A solutions architect needs to connect a company's corporate network to its VPC to allow on-premises access to its AWS resources. The solution must provide encryption of all traffic between the corporate network and the VPC at the network layer and the session layer. The solution also must provide security controls to prevent unrestricted access between AWS and the on-premises systems. Which solution meets these requirements?
Select an option, then click Submit answer.
Reference / correct answer:
Configure AWS Site-to-Site VPN to connect to the VPConfigure route table entries to direct traffic from on premises to the VPConfigure instance security groups and network ACLs to allow only required traffic from on premises.
Most accepted answer: C. Configure AWS Site-to-Site VPN to connect to the VPConfigure route table entries to direct traffic from on premises to the VPConfigure instance security groups and network ACLs to allow only required traffic from on premises.
Community votes: C=5, D=1
Selected Answer: C AWS Direct Connect does not provide encryption by itself; it is often used in conjunction with VPN for encrypted traffic. Direct Connect primarily offers a dedicated connection and does not inherently satisfy the encryption requirement. upvoted 8 times
Selected Answer: C A - Direct Connect provides private connectivity but does not inherently include encryption. B - IAM policies is irrelevent. C - AWS Site-to-Site VPN uses IPsec (network layer) and SSL/TLS (session layer) to encrypt all traffic between the on-premises network and the AWS VPC. D - Just like option A. upvoted 3 times
Selected Answer: C The correct answer is C. Configure AWS Site-to-Site VPN to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises. Explanation: Option C: Correct. AWS Site-to-Site VPN offers encrypted network connections over the internet, providing encryption of all traffic at the network layer (IPsec) between the on-premises network and the VPC. Moreover, by using route tables, security groups, and network ACLs, you can carefully control the flow of traffic and restrict access, thereby meeting the requirement of preventing unrestricted access. upvoted 3 times
Selected Answer: C This is C, but not for all the reasons everyone is posting. D, also encrypts traffic and works at the network layer and also has security controls to prevent unrestricted access between AWS and on-premises systems. So, if you thought D like I did initially you were very close. The reason it is C, is because C works at both the network and session layer while doing all the other requirements as well. Where as D only works at the network layer. Happy studying! upvoted 4 times
Selected Answer: D Answer is D upvoted 1 times FlyingHawk 1 year, 6 months ago Inter-Region gateway peering uses the same network infrastructure as VPC peering. Therefore traffic is encrypted using AES-256 encryption at the virtual network layer as it travels between Regions. Traffic is also encrypted using AES-256 encryption at the physical layer when it traverses network links that are outside of the physical control of AWS. As a result, traffic is double encrypted on network links outside the physical control of AWS. Within the same Region, traffic is encrypted at the physical layer only when it traverses network links that are outside of the physical control of AWS. upvoted 1 times ...
