A solutions architect needs to connect a company's corporate network to its VPC to allow on- premises access to its AWS resources. The solution must provide encryption of all trafficbetween the…

Question

Options

• AConfigure AWS Direct Connect to connect to the VPC. Configure the VPC route tables to allow
• BCreate an IAM policy to allow access to the AWS Management Console only from a defined set of
• CConfigure AWS Site-to-Site VPN to connect to the VPC. Configure route table entries to direct
• DConfigure AWS Transit Gateway to connect to the VPC. Configure route table entries to direct

• A
  15% (5)
• B
  6% (2)
• C
  76% (25)
• D
  3% (1)

Explanation

This solution meets the requirements of providing encryption at both the network and session layers while also allowing for controlled access between on-premises systems and AWS resources. AWS Site-to-Site VPN: This service allows you to establish a secure and encrypted connection between your on-premises network and AWS VPC over the internet or via AWS Direct Connect. The VPN encrypts data at the network layer (IPsec) as it travels between the corporate network and AWS. Routing and Security Controls: By configuring route table entries, you can ensure that only the traffic intended for AWS resources is directed to the VPC. Additionally, by setting up security groups and network ACLs, you can further restrict and control which traffic is allowed to communicate with the instances within your VPC. This approach provides the necessary security to prevent unrestricted access, aligning with the company's security policies. Why Not Other Options? Option A (AWS Direct Connect): While Direct Connect provides a private connection, it does not inherently provide encryption. Additional steps would be required to encrypt traffic, and it doesn't address the session layer encryption. Option B (IAM policies for Console access): This option does not meet the requirement for network-level encryption and security between the corporate network and the VPC. Option D (AWS Transit Gateway): Although Transit Gateway can help in managing multiple connections, it doesn't directly provide encryption at the network layer. You would still need to configure a VPN or use other methods for encryption.

No community discussion yet for this question.