nerdexam
Amazon

SAP-C02 · Question #739

A software development company has multiple engineers who are working remotely. The company is running Active Directory Domain Services (AD DS) on an Amazon EC2 instance. The company's security policy

The correct answer is B. Create an AWS Client VPN endpoint. Create an AD Connector directory for integration with AD. To enable remote engineers to securely access internal services in a VPC via VPN with MFA, the solution architect should deploy an AWS Client VPN integrated with Active Directory.

Submitted by zhang_li· Mar 6, 2026Design for New Solutions

Question

A software development company has multiple engineers who are working remotely. The company is running Active Directory Domain Services (AD DS) on an Amazon EC2 instance. The company's security policy states that all internal, nonpublic services that are deployed in a VPC must be accessible through a VPN. Multi-factor authentication (MFA) must be used for access to a VPN. What should a solutions architect do to meet these requirements?

Options

  • ACreate an AWS Site-to-Site VPN connection. Configure integration between a VPN and AD DS.
  • BCreate an AWS Client VPN endpoint. Create an AD Connector directory for integration with AD
  • CCreate multiple AWS Site-to-Site VPN connections by using AWS VPN CloudHub. Configure
  • DCreate an Amazon WorkLink endpoint. Configure integration between Amazon WorkLink and AD

How the community answered

(49 responses)
  • A
    4% (2)
  • B
    71% (35)
  • C
    16% (8)
  • D
    8% (4)

Why each option

To enable remote engineers to securely access internal services in a VPC via VPN with MFA, the solution architect should deploy an AWS Client VPN integrated with Active Directory.

ACreate an AWS Site-to-Site VPN connection. Configure integration between a VPN and AD DS.

An AWS Site-to-Site VPN connection is designed for connecting an on-premises network to a VPC, not for individual remote client access from engineers' devices.

BCreate an AWS Client VPN endpoint. Create an AD Connector directory for integration with ADCorrect

AWS Client VPN provides a secure, client-based access solution for remote users to connect to resources within a VPC, directly meeting the VPN access requirement for remote engineers. Integrating it with AD Connector allows authentication against the existing Active Directory and enforces multi-factor authentication (MFA) as per the security policy.

CCreate multiple AWS Site-to-Site VPN connections by using AWS VPN CloudHub. Configure

AWS VPN CloudHub is used for connecting multiple on-premises branch offices to a central AWS VPC, which is not suitable for individual remote user access.

DCreate an Amazon WorkLink endpoint. Configure integration between Amazon WorkLink and AD

Amazon WorkLink provides secure access to internal websites and web applications for mobile devices, but it does not offer general VPN access to internal nonpublic services.

Concept tested: Client VPN with AD authentication and MFA

Source: https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice