ANS-C01 Question 485
Select 2You are designing a secure architecture for a hybrid application that communicates between an on-premises data center and an AWS VPC over an AWS Site-to-Site VPN. To ensure the confidentiality of data in transit, which of the following actions should you take? (Select TWO).
- A
Configure the VPN tunnel to use AES-256 encryption for data encryption.
- B
Use AWS CloudTrail to log all API calls made by the VPN connection.
- C
Enable Perfect Forward Secrecy (PFS) for the VPN tunnel.
- D
Configure an IAM role to enforce encryption policies on the VPN traffic.
- E
Use a custom encryption algorithm for the VPN tunnel.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure confidentiality of data in transit, it is crucial to use strong encryption methods such as AES-256 and enable additional features like Perfect Forward Secrecy (PFS) for enhanced security. Other options, such as logging or IAM roles, do not directly address the confidentiality of network communications.
- A. Correct.
Correct. AES-256 is a strong encryption standard that ensures data confidentiality during transit.
- B. Incorrect.
Incorrect. While AWS CloudTrail improves auditing and logging for API activity, it does not directly ensure confidentiality of data in transit.
- C. Correct.
Correct. Perfect Forward Secrecy (PFS) ensures session keys are not compromised even if the server's private key is exposed, enhancing data confidentiality.
- D. Incorrect.
Incorrect. IAM roles are used for access control and permissions but do not enforce encryption policies directly on VPN traffic.
- E. Incorrect.
Incorrect. AWS Site-to-Site VPN does not support the use of custom encryption algorithms. It uses industry-standard algorithms like AES.