TGW VPC attachment data-plane availability depends on enabled attachment AZs; a subnet without an attachment path cannot assume that another AZ's attachment automatically carries its traffic; that still would not establish the requested outcome: connect packet inspection appliances to GWLB.

GWLB uses GENEVE encapsulation to distribute traffic to inspection appliances, while GWLBe provides a private steering endpoint inside service-consumer VPCs; the scenario instead needs an action that will connect packet inspection appliances to GWLB.

TGW appliance mode helps ensure the same appliance AZ is selected for a flow in both directions, which is important for stateful inspection continuity; those conditions do not produce the required result: connect packet inspection appliances to GWLB.

ALB mutual authentication can verify client certificates for inbound HTTPS sessions while preserving the ability to apply application-layer listener rules; the scenario instead needs an action that will invoke serverless targets through an ALB.

IP target mode registers Pod network addresses in the load balancer target group; instance target mode instead normally directs traffic through node-level ports; it changes a different aspect of the architecture rather than fulfilling the need to invoke serverless targets through an ALB.

Slow start gradually increases traffic sent to a newly healthy target during its configured warm-up interval, limiting sudden load as the replacement becomes ready; the operational gap would remain because the question requires a way to invoke serverless targets through an ALB.

A forced default route in full-tunnel mode sends ordinary internet traffic toward the VPN endpoint, the opposite of the stated routing requirement.

AWS NAT gateways reside in VPC subnets, not customer home routers, and do not define the client's split-tunnel route set.

An ALB listener redirect affects HTTP requests after they reach the application load balancer. It cannot control which network routes a remote laptop installs when establishing an AWS Client VPN connection.

NLB TLS access logs provide information about TLS connections handled by supported TLS listeners, helping diagnose negotiated protocol and certificate-related handshake behavior; it changes a different aspect of the architecture rather than fulfilling the need to retain source IP addresses through L4 forwarding.

A TCP listener forwards transport bytes without terminating TLS; a TLS listener would negotiate TLS at the load balancer and change where end-to-end certificate handling occurs; the operational gap would remain because the question requires a way to retain source IP addresses through L4 forwarding.

ALB can initiate HTTPS connections to backend targets, protecting the load-balancer-to-target segment; this is distinct from configuring a viewer-side HTTPS listener; it is not the action that directly makes the system retain source IP addresses through L4 forwarding.

A gateway timeout can occur when a backend does not respond in time; comparing request timing and target logs tests the hypothesis more directly than DNS registration changes; the operational gap would remain because the question requires a way to split requests between ALB target groups.

The deregistration delay sets how long a deregistering target can continue draining existing requests before being fully removed from service; that still would not establish the requested outcome: split requests between ALB target groups.

Server Name Indication lets the load balancer choose the appropriate configured certificate for the requested hostname without requiring one public IP per certificate; the scenario instead needs an action that will split requests between ALB target groups.

Slow start gradually increases traffic sent to a newly healthy target during its configured warm-up interval, limiting sudden load as the replacement becomes ready; it is not the action that directly makes the system distinguish load balancer errors from target errors.

ALB can initiate HTTPS connections to backend targets, protecting the load-balancer-to-target segment; this is distinct from configuring a viewer-side HTTPS listener; that still would not establish the requested outcome: distinguish load balancer errors from target errors.

An Application Load Balancer can transform supported HTTP requests into Lambda events and return its response as HTTP without an EC2 or IP target listener; those conditions do not produce the required result: distinguish load balancer errors from target errors.

HTTP requests may share TCP connections, and flow aggregation produces network records rather than one request row, so different record counts do not inherently mean loss; that still would not establish the requested outcome: inspect actual packet contents.

Flow Logs deliver aggregated metadata about observed IP flows and action status for the selected VPC resource; they are not packet-capture recordings; those conditions do not produce the required result: inspect actual packet contents.

Flow Logs aggregate network-flow information over a time window and only cover selected ENIs, subnets, or VPCs; request logs and flow records are not guaranteed one-to-one; it changes a different aspect of the architecture rather than fulfilling the need to inspect actual packet contents.

Origin access control governs supported origin authorization, chiefly S3 origin access; it does not instruct clients to remember an HTTPS-only policy.

CloudFront geographic restrictions permit or deny viewer requests according to country. They do not send an HSTS policy to browsers and therefore do not require subsequent HTTPS access.

Replacing origin certificates is not how browsers learn HSTS requirements; the relevant control is an HTTP response header delivered to viewers.

AWS provides two tunnels for redundancy; leaving a second tunnel's routing session unconfigured prevents it from taking over during planned or unplanned maintenance; those conditions do not produce the required result: alert on VPN tunnel health loss.

BGP exchanges prefixes and responds to route withdrawals across the VPN tunnel; static routing requires explicit configuration and does not provide equivalent dynamic route signaling; it changes a different aspect of the architecture rather than fulfilling the need to alert on VPN tunnel health loss.

IPsec tunnel establishment authenticates the encrypted underlay; dynamic route exchange requires a separate BGP session with the correct neighbors and ASN over the tunnel interfaces; it is not the action that directly makes the system alert on VPN tunnel health loss.

Resolver query information can tie source, queried name, response and time to DNS security rule behavior, helping distinguish an actual blocked lookup from application DNS failures; it changes a different aspect of the architecture rather than fulfilling the need to audit VPC DNS names looked up.

Resolver validation checks cryptographic DNSSEC integrity of applicable DNS responses; it is separate from signing the organization's own authoritative hosted zones; the operational gap would remain because the question requires a way to audit VPC DNS names looked up.

DNS response-code observations can distinguish nonexistence responses from failed or timed-out upstream resolution, guiding whether to inspect records or network paths; that still would not establish the requested outcome: audit VPC DNS names looked up.

Traffic Mirroring copies selected packets so the analyzer can inspect protocol exchanges; VPC Flow Logs record connection metadata rather than full packet payload; the operational gap would remain because the question requires a way to link cross-AZ traffic patterns to cost.

Flow Logs aggregate network-flow information over a time window and only cover selected ENIs, subnets, or VPCs; request logs and flow records are not guaranteed one-to-one; it is not the action that directly makes the system link cross-AZ traffic patterns to cost.

HTTP requests may share TCP connections, and flow aggregation produces network records rather than one request row, so different record counts do not inherently mean loss; that still would not establish the requested outcome: link cross-AZ traffic patterns to cost.