reply. If the traffic is outbound and the network ACL's inbound rules do not allow 1024 to 65535 back in, nothing works and every rule reads as reasonable.",[43,642,644],{"id":643},"exam-tips","Exam tips",[367,646,647,653,659,665,671,687,693,698],{},[59,648,649,652],{},[62,650,651],{},"Ordered walk, every time."," Source security group, source network ACL, route table, intermediate, destination network ACL, destination security group, resource policy, then the return path. Scenario questions are built by breaking exactly one of these.",[59,654,655,658],{},[62,656,657],{},"\"Connection refused\" is not a network problem."," Timeout means dropped, refused means delivered. A question that says the client gets an immediate refusal is pointing at the service, not the VPC.",[59,660,661,664],{},[62,662,663],{},"Reachability Analyzer analyzes configuration, not packets."," When a question asks how to find the blocking component without generating traffic or changing anything, this is the answer. When it asks what actually happened to real traffic, it is flow logs.",[59,666,667,670],{},[62,668,669],{},"Reachability Analyzer is IPv4 only, same Region, and ignores target health."," Those three constraints are the most likely thing an exam question tests about it.",[59,672,673,686],{},[62,674,675,618,677,679,680,682,683,685],{},[207,676,424],{},[207,678,414],{}," are routing; ",[207,681,434],{}," is the network ACL; ",[207,684,444],{}," is the security group."," Being able to map a code to a component is enough.",[59,688,689,692],{},[62,690,691],{},"Overlapping CIDRs cannot be peered",", because the local route always wins inside your own VPC CIDR and cannot be overridden.",[59,694,695],{},[62,696,697],{},"Forwarding appliance plus silent drops equals source/destination check.",[59,699,700,703],{},[62,701,702],{},"Stalls only on big transfers equals MTU",", not firewalls.",[36,705,706],{},"The habit to carry out of this lesson is smaller than the tool list: when a connection fails, name the first gate on the path that you have not verified, and check that one. Reachability Analyzer is how you do that walk in one call instead of seven. What it cannot tell you is what actually happened to real traffic last Tuesday at 03:00, and that is what the next lesson's logs are for.",[708,709,710],"style",{},"html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":205,"searchDepth":238,"depth":238,"links":712},[713,714,715,716,717,718,719],{"id":45,"depth":220,"text":46},{"id":110,"depth":220,"text":111},{"id":176,"depth":220,"text":177},{"id":389,"depth":220,"text":390},{"id":549,"depth":220,"text":550},{"id":604,"depth":220,"text":605},{"id":643,"depth":220,"text":644},"md",[722],{"slug":54,"concept":723,"style":724,"aspectRatio":725,"labels":726},"A single left-to-right path from a source EC2 instance to a destination resource, drawn as one horizontal line with 7 numbered checkpoints sitting on it in the exact order a packet meets them. Each checkpoint is a labeled gate on the line, not a box floating beside it, so the order is the visual argument. Above the line, a small return arrow doubles back from the destination to the source to mark the return path as a separate question. The takeaway strip at the bottom states the rule that decides the walk.","diagram","16:9",[727,728,729,730,731,732,733,734,735],"1. Source security group: outbound rule allows the destination and port","2. Source subnet network ACL: outbound rule allows it, and inbound allows the reply","3. Source route table: a route matches the destination and points at a live target","4. The intermediate: NAT gateway, internet gateway, endpoint, peering, or transit gateway","5. Destination subnet network ACL: inbound allows the request, outbound allows the reply","6. Destination security group: inbound rule allows the source and port","7. The resource policy: endpoint policy, bucket policy, or service policy","Return path: the reply travels back through the same 7 gates and can fail on its own","Walk the path in order. The first gate that denies is the answer, and every later gate is a distraction.",[25,26,27,28,29],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/05-network-troubleshooting/01-troubleshooting-vpc-connectivity",{"passingScore":740,"questions":741},70,[742,751,759,770,778,784,792,800,808],{"question":743,"type":744,"options":745,"correctAnswer":747,"explanation":750},"An EC2 instance in a private subnet cannot open a connection to an RDS database in the same VPC. You want to find the blocking component without changing anything or logging in to the instance. Which tool answers the question directly?","single",[746,747,748,749],"VPC Flow Logs, because they record the packets that were rejected","Reachability Analyzer, because it models the configured path and names the blocking component","Traffic Mirroring to a packet capture appliance","CloudWatch Network Flow Monitor with agents on both hosts","Reachability Analyzer builds a model of the network configuration and reports the component blocking the path, without sending a single packet. Flow logs are useful but only show what already happened, so they are silent when the source never got a packet out. Traffic Mirroring and Network Flow Monitor both require the traffic to actually flow, which is the thing that is failing.",{"question":752,"type":744,"options":753,"correctAnswer":757,"explanation":758},"Reachability Analyzer returns a result of not reachable with the explanation code SUBNET_ACL_RESTRICTION. What does that tell you?",[754,755,756,757],"The subnet has no route to the destination","The security group attached to the instance has no rules","The subnet is in an Availability Zone the destination does not support","The network ACL for the subnet does not admit the traffic in the direction being analyzed","SUBNET_ACL_RESTRICTION points at the network ACL, and the direction matters because network ACLs are stateless and evaluate the request and the reply separately. NO_ROUTE_TO_DESTINATION is the route table code, SG_HAS_NO_RULES and ENI_SG_RULES_MISMATCH are the security group codes, and TGW_ROUTE_AZ_RESTRICTION is one of the Availability Zone codes.",{"question":760,"type":761,"options":762,"correctAnswers":768,"explanation":769},"Which statements about Reachability Analyzer are correct? (Choose 2.)","multiple",[763,764,765,766,767],"It analyzes the configuration model rather than sending live packets","It considers the health of registered load balancer targets","It supports only resources with an IPv4 address","It works across Regions as long as the VPCs are peered","It replaces the need for VPC Flow Logs during an incident",[763,765],"Reachability Analyzer reasons about configuration, not the data plane, and it includes only IPv4 addresses even when a resource also has IPv6. It explicitly does not consider target health, and source and destination must be in the same Region, which is why a green result and a broken application can coexist and flow logs still