A company needs to extend its on-premises private cloud to an external cloud provider to meet the needs of additional storage and database services. The cloud architect also needs to implement a…

Network ACL policies control traffic flow at the packet level by permitting or denying connections but do not inherently provide encryption for data-in-transit between different environments.

MPLS (Multiprotocol Label Switching) provides a private, dedicated network connection with high performance, but it is often more expensive and complex than a VPN for simply extending a private cloud to a public cloud, and may still require higher-layer encryption.

A TLS tunnel secures point-to-point communication, often at the application layer, but it is not typically used as the primary method to securely connect two entire networks (on-premises to cloud) for general services like storage and databases; a VPN provides broader network-level connectivity and encryption.

A site-to-site VPN establishes a secure, encrypted connection between an on-premises network and a cloud provider's network over the internet, effectively creating a private network. This design allows the on-premises environment to securely access cloud resources like storage and databases as if they were part of the local network, fulfilling both connectivity and data-in-transit security needs through encryption.