ANS-C01 Question 503
Single answerYou are designing a secure hybrid infrastructure between your on-premises data center and AWS using a Site-to-Site VPN connection. To ensure data confidentiality and integrity during transit, which encryption protocol should you configure on both ends of the VPN tunnel?
- A
IPsec with AES-256 encryption
- B
SSL/TLS with RSA certificates
- C
Plaintext communication with TCP session monitoring
- D
HTTP with Basic Authentication
Show answer and explanation
Correct answer: A
Explanation
IPsec (Internet Protocol Security) with AES-256 encryption is the recommended method for securing data in transit over a Site-to-Site VPN connection. It provides robust encryption and integrity checks, making it ideal for hybrid cloud environments where confidentiality and data protection are critical. Other options, such as SSL/TLS or HTTP, are either application-layer protocols or insecure for this use case.
- A. Correct.
IPsec with AES-256 encryption is a highly secure and commonly used encryption protocol for Site-to-Site VPNs. It ensures data confidentiality, integrity, and authenticity during transit.
- B. Incorrect.
SSL/TLS with RSA certificates is commonly used for securing application-level connections, such as HTTPS, but it is not suitable for encrypting data in transit for Site-to-Site VPNs.
- C. Incorrect.
Plaintext communication with TCP session monitoring does not provide any encryption or security for data in transit, making it a non-viable option for securing a VPN connection.
- D. Incorrect.
HTTP with Basic Authentication is an insecure method for data transmission as it does not encrypt data during transit and is not applicable for VPN encryption.