matter.",{"question":771,"type":744,"options":772,"correctAnswer":774,"explanation":777},"A subnet route table has 0.0.0.0/0 pointing at a NAT gateway and 10.0.0.0/16 as the local route. An instance in that subnet cannot reach 10.0.5.20 in a peered VPC whose CIDR is 10.0.0.0/16. What is happening?",[773,774,775,776],"The peering connection is in a failed state","The local route matches first because overlapping CIDRs make the peering unusable, so the traffic never leaves the VPC","The NAT gateway is translating the address to a public IP","The network ACL is dropping the reply on the ephemeral port","The local route always wins for addresses inside the VPC CIDR and cannot be overridden, so two VPCs with the same or overlapping CIDR can be peered in name only. AWS rejects a peering request between overlapping CIDRs for exactly this reason. Nothing about the NAT gateway or the network ACL changes a routing decision that was already made locally.",{"question":779,"type":744,"options":780,"correctAnswer":781,"explanation":783},"True or False: if a security group blocks the traffic, VPC Flow Logs show one REJECT record, and if a network ACL blocks the reply, the logs show an ACCEPT record followed by a REJECT record.",[781,782],"True","False","A security group is stateful, so a denied inbound packet never reaches the interface and produces a single REJECT. A network ACL is stateless and evaluates each direction on its own, so the request can be accepted and logged as ACCEPT while the reply is denied and logged as REJECT. That ACCEPT then REJECT pair is the fastest way to tell the two apart in a log.",{"question":785,"type":744,"options":786,"correctAnswer":787,"explanation":791},"A firewall appliance instance is forwarding traffic for other subnets, but packets it forwards are silently dropped. Every route table and security group is correct. What is the most likely cause?",[787,788,789,790],"The instance has source/destination check enabled","The instance is in a subnet with no internet gateway route","The instance type does not support enhanced networking","The instance needs an Elastic IP address","Source/destination check makes an interface reject any packet whose source or destination is not one of its own addresses, which is the normal safety default and exactly wrong for anything routing on behalf of others. Reachability Analyzer reports this as ENI_SOURCE_DEST_CHECK_RESTRICTION. Enhanced networking and Elastic IP addresses change performance and public addressing, not whether a forwarded packet is accepted.",{"question":793,"type":744,"options":794,"correctAnswer":797,"explanation":799},"You are asked to verify that an internet gateway can reach an EC2 instance on port 443, but the path you want to test crosses the internet gateway in the middle. Reachability Analyzer returns IGW_NAT_REFLECTION. What should you do?",[795,796,797,798],"Enable cross-account analysis on the path","Re-run the analysis with TCP instead of the default protocol","Split it into two analyses: source to the internet gateway, then the internet gateway to the destination","Add the internet gateway as an excluded intermediate component","Reachability Analyzer does not support an internet gateway as an intermediate hop because address translation happens there, so it asks you to analyze each side separately. Cross-account analysis solves a different problem, which is a path whose components live in another account in the same organization. Changing the protocol or excluding the component does not restore a hop the tool cannot model.",{"question":801,"type":744,"options":802,"correctAnswer":806,"explanation":807},"An application connects fine to small API responses but hangs whenever a large file transfer starts over a Site-to-Site VPN. Reachability Analyzer reports the path as reachable. What should you investigate?",[803,804,805,806],"The security group on the destination, since large transfers use different ports","A route table entry that only matches short flows","The network ACL rule numbers, since lower numbers apply to small packets first","Path MTU: the tunnel reduces the usable packet size, and blocked ICMP prevents path MTU discovery from working","A handshake and small responses fit inside any MTU, so a connection that opens and then stalls on bulk transfer is the signature of an MTU problem, usually made invisible by a firewall dropping the ICMP fragmentation-needed messages. Reachability Analyzer models configuration and will happily call the path reachable. No security group, route, or network ACL rule distinguishes traffic by transfer size.",{"question":809,"type":761,"options":810,"correctAnswers":816,"explanation":817},"Which of these are true about how you should order a manual VPC connectivity investigation? (Choose 2.)",[811,812,813,814,815],"Check the return path separately, because a stateless network ACL can allow the request and deny the reply","Start with the destination security group, since inbound rules are the most common cause","Confirm the route table has a matching route before spending time on firewall rules, because no route means the packet never leaves","Assume DNS is fine if the destination resolves from your laptop","Check the resource policy first, because it is evaluated before the network path",[811,813],"An ordered walk moves with the packet, so routing comes before the far-end firewall, and the return path gets its own pass because network ACLs are stateless. Starting at the destination security group works sometimes and wastes the outage the rest of the time. Resolution from your laptop says nothing about a private hosted zone inside the VPC, and a resource policy is evaluated at the service after the packet arrives, not before it leaves.",{"title":21,"description":22},"courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/05-network-troubleshooting/01-troubleshooting-vpc-connectivity","NtCLNd6MLk06n6b-9o_lgzGRFmU0hS_WfeCG-PJ9yfU",{"locked":10,"reason":3,"meta":822,"item":833},{"title":823,"description":824,"isFree":5,"estimatedMinutes":825,"difficulty":12,"learningObjectives":826},"Auditing Network Protection Services","AWS WAF, Shield, Network Firewall, and Route 53 Resolver DNS Firewall each guard a different piece of traffic, and each has a way of looking deployed while blocking nothing. This lesson gives you a repeatable audit for all 4 in a single account.",28,[827,828,829,830,831,832],"Distinguish AWS WAF, AWS Shield, AWS Network Firewall, and Route 53 Resolver DNS Firewall by the traffic each one actually sees","Apply a 4-question audit frame to any network protection service: deployed, attached, enforcing, observable","Find the AWS WAF configurations that make a web ACL look protective while it blocks nothing","Verify that a Network Firewall is inspecting traffic instead of merely existing, using subnets, endpoints, and route tables","Check a DNS Firewall configuration for rule group association, rule action, priority, and failure mode","Assemble standing audit evidence from CLI calls, service logs, CloudWatch metrics, AWS Config, and