ANS-C01 Question 146
Select 2You are designing a hybrid cloud architecture that requires secure communication between your on-premises data center and an Amazon VPC. The solution must allow multicast traffic to flow between the two networks while ensuring data confidentiality. Which combination of technologies should you use to meet these requirements?
- A
IPsec VPN with GRE encapsulation
- B
Direct Connect with BGP routing
- C
IPsec VPN only
- D
GRE over IPsec VPN
Show answer and explanation
Correct answers: A, D
Explanation
Multicast traffic is not natively supported by IPsec VPN. However, using GRE (Generic Routing Encapsulation) allows multicast packets to be encapsulated and transmitted across the VPN. IPsec, in turn, encrypts the GRE traffic to maintain data confidentiality. Both 'IPsec VPN with GRE encapsulation' and 'GRE over IPsec VPN' achieve the goals of supporting multicast traffic and ensuring encryption, making them the correct answers for this scenario.
- A. Correct.
IPsec VPN with GRE encapsulation is a valid solution for this scenario. GRE encapsulation allows multicast traffic to be transmitted, and IPsec provides encryption and data confidentiality.
- B. Incorrect.
Direct Connect with BGP routing does not inherently provide encryption or support multicast traffic. It is designed for private, dedicated connectivity and lacks native support for this use case.
- C. Incorrect.
IPsec VPN alone does not support multicast traffic, as it does not encapsulate or handle multicast packets.
- D. Correct.
GRE over IPsec VPN is another valid solution. GRE encapsulates multicast traffic, and IPsec ensures encryption and confidentiality. This combination achieves both requirements of the scenario.