ANS-C01 Question 494
Select 2You are designing a secure network architecture for an application hosted in AWS. The application handles sensitive customer data and requires encryption for data in transit between resources within the VPC and resources accessed over the internet. Which of the following network encryption options can you use to meet this requirement?
- A
Use VPC traffic mirroring to capture and encrypt packet-level data.
- B
Enable AWS PrivateLink for secure and encrypted communication between services.
- C
Use AWS Site-to-Site VPN for encrypted communication between on-premises and AWS resources.
- D
Enable TLS (Transport Layer Security) for encrypting data in transit between application endpoints.
- E
Enable Transit Gateway with encryption enabled to secure inter-VPC traffic.
Show answer and explanation
Correct answers: B, D
Explanation
AWS provides multiple options for encrypting data in transit based on specific use cases. For this scenario, AWS PrivateLink ensures secure and encrypted communication within AWS, while TLS encrypts data in transit between application endpoints over the internet. These solutions meet the requirement for secure network communication. Other options like VPC Traffic Mirroring, Site-to-Site VPN, and Transit Gateway either do not provide encryption for the specified use case or are irrelevant to the scenario.
- A. Incorrect.
VPC traffic mirroring is used for monitoring and debugging network traffic and does not provide encryption. It captures packet-level data for analysis but does not secure or encrypt the data.
- B. Correct.
AWS PrivateLink allows secure and private connectivity between VPCs, AWS services, and on-premises applications. It uses AWS’s secure backbone network and supports encryption for communication.
- C. Incorrect.
AWS Site-to-Site VPN provides an encrypted connection between on-premises networks and AWS. While it secures data in transit, the question focuses on encryption within the VPC and over the internet, which does not involve Site-to-Site VPN.
- D. Correct.
TLS (Transport Layer Security) is a widely used protocol for encrypting data in transit. It is suitable for securing communication between application endpoints within the VPC and external resources over the internet.
- E. Incorrect.
Transit Gateway provides connectivity between multiple VPCs and on-premises networks at scale, but it does not inherently encrypt inter-VPC traffic unless combined with other encryption mechanisms like VPN or TLS.