Security Hub",{"id":834,"title":823,"body":835,"description":824,"difficulty":12,"estimatedMinutes":825,"extension":720,"infographics":1723,"isFree":5,"learningObjectives":1735,"meta":1736,"navigation":5,"path":1737,"quiz":1738,"seo":1815,"stem":1816,"__hash__":1817},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/04-network-protection-and-cost/01-auditing-network-protection-services.md",{"type":33,"value":836,"toc":1713},[837,844,847,851,854,858,948,951,957,963,967,970,996,999,1003,1010,1101,1108,1111,1128,1134,1140,1146,1167,1171,1174,1180,1186,1193,1223,1226,1229,1249,1252,1256,1259,1274,1280,1283,1289,1295,1305,1342,1345,1392,1399,1406,1410,1413,1419,1467,1473,1508,1523,1529,1549,1573,1579,1601,1604,1607,1611,1614,1620,1626,1635,1646,1648,1707,1710],[36,838,839,840,843],{},"Compliance sends one line: confirm that every internet-facing application in the production account is protected by a web application firewall. You open the console, find a web ACL named ",[207,841,842],{},"prod-web-acl"," with 14 rules including the AWS managed core rule set, and reply that you are covered.",[36,845,846],{},"You may have just signed off on nothing. A web ACL is a standalone resource. Until it is associated with a specific CloudFront distribution or load balancer, it inspects zero requests, and the console page looks identical either way. The same shape of gap exists in all 4 of the services in this lesson, which is why the exam has a skill statement for auditing them rather than for configuring them.",[43,848,850],{"id":849},"four-services-four-different-pieces-of-traffic","Four services, four different pieces of traffic",[36,852,853],{},"Before you can audit these services you have to know what each one is even in a position to see. They are not layers of the same wall. They sit on different paths, and a gap in one is completely invisible to the other 3.",[51,855],{"alt":856,"slug":857},"A diagram of a VPC showing Shield at the network edge, AWS WAF in front of HTTP application resources, Network Firewall at the VPC perimeter on both the inbound and outbound paths, and DNS Firewall on the branch from the workload to the Route 53 Resolver.","network-protection-services-traffic-paths",[116,859,860,876],{},[119,861,862],{},[122,863,864,867,870,873],{},[125,865,866],{},"Service",[125,868,869],{},"Traffic it inspects",[125,871,872],{},"Where it attaches",[125,874,875],{},"Cost model",[132,877,878,892,906,920,934],{},[122,879,880,883,886,889],{},[137,881,882],{},"AWS Shield Standard",[137,884,885],{},"Layer 3 and 4 volumetric floods",[137,887,888],{},"Automatic for all AWS customers",[137,890,891],{},"Free",[122,893,894,897,900,903],{},[137,895,896],{},"AWS Shield Advanced",[137,898,899],{},"Layer 3, 4, and 7 DDoS on named resources",[137,901,902],{},"Per-resource protections you create",[137,904,905],{},"$3,000 per month, 1-year commitment",[122,907,908,911,914,917],{},[137,909,910],{},"AWS WAF",[137,912,913],{},"HTTP and HTTPS requests",[137,915,916],{},"Web ACL associated with a supported resource",[137,918,919],{},"Per web ACL, per rule, per million requests",[122,921,922,925,928,931],{},[137,923,924],{},"AWS Network Firewall",[137,926,927],{},"Packets and flows at the VPC perimeter, any protocol",[137,929,930],{},"Firewall endpoints in dedicated subnets, reached by route table entries",[137,932,933],{},"Per endpoint hour and per GB processed",[122,935,936,939,942,945],{},[137,937,938],{},"Route 53 Resolver DNS Firewall",[137,940,941],{},"Outbound DNS queries from the VPC",[137,943,944],{},"Rule groups associated with a VPC",[137,946,947],{},"Per query and per domain list",[36,949,950],{},"Two boundaries in that table earn their own sentence.",[36,952,953,956],{},[62,954,955],{},"AWS WAF sees requests, Network Firewall sees packets."," WAF only exists in front of resource types that speak HTTP: CloudFront distributions, Application Load Balancers, API Gateway REST APIs, AppSync GraphQL APIs, Cognito user pools, App Runner services, Bedrock AgentCore Gateways, Verified Access instances, and Amplify. Nothing else. If your workload is a database replica shipping data over a custom TCP port, WAF is not the control that could ever have caught it, and Network Firewall is.",[36,958,959,962],{},[62,960,961],{},"DNS Firewall sees queries, Network Firewall sees connections."," Both can filter by domain name, and that overlap is a favorite exam trap. DNS Firewall filters the DNS lookup itself as it passes through the Route 53 VPC Resolver, so it stops the workload from ever learning the address. Network Firewall inspects the resulting traffic on the wire but has no visibility into Resolver queries at all. AWS states this directly: the 2 services filter domain names on 2 different network paths.",[43,964,966],{"id":965},"the-4-questions-an-audit-answers","The 4 questions an audit answers",[36,968,969],{},"Every one of these services can be deployed and still protect nothing, and the failure is always one of the same 4 steps. Carry this frame through the rest of the lesson and apply it to whatever service the exam names:",[56,971,972,978,984,990],{},[59,973,974,977],{},[62,975,976],{},"Is it deployed?"," Does the resource exist in this account and Region?",[59,979,980,983],{},[62,981,982],{},"Is it attached to what you think?"," Association, subnet, route, or VPC binding.",[59,985,986,989],{},[62,987,988],{},"Is it enforcing, or only observing?"," Count, Alert, and Pass all produce healthy-looking telemetry while permitting the traffic.",[59,991,992,995],{},[62,993,994],{},"Can you prove what it did?"," Logging is off by default on most of these, and an audit without evidence is an opinion.",[36,997,998],{},"Question 3 is where real environments fail, because step 3 is a normal and correct part of every rollout. You start a new rule in count mode on purpose. Nobody schedules the day you turn it on.",[43,1000,1002],{"id":1001},"auditing-aws-waf","Auditing AWS WAF",[36,1004,1005,1006,1009],{},"Start with the association, because that is the question the auditor actually asked. Web ACLs live in 2 separate scopes, and the CloudFront scope only exists in ",[207,1007,1008],{},"us-east-1",":",[200,1011,1013],{"className":202,"code":1012,"language":204,"meta":205,"style":205},"# Regional resources: ALB, API Gateway, AppSync, Cognito, App Runner, Verified Access\naws wafv2 list-web-acls --scope REGIONAL --region eu-west-1\n\naws wafv2 list-resources-for-web-acl \\\n  --web-acl-arn arn:aws:wafv2:eu-west-1:111122223333:regional/webacl/prod-web-acl/a1b2c3d4 \\\n  --region eu-west-1\n\n# CloudFront distributions are always in the us-east-1 CLOUDFRONT scope\naws wafv2 list-web-acls --scope CLOUDFRONT --region us-east-1\n",[207,1014,1015,1020,1042,1046,1057,1067,1074,1078,1083],{"__ignoreMap":205},[210,1016,1017],{"class":212,"line":213},[210,1018,1019],{"class":216},"# Regional resources: ALB, API Gateway, AppSync, Cognito, App Runner, Verified