ANS-C01 Question 145
Select 2You are designing a hybrid network that securely connects your on-premises data center to an Amazon VPC over the internet. The solution must ensure data integrity, confidentiality, and authentication. Additionally, you need to allow the transmission of non-IP protocols between the endpoints. Which combination of technologies would best meet these requirements?
- A
IPsec VPN
- B
Generic Routing Encapsulation (GRE)
- C
AWS Direct Connect
- D
SSL/TLS
- E
GRE over IPsec
Show answer and explanation
Correct answers: A, E
Explanation
The requirements specify the need for data integrity, confidentiality, and authentication, as well as support for non-IP protocols. IPsec alone cannot support non-IP protocols, and GRE alone does not provide encryption or authentication. Combining GRE with IPsec (GRE over IPsec) meets all the requirements by encapsulating non-IP protocols with GRE while securing the traffic with IPsec. AWS Direct Connect and SSL/TLS do not meet the specific requirements for this scenario.
- A. Correct.
IPsec provides encryption, authentication, and data integrity. However, it only supports IP traffic and does not inherently support non-IP protocols.
- B. Incorrect.
GRE is a tunneling protocol that allows the encapsulation of non-IP protocols. However, GRE does not provide encryption, authentication, or data integrity on its own.
- C. Incorrect.
AWS Direct Connect provides a dedicated private network connection between on-premises and AWS. While it is highly secure, it does not provide encryption over the public internet and does not natively support non-IP protocols.
- D. Incorrect.
SSL/TLS is a protocol for encrypting application-layer data (e.g., HTTPS traffic). It is not suitable for tunneling or supporting non-IP protocols.
- E. Correct.
GRE over IPsec combines the benefits of both GRE and IPsec. GRE encapsulates non-IP protocols, and IPsec adds encryption, authentication, and data integrity, making it the best solution for the requirements.