SAP-C02 Question 23
Single answerAn organization is hosting sensitive financial applications on Amazon ECS using the Fargate launch type. The applications are deployed in a private subnet within an Amazon VPC. The organization requires secure communication between the on-premises data center and the VPC to access the applications, while ensuring low latency and high bandwidth. Additionally, the applications must not be publicly accessible over the internet. What is the most appropriate networking solution to meet these requirements?
- A
Use AWS Direct Connect to establish a private connection between the on-premises data center and the VPC, and configure a private endpoint for the applications.
- B
Set up an AWS Site-to-Site VPN connection between the on-premises data center and the VPC, and use a NAT gateway for outbound internet connectivity.
- C
Create a VPC peering connection between the on-premises data center and the VPC to allow private communication with the applications.
- D
Deploy an AWS Global Accelerator endpoint in the public subnet to route traffic securely to the applications in the private subnet.
Show answer and explanation
Correct answer: A
Explanation
The organization requires secure, low-latency, and high-bandwidth communication between their on-premises data center and the Amazon VPC hosting their ECS applications. AWS Direct Connect is the most appropriate solution as it provides a dedicated, private connection that meets these requirements. Configuring a private endpoint ensures that the applications remain private and are not exposed to the internet.
- A. Correct.
This is the correct option. AWS Direct Connect provides a dedicated, private, low-latency, and high-bandwidth connection between the on-premises data center and the VPC. Configuring a private endpoint allows secure access to the applications without exposing them to the internet.
- B. Incorrect.
This is incorrect because while AWS Site-to-Site VPN provides secure connectivity, it does not offer the same low latency or high bandwidth as Direct Connect. Additionally, using a NAT gateway would expose the applications to outbound internet traffic, which violates the requirement.
- C. Incorrect.
This is incorrect because VPC peering is used for communication between two VPCs, not between an on-premises data center and a VPC. It does not meet the requirement for secure and private communication.
- D. Incorrect.
This is incorrect because AWS Global Accelerator is designed to improve the availability and performance of applications by routing traffic over the AWS global network, but it requires public IP addresses for the endpoint, which violates the requirement for private access.