Access\n",[210,1021,1022,1024,1027,1030,1033,1036,1039],{"class":212,"line":220},[210,1023,224],{"class":223},[210,1025,1026],{"class":227}," wafv2",[210,1028,1029],{"class":227}," list-web-acls",[210,1031,1032],{"class":241}," --scope",[210,1034,1035],{"class":227}," REGIONAL",[210,1037,1038],{"class":241}," --region",[210,1040,1041],{"class":227}," eu-west-1\n",[210,1043,1044],{"class":212,"line":238},[210,1045,285],{"emptyLinePlaceholder":5},[210,1047,1048,1050,1052,1055],{"class":212,"line":250},[210,1049,224],{"class":223},[210,1051,1026],{"class":227},[210,1053,1054],{"class":227}," list-resources-for-web-acl",[210,1056,235],{"class":234},[210,1058,1059,1062,1065],{"class":212,"line":261},[210,1060,1061],{"class":241},"  --web-acl-arn",[210,1063,1064],{"class":227}," arn:aws:wafv2:eu-west-1:111122223333:regional/webacl/prod-web-acl/a1b2c3d4",[210,1066,235],{"class":234},[210,1068,1069,1072],{"class":212,"line":273},[210,1070,1071],{"class":241},"  --region",[210,1073,1041],{"class":227},[210,1075,1076],{"class":212,"line":282},[210,1077,285],{"emptyLinePlaceholder":5},[210,1079,1080],{"class":212,"line":288},[210,1081,1082],{"class":216},"# CloudFront distributions are always in the us-east-1 CLOUDFRONT scope\n",[210,1084,1085,1087,1089,1091,1093,1096,1098],{"class":212,"line":294},[210,1086,224],{"class":223},[210,1088,1026],{"class":227},[210,1090,1029],{"class":227},[210,1092,1032],{"class":241},[210,1094,1095],{"class":227}," CLOUDFRONT",[210,1097,1038],{"class":241},[210,1099,1100],{"class":227}," us-east-1\n",[36,1102,1103,1104,1107],{},"An empty ",[207,1105,1106],{},"ResourceArns"," list is the finding. Work the other direction too: list your ALBs and CloudFront distributions and check which ones have no web ACL at all, because a resource with no association will never appear in any web ACL's resource list.",[36,1109,1110],{},"Once the association is confirmed, 4 configuration details decide whether the web ACL blocks anything.",[36,1112,1113,1116,1117,1120,1121,1124,1125,1127],{},[62,1114,1115],{},"The default action."," A web ACL applies its default action to every request that no rule terminated on. ",[207,1118,1119],{},"Allow"," is normal for a public site protected by explicit block rules. ",[207,1122,1123],{},"Block"," is normal for a locked-down internal API. Reading the default action tells you which model the web ACL was designed for, and a ",[207,1126,1123],{}," default with a broad allow rule at the top is a very different security posture from what its name suggests.",[36,1129,1130,1133],{},[62,1131,1132],{},"Terminating and non-terminating actions."," Allow and Block stop evaluation immediately, and whichever matches first decides the request. Count never terminates: it increments a metric and evaluation continues. CAPTCHA and Challenge are conditional, terminating only when the request has no valid token. So a rule set can be full of well-written block rules that never run.",[36,1135,1136,1139],{},[62,1137,1138],{},"Rule priority."," AWS WAF evaluates rules from the lowest numeric priority upward. An allow rule at priority 10 that matches your office IP range will terminate before the SQL injection rule at priority 50 ever sees the request. Broad allow rules near the top are the single most productive thing to look for in a web ACL review.",[36,1141,1142,1145],{},[62,1143,1144],{},"Rule group overrides."," When you add a managed rule group, you can override the whole group's action to Count, or override individual rules inside it. This is the intended way to trial the AWS managed core rule set without breaking a live application. It is also the most common reason a web ACL with excellent rules blocks nothing. Check for it explicitly; the console shows it as a small badge that is easy to skim past.",[36,1147,1148,1149,1152,1153,1156,1157,1160,1161,1163,1164,1166],{},"For question 4, WAF logging is off until you configure it. You can send web ACL logs to a CloudWatch Logs log group, an S3 bucket, or an Amazon Data Firehose delivery stream, and you can redact fields and filter which records are kept. Separately, request sampling gives you a rolling look at recent evaluated requests without any logging setup, which is the fastest way to see whether a rule is matching at all. The CloudWatch metrics to read are ",[207,1150,1151],{},"AllowedRequests",", ",[207,1154,1155],{},"BlockedRequests",", and ",[207,1158,1159],{},"CountedRequests",". A web ACL whose ",[207,1162,1155],{}," has been flat at zero for months while ",[207,1165,1159],{}," climbs is telling you the answer to question 3.",[43,1168,1170],{"id":1169},"auditing-aws-shield","Auditing AWS Shield",[36,1172,1173],{},"Shield splits cleanly into an automatic half and a subscribed half, and the audit questions are different for each.",[36,1175,1176,1179],{},[62,1177,1178],{},"Shield Standard"," is on for every AWS customer at no extra charge and defends against the common network and transport layer floods. There is nothing to enable, nothing to attach, and nothing to audit beyond knowing it is there.",[36,1181,1182,1185],{},[62,1183,1184],{},"Shield Advanced"," is a subscription at $3,000 per month with a 1-year commitment, billed per payer account where that payer or any linked account is subscribed. It protects EC2 instances, Elastic Load Balancing load balancers, CloudFront distributions, Route 53 hosted zones, and Global Accelerator standard accelerators.",[36,1187,1188,1189,1192],{},"Here is the misconception worth naming: ",[62,1190,1191],{},"subscribing to Shield Advanced does not protect your resources."," The subscription unlocks the capability. You still create a protection for each resource you want covered. The predictable audit finding is a load balancer created 3 months after the subscription started that nobody added, and the account is paying $3,000 a month partly for coverage it does not have.",[200,1194,1196],{"className":202,"code":1195,"language":204,"meta":205,"style":205},"aws shield describe-subscription          # is the account subscribed, and when does the term end\naws shield list-protections               # which resource ARNs are actually protected\n",[207,1197,1198,1211],{"__ignoreMap":205},[210,1199,1200,1202,1205,1208],{"class":212,"line":213},[210,1201,224],{"class":223},[210,1203,1204],{"class":227}," shield",[210,1206,1207],{"class":227}," describe-subscription",[210,1209,1210],{"class":216},"          # is the account subscribed, and when does the term end\n",[210,1212,1213,1215,1217,1220],{"class":212,"line":220},[210,1214,224],{"class":223},[210,1216,1204],{"class":227},[210,1218,1219],{"class":227}," list-protections",[210,1221,1222],{"class":216},"               # which resource ARNs are actually protected\n",[36,1224,1225],{},"Diff that protection list against the eligible resources in the account. That diff is your finding.",[36,1227,1228],{},"Three more Shield Advanced settings carry real audit weight:",[367,1230,1231,1237,1243],{},[59,1232,1233,1236],{},[62,1234,1235],{},"Automatic application layer DDoS mitigation"," can be configured to count or to block the web requests it identifies as part of an attack. Set to