ANS-C01 Question 502
Select 2Your company is setting up a secure site-to-site VPN connection between its on-premises data center and a VPC in AWS. The requirement is to ensure encryption for data in transit using an industry-standard protocol. Which of the following methods can be used to accomplish this?
- A
IPsec (Internet Protocol Security)
- B
TLS (Transport Layer Security) with Amazon API Gateway
- C
Direct Connect with MACsec
- D
AWS Site-to-Site VPN with IPsec
Show answer and explanation
Correct answers: A, D
Explanation
To securely encrypt data in transit for a site-to-site VPN connection, IPsec is the industry-standard protocol used. AWS Site-to-Site VPN is built on IPsec technology, making it a valid solution for this requirement. TLS is application-level encryption and not suitable for site-to-site VPNs, while Direct Connect with MACsec operates at the physical layer and does not meet the VPN requirement.
- A. Correct.
IPsec is an industry-standard protocol designed for securing data in transit over IP networks. It encrypts and authenticates IP packets, making it a common choice for site-to-site VPN connections.
- B. Incorrect.
TLS is a protocol for encrypting application-level data, commonly used with HTTPS or services like API Gateway. While it ensures encryption, it is not typically used for site-to-site VPN connections.
- C. Incorrect.
Direct Connect is used for dedicated network connections between on-premises and AWS. While MACsec can be enabled for physical layer encryption, Direct Connect with MACsec does not natively provide a site-to-site VPN solution.
- D. Correct.
AWS Site-to-Site VPN uses IPsec to secure traffic between on-premises and AWS, meeting the requirement for encrypting data in transit using an industry-standard protocol.