IP target mode registers Pod network addresses in the load balancer target group; instance target mode instead normally directs traffic through node-level ports; it is not the action that directly makes the system remove public reachability instead of hiding hostnames.

An Application Load Balancer can transform supported HTTP requests into Lambda events and return its response as HTTP without an EC2 or IP target listener; that still would not establish the requested outcome: remove public reachability instead of hiding hostnames.

ALB mutual authentication can verify client certificates for inbound HTTPS sessions while preserving the ability to apply application-layer listener rules; the scenario instead needs an action that will remove public reachability instead of hiding hostnames.

Route tables can reference customer-managed prefix lists as destinations; a changed list of prefixes can influence matching traffic even when the route itself was not individually edited; it is not the action that directly makes the system restrict HTTPS egress using maintained destination prefixes.

Security groups are stateful, but replacing the rules does not grant indefinite access for new flows; connection tracking and subsequent connection establishment follow allowed traffic and rule state; the scenario instead needs an action that will restrict HTTPS egress using maintained destination prefixes.

AWS Config records resource configuration and can evaluate it against guardrails; a workflow can then notify or trigger controlled remediation; those conditions do not produce the required result: restrict HTTPS egress using maintained destination prefixes.

HTTP requests may share TCP connections, and flow aggregation produces network records rather than one request row, so different record counts do not inherently mean loss; that still would not establish the requested outcome: audit observed ENI-level flow decisions.

Flow Logs aggregate network-flow information over a time window and only cover selected ENIs, subnets, or VPCs; request logs and flow records are not guaranteed one-to-one; the scenario instead needs an action that will audit observed ENI-level flow decisions.

Traffic Mirroring copies selected packets so the analyzer can inspect protocol exchanges; VPC Flow Logs record connection metadata rather than full packet payload; it changes a different aspect of the architecture rather than fulfilling the need to audit observed ENI-level flow decisions.

Flow Logs aggregate network-flow information over a time window and only cover selected ENIs, subnets, or VPCs; request logs and flow records are not guaranteed one-to-one; the scenario instead needs an action that will centralize long-term network flow records.

Traffic Mirroring copies selected packets so the analyzer can inspect protocol exchanges; VPC Flow Logs record connection metadata rather than full packet payload; those conditions do not produce the required result: centralize long-term network flow records.

HTTP requests may share TCP connections, and flow aggregation produces network records rather than one request row, so different record counts do not inherently mean loss; it changes a different aspect of the architecture rather than fulfilling the need to centralize long-term network flow records.

A TCP listener forwards transport bytes without terminating TLS; a TLS listener would negotiate TLS at the load balancer and change where end-to-end certificate handling occurs; it changes a different aspect of the architecture rather than fulfilling the need to examine TLS negotiation at a Network Load Balancer.

Depending on target type and protocol, NLB client IP preservation may need to be explicitly configured; otherwise targets can observe a translated source address; the operational gap would remain because the question requires a way to examine TLS negotiation at a Network Load Balancer.

ALB security policies govern the protocols and ciphers accepted by its TLS listener; rotating the certificate alone does not disable old protocol versions; it is not the action that directly makes the system examine TLS negotiation at a Network Load Balancer.

Rate-based rules count requests over a configurable evaluation window using the selected aggregation key and apply the configured action after the rate limit is exceeded; it changes a different aspect of the architecture rather than fulfilling the need to review exact WAF decisions for HTTP requests.

Firewall Manager can apply and audit centrally defined security policies across eligible accounts and resources under AWS Organizations, reducing individual distribution policy drift; it is not the action that directly makes the system review exact WAF decisions for HTTP requests.

WAF inspects supported HTTP request components and can block matching application-layer attack patterns before the request reaches the origin; that still would not establish the requested outcome: review exact WAF decisions for HTTP requests.

Edge hit rates describe cache behavior, whereas origin errors diagnose backend responses; combining them as one success percentage obscures different failure causes; the operational gap would remain because the question requires a way to alert on detected DDoS activity.

WAF logs show per-request evaluated rule actions and relevant request attributes, supporting investigation beyond high-level web ACL metric counts; it is not the action that directly makes the system alert on detected DDoS activity.

Origin Shield adds a centralized caching layer between regional caches and the origin, improving cache reuse for requests arriving through multiple regional caches and reducing duplicate fetches; the scenario instead needs an action that will alert on detected DDoS activity.

IAM roles constrain which networking APIs automation can call, and CloudTrail supplies audit events for changes; storing broad permanent access keys in pipeline code weakens control; it is not the action that directly makes the system audit policy-forbidden network paths.

Reachability Analyzer models routing and security configuration to identify a blocking component; it is not a live probe that demonstrates application process health; the scenario instead needs an action that will audit policy-forbidden network paths.

GuardDuty correlates supported telemetry to generate potential threat findings, which can provide enrichment for triage but are not a packet-by-packet capture of the session; those conditions do not produce the required result: audit policy-forbidden network paths.

Security groups are stateful, but replacing the rules does not grant indefinite access for new flows; connection tracking and subsequent connection establishment follow allowed traffic and rule state; that still would not establish the requested outcome: reconstruct historical security-group exposure.

Resolver forwarding generates DNS queries from the endpoint ENIs; restrictive security-group egress and return-path routing can prevent a valid forwarding rule from delivering them; the scenario instead needs an action that will reconstruct historical security-group exposure.

AWS Config records resource configuration and can evaluate it against guardrails; a workflow can then notify or trigger controlled remediation; it changes a different aspect of the architecture rather than fulfilling the need to reconstruct historical security-group exposure.

Aggregators collect configuration and compliance information across authorized accounts and Regions to support centralized queries and dashboards, while rule evaluation remains tied to the sources; the scenario instead needs an action that will triage managed EC2 network threat findings.

Network Access Analyzer evaluates modeled VPC networking configurations against defined access requirements and identifies unintended access patterns without generating live application packets; it changes a different aspect of the architecture rather than fulfilling the need to triage managed EC2 network threat findings.

Reachability Analyzer models routing and security configuration to identify a blocking component; it is not a live probe that demonstrates application process health; the operational gap would remain because the question requires a way to triage managed EC2 network threat findings.

Stateful domain inspection can examine supported protocol metadata such as TLS SNI without full TLS decryption; it cannot classify traffic lacking the inspected hostname signal; it changes a different aspect of the architecture rather than fulfilling the need to alert on logged inspection denies.

Network Firewall processes packets according to configured stateless and stateful policies; the surrounding subnet/TGW routing must force both relevant directions through the endpoints; the operational gap would remain because the question requires a way to alert on logged inspection denies.

An alert action records a match without necessarily dropping the traffic, while a drop or reject action changes data-plane delivery; rule action and event evidence must be read together; it is not the action that directly makes the system alert on logged inspection denies.