count, it is a detector. Enabling it adds a rule group consuming 150 WCUs to the associated web ACL, which counts against the web ACL's capacity.",[59,1238,1239,1242],{},[62,1240,1241],{},"Health-based detection"," associates a Route 53 health check with a protected resource so Shield can distinguish a real impact from a benign traffic spike. It is available for every resource type except Route 53 hosted zones, and proactive engagement by the Shield Response Team only works on resources that have it enabled.",[59,1244,1245,1248],{},[62,1246,1247],{},"Shield Response Team access"," additionally requires a Business or Enterprise Support plan. A subscription without the support plan means the phone number in your runbook does not work.",[36,1250,1251],{},"Shield Advanced also offers cost protection against bill spikes caused by an attack, granted as service credits after the fact rather than as an automatic discount.",[43,1253,1255],{"id":1254},"auditing-aws-network-firewall","Auditing AWS Network Firewall",[36,1257,1258],{},"Network Firewall has the largest gap between \"the resource exists\" and \"the resource is doing something\", so this is the deepest of the 4 audits.",[36,1260,1261,1262,1265,1266,1269,1270,1273],{},"The service creates a ",[62,1263,1264],{},"firewall endpoint"," in each subnet you designate, and each endpoint gives the firewall availability in its Availability Zone. A ",[62,1267,1268],{},"firewall policy"," holds the settings and points at ",[62,1271,1272],{},"rule groups",", stateless and stateful. None of that puts the firewall in the traffic path.",[36,1275,1276,1279],{},[62,1277,1278],{},"Route tables are the enforcement mechanism."," You edit VPC route tables so a protected subnet's traffic goes to the firewall endpoint, and so return traffic from the internet gateway comes back through the endpoint before reaching the subnet. Skip that step and you have a fully configured firewall with a monthly bill and zero packets. When a scenario says the firewall is deployed and correctly configured but traffic is not being filtered, the routes are the answer.",[36,1281,1282],{},"Four more checks, in the order they usually bite:",[36,1284,1285,1288],{},[62,1286,1287],{},"Availability Zone coverage."," One endpoint per AZ, and the endpoint's availability is scoped to its own zone. Workloads in an AZ with no firewall endpoint are unfiltered, or their traffic crosses an AZ boundary to reach an endpoint elsewhere and picks up cross-zone data transfer charges on the way. Compare the list of AZs holding workload subnets against the list of AZs holding firewall subnets.",[36,1290,1291,1294],{},[62,1292,1293],{},"Dedicated firewall subnets."," A firewall endpoint cannot filter traffic entering or leaving the subnet it lives in. Put a workload in a firewall subnet and that workload is exempt from inspection. AWS is explicit: use firewall subnets for nothing else.",[36,1296,1297,1300,1301,1304],{},[62,1298,1299],{},"Stateless default actions."," The stateless engine runs first and decides whether each packet is passed, dropped, or forwarded to the stateful engine. If the stateless default action is ",[207,1302,1303],{},"Pass"," and no stateless rule forwards traffic onward, your Suricata rules and domain lists never execute. The policy is perfectly valid, which is what makes it an audit finding instead of an error. The same setting has a separate default for UDP packet fragments; Network Firewall silently drops fragments of other protocols.",[36,1306,1307,1310,1311,1314,1315,1318,1319,1152,1322,1325,1326,1329,1330,1333,1334,1337,1338,1341],{},[62,1308,1309],{},"Stateful rule evaluation order."," A policy uses either action order or strict order, and ",[207,1312,1313],{},"RuleOrder"," can only be set when the policy is created. It cannot be edited afterward. Under action order, Suricata evaluates every ",[207,1316,1317],{},"pass"," rule before any ",[207,1320,1321],{},"drop",[207,1323,1324],{},"reject",", or ",[207,1327,1328],{},"alert"," rule regardless of the ",[207,1331,1332],{},"priority"," keyword, so a permissive pass rule anywhere in any rule group overrides everything below it. Under strict order, rule groups run by ascending priority and rules run in the order written, and you also choose default actions such as ",[62,1335,1336],{},"Drop all"," or ",[62,1339,1340],{},"Drop established",". AWS recommends strict order for exactly this predictability. If an audit finds a drop rule that never fires, action order plus a broad pass rule is the first hypothesis.",[36,1343,1344],{},"For evidence, Network Firewall logging is off until you configure it, and it produces 3 log types you enable separately:",[116,1346,1347,1357],{},[119,1348,1349],{},[122,1350,1351,1354],{},[125,1352,1353],{},"Log type",[125,1355,1356],{},"Contents",[132,1358,1359,1367,1384],{},[122,1360,1361,1364],{},[137,1362,1363],{},"Flow",[137,1365,1366],{},"Standard network traffic flow records for traffic through the stateful engine",[122,1368,1369,1372],{},[137,1370,1371],{},"Alert",[137,1373,1374,1375,1152,1378,1325,1381],{},"Traffic matching stateful rules whose action is ",[207,1376,1377],{},"DROP",[207,1379,1380],{},"ALERT",[207,1382,1383],{},"REJECT",[122,1385,1386,1389],{},[137,1387,1388],{},"TLS",[137,1390,1391],{},"TLS inspection events, only when TLS inspection is configured",[36,1393,1394,1395,1398],{},"The constraint that catches people: ",[62,1396,1397],{},"only traffic forwarded to the stateful engine is logged at all."," Stateless drops never appear in these logs. CloudWatch metrics cover both engines and are the right place to confirm the firewall is receiving traffic in the first place.",[36,1400,1401,1402,1405],{},"One last item worth recording: ",[62,1403,1404],{},"delete protection"," is enabled when a firewall is created and must be explicitly turned off through the API before the firewall can be deleted. The console does not show the setting because the deletion flow disables it for you.",[43,1407,1409],{"id":1408},"auditing-route-53-resolver-dns-firewall","Auditing Route 53 Resolver DNS Firewall",[36,1411,1412],{},"DNS Firewall filters outbound DNS queries as they pass through the Route 53 VPC Resolver. Its headline job is stopping DNS exfiltration, where an attacker who has compromised an instance encodes data into lookups against a domain they control. It also blocks resolution of private hosted zone records, VPC endpoint names, and EC2 instance names.",[36,1414,1415,1418],{},[62,1416,1417],{},"Association."," Rule groups do nothing until associated with a VPC, and you can associate up to 5 rule groups per VPC per Region. Confirm the association and its priority, then check that the priority order matches your intent, since lower numbers evaluate first both across associated rule groups and among rules inside one group.",[200,1420,1422],{"className":202,"code":1421,"language":204,"meta":205,"style":205},"aws route53resolver list-firewall-rule-group-associations --vpc-id vpc-0abc123\naws route53resolver list-firewall-rules --firewall-rule-group-id rslvr-frg-0abc123\naws route53resolver list-firewall-configs        # the fail-open setting per VPC\n",[207,1423,1424,1440,1455],{"__ignoreMap":205},[210,1425,1426,1428,1431,1434,1437],{"class":212,"line":213},[210,1427,224],{"class":223},[210,1429,1430],{"class":227}," route53resolver",[210,1432,1433],{"class":227}," list-firewall-rule-group-associations",[210,1435,1436],{"class":241}," --vpc-id",[210,1438,1439],{"class":227}," vpc-0abc123\n",[210,1441,1442,1444,1446,1449,1452],{"class":212,"line":220},[210,1443,224],{"class":223},[210,1445,1430],{"class":227},[210,1447,1448],{"class":227}," list-firewall-rules",[210,1450,1451],{"class":241}," --firewall-rule-group-id",[210,1453,1454],{"class":227}," rslvr-frg-0abc123\n",[210,1456,1457,1459,1461,1464],{"class":212,"line":238},[210,1458,224],{"class":223},[210,1460,1430],{"class":227},[210,1462,1463],{"class":227}," list-firewall-configs",[210,1465,1466],{"class":216},"        # the fail-open setting per VPC\n",[36,1468,1469,1472],{},[62,1470,1471],{},"Rule action."," Every rule carries exactly one of 3 actions:",[116,1474,1475,1485],{},[119,1476,1477],{},[122,1478,1479,1482],{},[125,1480,1481],{},"Action",[125,1483,1484],{},"Effect",[132,1486,1487,1494,1501],{},[122,1488,1489,1491],{},[137,1490,1119],{},[137,1492,1493],{},"Stop inspecting and permit the query",[122,1495,1496,1498],{},[137,1497,1371],{},[137,1499,1500],{},"Stop inspecting, permit the query, and log it in the Resolver query logs",[122,1502,1503,1505],{},[137,1504,1123],{},[137,1506,1507],{},"Stop inspecting, block the query, log it, and return the configured block response",[36,1509,1510,1511,1513,1514,1516,1517,1519,1520,1522],{},"AWS itself recommends creating a blocking rule as ",[207,1512,1371],{}," first so you can measure how many queries it would have blocked. That advice creates the most common DNS Firewall finding in existence: a rule group where every rule is still on ",[207,1515,1371],{}," a year later. ",[207,1518,1371],{}," is a detector; ",[207,1521,1123],{}," is a control. Reading the action list is a 30 second check with real consequences.",[36,1524,1525,1528],{},[62,1526,1527],{},"Block response."," When the action is Block, you choose what the client hears back:",[367,1530,1531,1537,1543],{},[59,1532,1533,1536],{},[62,1534,1535],{},"NODATA"," answers that the query succeeded but no record is available.",[59,1538,1539,1542],{},[62,1540,1541],{},"NXDOMAIN"," answers that the domain name does not exist.",[59,1544,1545,1548],{},[62,1546,1547],{},"OVERRIDE"," returns a custom CNAME you specify, with a time to live that defaults to 0 so the answer is not cached. This is how you route blocked lookups to a sinkhole or an internal warning page.",[36,1550,1551,1554,1555,1152,1558,1152,1561,1564,1565,1568,1569,1572],{},[62,1552,1553],{},"Managed domain lists."," AWS maintains 4 lists you can use for free: ",[62,1556,1557],{},"Malware",[62,1559,1560],{},"Botnet/Command and Control",[62,1562,1563],{},"Aggregate Threat List"," (a superset of the others, adding ransomware, spyware, and DNS tunneling), and ",[62,1566,1567],{},"Amazon GuardDuty Threat List"," (domains from GuardDuty's own DNS findings). You cannot view or download their contents, which is deliberate: a published block list is a specification for evading it. When a managed list produces a false positive, the fix is to add an allow rule for that specific domain and give it a ",[62,1570,1571],{},"lower numeric priority"," than the blocking rule so it runs first.",[36,1574,1575,1578],{},[62,1576,1577],{},"Failure mode."," This is the setting nobody checks. When VPC Resolver gets no reply from DNS Firewall, the VPC's firewall configuration decides what happens:",[367,1580,1581,1591],{},[59,1582,1583,1586,1587,1590],{},[62,1584,1585],{},"Fail closed"," is the default. The query is blocked and VPC Resolver returns ",[207,1588,1589],{},"SERVFAIL",". Security over availability.",[59,1592,1593,1596,1597,1600],{},[62,1594,1595],{},"Fail open",", set through the ",[207,1598,1599],{},"FirewallFailOpen"," field, lets the query through. Availability over security.",[36,1602,1603],{},"Both are legitimate choices, and neither is an error. But a fail-open VPC loses its DNS protections during exactly the moments an attacker would want them gone, so the audit finding is not \"fail open is wrong\", it is \"fail open is set and nobody documented the decision\".",[36,1605,1606],{},"Worth memorizing alongside the config: 5 rule groups per VPC, 100 rules per rule group, 1,000 rule groups per account per Region, 100,000 domains across all your domain lists.",[43,1608,1610],{"id":1609},"turning-spot-checks-into-standing-evidence","Turning spot checks into standing evidence",[36,1612,1613],{},"Everything above is a point-in-time answer. An audit that has to be repeated by hand every quarter will not be repeated.",[36,1615,1616,1619],{},[62,1617,1618],{},"AWS Config"," records configuration changes to these resources and evaluates managed rules against them continuously, so a web ACL that loses its association or a firewall policy whose default action changes generates a noncompliant finding on its own. Conformance packs bundle the relevant rules into one deployable unit.",[36,1621,1622,1625],{},[62,1623,1624],{},"AWS Security Hub"," aggregates those Config findings alongside GuardDuty and Inspector results and scores them against standards such as the AWS Foundational Security Best Practices, which turns \"are we protected\" into a number with a trend line.",[36,1627,1628,1631,1632,1634],{},[62,1629,1630],{},"CloudWatch alarms"," close question 3 permanently. An alarm on a web ACL's ",[207,1633,1155],{}," staying at zero across a full week, or on Network Firewall's packet counters dropping to nothing, catches the silent regressions that a quarterly review misses by 89 days.",[36,1636,1637,1638,1641,1642,1645],{},"One scope note that matters for the exam. This skill is written as auditing these services ",[62,1639,1640],{},"in a single account",". The moment the question widens to every VPC in every member account, including accounts that do not exist yet, the answer changes to ",[62,1643,1644],{},"AWS Firewall Manager",", which centrally applies AWS WAF, Shield Advanced, security group, network ACL, Network Firewall, and DNS Firewall policies across an organization and automatically brings new resources into scope. Firewall Manager requires AWS Organizations and AWS Config. Keep it filed as the organization-wide answer so it does not tempt you on a single-account question.",[43,1647,644],{"id":643},[367,1649,1650,1656,1662,1668,1674,1679,1685,1693,1702],{},[59,1651,1652,1655],{},[62,1653,1654],{},"Existence is not protection."," For WAF read the association, for Shield read the protection list, for Network Firewall read the route tables, for DNS Firewall read the VPC association. That single move answers most audit questions on this skill.",[59,1657,1658,1661],{},[62,1659,1660],{},"Count, Alert, and Pass are the observe-only settings."," WAF Count and