ANS-C01 Question 496
Select 3A financial services company needs to ensure that all data transmitted between their on-premises data center and their VPC in AWS is encrypted. They are looking for a solution that minimizes operational overhead and supports high throughput. Which network encryption options can they use to achieve this requirement?
- A
AWS VPN with IPsec
- B
AWS Direct Connect with MACsec
- C
AWS PrivateLink
- D
TLS encryption at the application level
- E
AWS Direct Connect with IPsec over a public virtual interface
Show answer and explanation
Correct answers: A, B, E
Explanation
The company requires network-level encryption to secure data in transit between their on-premises data center and AWS while minimizing operational overhead and supporting high throughput. AWS VPN with IPsec is a straightforward way to achieve encrypted connectivity. AWS Direct Connect with MACsec provides encryption for Direct Connect links, ensuring secure, high-speed communication. Additionally, an IPsec VPN tunnel can be configured over a public virtual interface on Direct Connect to combine encryption with the benefits of dedicated connectivity. PrivateLink and TLS encryption do not meet the requirements for network-layer encryption.
- A. Correct.
AWS VPN with IPsec provides encrypted connectivity between on-premises data centers and AWS VPCs using the industry-standard IPsec protocol. It is a common choice for encrypting data in transit.
- B. Correct.
AWS Direct Connect with MACsec enables encryption for dedicated network connections between on-premises and AWS. It provides secure, high-throughput, low-latency connectivity with minimal operational overhead.
- C. Incorrect.
AWS PrivateLink provides private connectivity between VPCs and AWS services or on-premises applications, but it does not inherently offer encryption for data in transit.
- D. Incorrect.
TLS encryption operates at the application level and requires managing certificates and application-level changes, which may add operational overhead and may not meet the requirement of network-level encryption.
- E. Correct.
AWS Direct Connect with IPsec over a public virtual interface allows you to establish an encrypted VPN connection over a Direct Connect link, combining high throughput with IPsec encryption.