ANS-C01 Question 456
Select 3Your company operates in the financial sector and must comply with strict regulatory requirements, including encrypting sensitive data in transit and ensuring network traffic is monitored at all times. You are tasked with designing a network architecture on AWS to meet these requirements. Which combination of services and configurations will best address these needs?
- A
Use VPC Traffic Mirroring to capture and inspect network traffic in real-time.
- B
Establish a Site-to-Site VPN connection with encryption enabled between your on-premises data center and AWS.
- C
Configure AWS WAF to block unauthorized traffic to your application hosted on Amazon EC2.
- D
Implement a private VPC endpoint for accessing AWS services securely without traversing the public internet.
- E
Enable AWS CloudTrail to log API activity and monitor compliance across your network environment.
Show answer and explanation
Correct answers: A, B, D
Explanation
The correct combination of options ensures that the architecture is designed to meet the specified security and compliance requirements. VPC Traffic Mirroring provides real-time network traffic monitoring, whereas a Site-to-Site VPN with encryption secures sensitive data as it traverses between environments. Private VPC endpoints ensure secure communication with AWS services without exposing traffic to the public internet. These features collectively address the regulatory requirements for encryption, monitoring, and secure network architecture.
- A. Correct.
This option is correct. VPC Traffic Mirroring is a powerful feature to capture and analyze network traffic for security monitoring, which is crucial for meeting compliance requirements.
- B. Correct.
This option is correct. A Site-to-Site VPN with encryption ensures that sensitive data transmitted between your on-premises environment and AWS remains secure, addressing regulatory requirements for data in transit.
- C. Incorrect.
This option is incorrect. While AWS WAF helps protect against web-based attacks, it does not address encryption of data in transit or network traffic monitoring, which are specific security and compliance requirements in this scenario.
- D. Correct.
This option is correct. A private VPC endpoint ensures that communication with AWS services remains within the AWS network, avoiding exposure to the public internet and enhancing security.
- E. Incorrect.
This option is incorrect. While AWS CloudTrail is essential for logging and compliance, it does not address the specific scenario requirements of encrypting data in transit or monitoring network traffic in real-time.