ANS-C01 Question 143
Single answerYour organization has established an AWS Site-to-Site VPN connection between its on-premises data center and an Amazon VPC. The VPN uses IPsec for encryption. However, you need to support multicast traffic for specific applications, which IPsec does not natively support. How can you modify the configuration to support multicast traffic while maintaining the encrypted connection?
- A
Use Generic Routing Encapsulation (GRE) over IPsec to encapsulate multicast traffic.
- B
Enable multicast support directly in the AWS Site-to-Site VPN connection settings.
- C
Migrate the VPN connection to AWS Direct Connect, which supports multicast natively.
- D
Configure an additional IPsec tunnel specifically for multicast traffic.
Show answer and explanation
Correct answer: A
Explanation
IPsec alone does not support multicast traffic, as it is designed for unicast communication. To address this, GRE can be used to encapsulate multicast traffic, and IPsec can then encrypt the GRE-encapsulated packets. This combination ensures both compatibility with multicast and secure transmission over the VPN.
- A. Correct.
Correct. GRE can encapsulate multicast traffic, which can then be encrypted by IPsec. This allows multicast traffic to flow securely over the VPN.
- B. Incorrect.
Incorrect. AWS Site-to-Site VPN does not natively support multicast traffic and does not provide a direct option to enable it.
- C. Incorrect.
Incorrect. AWS Direct Connect does not natively support multicast; it is a dedicated network connection, not a tunneling protocol.
- D. Incorrect.
Incorrect. IPsec does not natively support multicast traffic, so configuring an additional IPsec tunnel will not solve the issue.