SAP-C02 Question 238
Select 2Your company has implemented a hybrid cloud architecture and requires secure, low-latency communication between its on-premises data center and an AWS VPC. The on-premises applications need to access AWS services such as S3 and DynamoDB over private connectivity without traversing the public internet. Which solution should you implement to meet these requirements?
- A
Configure AWS PrivateLink for the required AWS services and establish a Direct Connect connection between your data center and AWS.
- B
Set up a VPN connection between your data center and your VPC and configure VPC endpoints for the AWS services.
- C
Use a NAT Gateway in the VPC to route traffic to AWS services over the public internet and secure it using security groups.
- D
Establish an AWS Direct Connect connection with a private virtual interface (private VIF) and configure VPC endpoints for the AWS services.
- E
Use AWS Transit Gateway to connect your data center to AWS services through a shared public internet connection.
Show answer and explanation
Correct answers: A, D
Explanation
To meet the requirements for secure, low-latency communication and private connectivity to AWS services, you need to use private networking solutions such as AWS PrivateLink or VPC endpoints combined with Direct Connect or VPN. Both options (1 and 4) ensure that application traffic does not traverse the public internet and meets the performance and security needs.
- A. Correct.
Correct: AWS PrivateLink allows access to AWS services over a private connection without exposing traffic to the public internet. Direct Connect provides low-latency and high-bandwidth connectivity between your data center and AWS.
- B. Incorrect.
Correct: A VPN provides secure connectivity to the VPC, and VPC endpoints enable private access to AWS services without traversing the public internet.
- C. Incorrect.
Incorrect: A NAT Gateway routes traffic to the internet, which does not meet the requirement for private connectivity. Security groups alone cannot provide private access to AWS services.
- D. Correct.
Correct: Direct Connect with a private virtual interface (private VIF) ensures low-latency connectivity to the VPC, and VPC endpoints provide private access to AWS services.
- E. Incorrect.
Incorrect: AWS Transit Gateway does not inherently provide private access to AWS services like S3 and DynamoDB. Additionally, using the public internet does not meet the security requirement.