ANS-C01 Question 144
Select 2Your company has established a hybrid cloud architecture between its on-premises data center and AWS. To securely extend the on-premises network to AWS over the internet, you are tasked with creating a VPN connection using IPsec. However, your network team also needs to tunnel multicast traffic between the two sites, which is not natively supported by IPsec. Which solution would satisfy these requirements?
- A
Encapsulate multicast traffic within a Generic Routing Encapsulation (GRE) tunnel and then secure the GRE traffic with IPsec.
- B
Use an AWS Direct Connect connection to transport multicast traffic without the need for IPsec or GRE.
- C
Enable native IPsec support for multicast traffic by modifying the VPN customer gateway configuration.
- D
Use GRE tunneling alone to transport both unicast and multicast traffic without encryption.
- E
Create a GRE tunnel over the IPsec VPN to transport multicast traffic securely.
Show answer and explanation
Correct answers: A, E
Explanation
IPsec alone does not natively support multicast traffic, which is required in this scenario. The correct approach is to use a GRE tunnel to encapsulate multicast traffic and then secure that GRE tunnel using IPsec. This combination ensures that multicast traffic can be transported and securely encrypted over the internet, meeting the requirements of the hybrid cloud architecture.
- A. Correct.
Correct. GRE can encapsulate multicast traffic, and IPsec can then encrypt the GRE tunnel to ensure secure communication over the internet.
- B. Incorrect.
Incorrect. AWS Direct Connect is a private dedicated connection that does not natively support multicast traffic and does not address the encryption requirement specified in the scenario.
- C. Incorrect.
Incorrect. IPsec does not natively support multicast traffic; modifications to the customer gateway configuration cannot enable this functionality.
- D. Incorrect.
Incorrect. While GRE can transport multicast traffic, using GRE alone would not provide the encryption required for secure communication over the internet.
- E. Correct.
Correct. A GRE tunnel encapsulates multicast traffic, and when combined with IPsec, it ensures both transport capability for multicast and encryption for secure communication.