ANS-C01 Question 504
Select 3An organization is setting up a site-to-site VPN between its on-premises data center and a VPC in AWS. As part of the configuration, they want to ensure that data in transit is encrypted. Which of the following encryption methods are supported by AWS Site-to-Site VPN?
- A
AES-256 for IPsec encryption
- B
ChaCha20-Poly1305 for IPsec encryption
- C
IKEv2 for key exchange
- D
RSA for encrypting data payloads
- E
SHA-2 for integrity verification
Show answer and explanation
Correct answers: A, C, E
Explanation
AWS Site-to-Site VPN supports specific encryption and integrity protocols to ensure secure communication. AES-256 is a widely supported encryption standard for IPsec. IKEv2 is used for secure key exchange, and SHA-2 is employed for data integrity. Other methods like ChaCha20-Poly1305 and RSA for payload encryption are not supported by AWS Site-to-Site VPN.
- A. Correct.
AES-256 is a widely supported and highly secure encryption standard used by AWS Site-to-Site VPN for IPsec encryption.
- B. Incorrect.
ChaCha20-Poly1305 is not currently supported by AWS Site-to-Site VPN as an encryption method.
- C. Correct.
IKEv2 is supported by AWS Site-to-Site VPN and is used for key exchange and setting up secure communication channels.
- D. Incorrect.
RSA is not used for encrypting data payloads in AWS Site-to-Site VPN. It is typically used for public/private key encryption but not for IPsec payloads.
- E. Correct.
SHA-2 is supported by AWS Site-to-Site VPN for integrity verification, ensuring that data has not been tampered with during transit.