rule group overrides, Shield automatic mitigation set to count, Network Firewall stateless default Pass, DNS Firewall Alert. A scenario describing \"logs show the traffic but it is not blocked\" is pointing at one of these.",[59,1663,1664,1667],{},[62,1665,1666],{},"Domain filtering appears twice."," Queries through the Resolver are DNS Firewall; traffic on the wire is Network Firewall. Network Firewall has no visibility into Resolver queries.",[59,1669,1670,1673],{},[62,1671,1672],{},"AWS WAF only attaches to HTTP resource types."," CloudFront, ALB, API Gateway, AppSync, Cognito user pools, App Runner, Bedrock AgentCore Gateway, Verified Access, Amplify. Not EC2, not NLB, not RDS.",[59,1675,1676],{},[62,1677,1678],{},"Shield Standard is free and automatic; Shield Advanced is $3,000 a month on a 1-year commitment and protects only the resources you explicitly add.",[59,1680,1681,1684],{},[62,1682,1683],{},"Network Firewall route tables, dedicated firewall subnets, and one endpoint per AZ."," A firewall endpoint cannot filter its own subnet.",[59,1686,1687,1692],{},[62,1688,1689,1691],{},[207,1690,1313],{}," is set at policy creation and cannot be changed."," Strict order is the recommended choice.",[59,1694,1695,1698,1699,1701],{},[62,1696,1697],{},"DNS Firewall fails closed by default"," and returns ",[207,1700,1589],{},". Fail open is opt-in.",[59,1703,1704],{},[62,1705,1706],{},"Single account is the audit; AWS Organizations is Firewall Manager.",[36,1708,1709],{},"The habit to carry out of this lesson is smaller than the service list: for any protection control, find the binding that connects it to real traffic, then find the setting that decides whether it acts or only watches. Those 2 facts are the audit. The next lesson looks at the same network from the opposite direction, asking not whether it is protected but what every gigabyte crossing it costs you.",[708,1711,1712],{},"html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":205,"searchDepth":238,"depth":238,"links":1714},[1715,1716,1717,1718,1719,1720,1721,1722],{"id":849,"depth":220,"text":850},{"id":965,"depth":220,"text":966},{"id":1001,"depth":220,"text":1002},{"id":1169,"depth":220,"text":1170},{"id":1254,"depth":220,"text":1255},{"id":1408,"depth":220,"text":1409},{"id":1609,"depth":220,"text":1610},{"id":643,"depth":220,"text":644},[1724],{"slug":857,"concept":1725,"style":724,"aspectRatio":725,"labels":1726},"A single VPC drawn as a wide horizontal band in the center, with an inbound traffic path entering from the left (internet to application) and an outbound path leaving to the right (workload to internet). Each of the 4 protection services is placed as a labeled checkpoint at the exact point on a path where it inspects traffic, not floating beside it: Shield furthest left at the network edge, AWS WAF at the HTTP entry point in front of the application resources, Network Firewall straddling the VPC perimeter on both paths, and DNS Firewall on a short branch from the workload up to the Route 53 Resolver. The visual anchor is that no 2 checkpoints sit on the same segment of the same path. A footer strip carries the audit consequence.",[1727,1728,1729,1730,1731,1732,1733,1734],"Inbound path: internet to application","Outbound path: workload to internet","AWS Shield: absorbs layer 3 and 4 volumetric floods before they reach the resource","AWS WAF: inspects HTTP and HTTPS requests at CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, Verified Access","AWS Network Firewall: inspects packets and flows at the VPC perimeter, any protocol, steered by route tables","Route 53 Resolver DNS Firewall: filters outbound DNS queries that leave the VPC through the Resolver","Route 53 Resolver sits at the VPC network range base plus two","No 2 of these services inspect the same traffic, so a gap in one is invisible to the other three",[827,828,829,830,831,832],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/04-network-protection-and-cost/01-auditing-network-protection-services",{"passingScore":740,"questions":1739},[1740,1748,1756,1764,1774,1782,1790,1794,1802,1807],{"question":1741,"type":744,"options":1742,"correctAnswer":1744,"explanation":1747},"An auditor asks whether your internet-facing application is protected by AWS WAF. You confirm a web ACL named prod-web-acl exists with 14 rules. What have you actually proven?",[1743,1744,1745,1746],"That the application is protected, since the web ACL exists in the same Region","Nothing about the application, because a web ACL only inspects traffic for the resources it is associated with","That the application is protected as long as the default action is Block","That the application is protected unless Shield Advanced is also subscribed","A web ACL is an independent resource that does nothing until it is associated with a CloudFront distribution, ALB, API Gateway REST API, AppSync API, Cognito user pool, App Runner service, Verified Access instance, or Amplify app. Run list-resources-for-web-acl to see the association list, which is the only thing that answers the auditor's question. The default action and Shield subscription matter only after the association exists.",{"question":1749,"type":744,"options":1750,"correctAnswer":1753,"explanation":1755},"A managed rule group in a web ACL is added with the rule group action override set to Count. What is the effect?",[1751,1752,1753,1754],"Requests matching the group are blocked and also counted","The group is evaluated twice, once for metrics and once for enforcement","Every rule in the group is evaluated and counted, but none of them block, so evaluation continues to the next rule","The group is skipped entirely and produces no metrics","Overriding a rule group to Count converts its rule actions to a non-terminating count, which is the correct way to test a new managed rule group but a serious finding if it survives into production. The group still produces CountedRequests metrics and log entries, which is exactly why it looks healthy on a dashboard while blocking nothing. Skipping the group entirely would produce no metrics at all, which is a different and more visible failure.",{"question":1757,"type":744,"options":1758,"correctAnswer":1760,"explanation":1763},"In a web ACL, a rule with the Allow action has priority 10 and a rule that blocks SQL injection patterns has priority 50. A request matches both. What happens?",[1759,1760,1761,1762],"The request is blocked, because Block always wins over Allow","The request is allowed, because rules are evaluated from the lowest numeric priority and Allow is a terminating action","The request is counted by both rules and then the default action applies","AWS WAF rejects the configuration as ambiguous","AWS WAF evaluates rules in ascending numeric priority order, and Allow and Block are both terminating, so the first one that matches decides the request and no later rule is evaluated. A broad Allow rule placed at a low priority silently shadows every protection below it, which is one of the highest-value findings in a web