ANS-C01 Question 499
Single answerYour organization has established an AWS Direct Connect connection between its on-premises data center and AWS. However, due to compliance requirements, all traffic between the on-premises environment and AWS must be encrypted. Which approach should you take to ensure this while leveraging the Direct Connect connection?
- A
Establish a Site-to-Site VPN over the Direct Connect connection.
- B
Enable encryption on the Direct Connect connection directly.
- C
Configure an AWS Transit Gateway to enforce encryption on all traffic.
- D
Use a Virtual Private Gateway (VGW) with encryption enabled.
Show answer and explanation
Correct answer: A
Explanation
Direct Connect provides a dedicated, high-bandwidth connection, but it does not natively encrypt traffic. To meet compliance requirements for encryption, you can establish a Site-to-Site VPN over the Direct Connect connection. This approach combines the benefits of Direct Connect with the security of encrypted communication provided by the VPN.
- A. Correct.
Correct. Establishing a Site-to-Site VPN over Direct Connect ensures that all traffic is encrypted while still benefiting from the low-latency and dedicated connection of Direct Connect.
- B. Incorrect.
Incorrect. Direct Connect does not natively support encryption. Encryption must be implemented through another mechanism, such as a VPN.
- C. Incorrect.
Incorrect. AWS Transit Gateway does not inherently enforce encryption. While Transit Gateway can route traffic, encryption must be configured separately, such as through a VPN.
- D. Incorrect.
Incorrect. A Virtual Private Gateway (VGW) does not provide encryption on its own. It can, however, be used in conjunction with a VPN to encrypt traffic.