ACL audit. Count is the only plain action that never terminates evaluation.",{"question":1765,"type":761,"options":1766,"correctAnswers":1772,"explanation":1773},"Which statements about AWS Shield are correct? (Choose 2.)",[1767,1768,1769,1770,1771],"Shield Standard is included at no additional cost for all AWS customers","Subscribing to Shield Advanced automatically protects every eligible resource in the account","Shield Advanced requires a 1-year subscription commitment and is billed per payer account","Shield Standard provides access to the Shield Response Team","Shield Advanced replaces the need for AWS WAF on protected resources",[1767,1769],"Shield Standard is automatic and free and covers common network and transport layer events, while Shield Advanced is a paid subscription with a 1-year commitment billed at the payer account level. Subscribing does not protect anything on its own: you still add each resource as a protection, which is why a new load balancer created after the subscription is a classic audit gap. Shield Advanced uses AWS WAF for its application layer protections rather than replacing it, and the Shield Response Team is an Advanced feature that also requires Business or Enterprise Support.",{"question":1775,"type":744,"options":1776,"correctAnswer":1780,"explanation":1781},"A Network Firewall exists, its policy has well-written stateful rules, and CloudWatch shows almost no traffic through the firewall. Workload traffic still reaches the internet normally. What do you check first?",[1777,1778,1779,1780],"Whether the stateful rule groups use strict order","Whether the firewall policy has a customer managed KMS key","Whether delete protection is enabled on the firewall","The route tables for the protected subnets, because traffic only reaches the firewall if routes send it to the firewall endpoint","Network Firewall is not inline by default. You steer traffic to it by editing VPC route tables so that the protected subnet sends traffic to the firewall endpoint and the internet gateway sends return traffic back through it. If those routes still point straight at a NAT gateway or internet gateway, the firewall bills every hour and inspects nothing. Rule order, encryption keys, and delete protection all change behavior only for traffic that already arrives.",{"question":1783,"type":744,"options":1784,"correctAnswer":1785,"explanation":1789},"A firewall policy has stateless default actions set to Pass for full packets, and no stateless rule group forwards anything to the stateful engine. What is the result?",[1785,1786,1787,1788],"The stateful rules are never evaluated, so Suricata rules and domain lists have no effect","The stateful rules run anyway, because Pass means continue inspecting","Traffic is dropped because no rule matched","The policy fails validation at creation time","The stateless engine decides whether a packet is passed, dropped, or forwarded to the stateful engine, and only forwarded traffic reaches your Suricata rules and domain lists. A stateless default of Pass sends traffic straight through, which is also why no alert or flow logs appear: firewall logging only covers traffic forwarded to the stateful engine. The policy is valid, which is what makes this a configuration audit finding rather than a deployment error.",{"question":1791,"type":744,"options":1792,"correctAnswer":782,"explanation":1793},"True or False: if a DNS Firewall rule group is associated with a VPC and Route 53 VPC Resolver receives no reply from DNS Firewall, queries are allowed through by default.",[781,782],"The default DNS Firewall failure mode is closed: VPC Resolver blocks the query and returns SERVFAIL, favoring security over availability. Fail open is an explicit opt-in that you set with the FirewallFailOpen setting on the VPC firewall configuration, and it trades security for availability. Auditing this setting matters because a fail-open VPC quietly loses its DNS protections during an impairment.",{"question":1795,"type":744,"options":1796,"correctAnswer":1798,"explanation":1801},"Six months after rollout, a DNS Firewall rule group still uses the Alert action on the AWS managed Aggregate Threat List. What is the operational consequence?",[1797,1798,1799,1800],"Queries to listed domains are blocked, and the alert only adds a log entry","Queries to listed domains are permitted and logged, so the rule detects exfiltration without stopping it","The managed list is not evaluated until the action is changed to Block","The rule group is ignored because Alert is not valid on a managed domain list","Alert stops inspection, permits the query, and writes a record to the Resolver query logs, which is exactly what AWS recommends while you measure a new rule's blast radius. Leaving it there permanently turns a control into a report. Block is the action that discontinues the query and returns your chosen response, and a stale Alert action is one of the most common findings in a DNS Firewall audit.",{"question":1803,"type":744,"options":1804,"correctAnswer":1541,"explanation":1806},"You need a DNS Firewall block response that makes clients believe the domain does not exist. Which block response do you configure?",[1541,1535,1805,1589],"OVERRIDE with a CNAME to a sinkhole","NXDOMAIN answers that the queried domain name does not exist, while NODATA answers that the query succeeded but no record is available, and OVERRIDE returns a custom CNAME with a time to live that defaults to 0 so the answer is not cached. SERVFAIL is not a block response you configure: it is what VPC Resolver returns when a fail-closed VPC gets no reply from DNS Firewall. Choosing between NXDOMAIN and OVERRIDE usually depends on whether you want the client to fail fast or land on a sinkhole page you control.",{"question":1808,"type":744,"options":1809,"correctAnswer":1811,"explanation":1814},"Your organization wants the same DNS Firewall rule groups and Network Firewall policies applied automatically to every VPC in every member account, including accounts created next quarter. What does that require?",[1810,1811,1812,1813],"A CloudFormation StackSet targeting each Region","AWS Firewall Manager, which requires AWS Organizations and AWS Config","Shield Advanced protection groups","A Route 53 Profile shared with AWS RAM","Firewall Manager centrally configures AWS WAF, Shield Advanced, security groups, network ACLs, Network Firewall, and DNS Firewall across an organization, and it automatically brings new accounts and resources into scope. It sits outside a single-account audit, which is where the exam scopes this skill, so treat it as the answer to the organization-wide version of the question. StackSets deploy templates but do not continuously enforce protection scope, and protection groups only cluster resources already protected by Shield Advanced.",{"title":823,"description":824},"courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/04-network-protection-and-cost/01-auditing-network-protection-services","H1DNyH2hRXJaSSVVG36mKsqWAynwf1eCtPpcoiVoo0Q"]