SAP-C02 Question 652
Single answerA company is migrating its on-premises application to AWS. The application handles sensitive customer data and has strict compliance requirements. The company needs to ensure that all data in transit between its on-premises environment and AWS is encrypted, while also minimizing latency for real-time data processing. What is the MOST appropriate solution?
- A
Use a Site-to-Site VPN with AWS Transit Gateway to encrypt data in transit.
- B
Use AWS Direct Connect with MACsec (Media Access Control Security) to encrypt the data in transit.
- C
Use AWS Direct Connect with VPN overlay to encrypt the data in transit.
- D
Use an Elastic Load Balancer with HTTPS to encrypt traffic between on-premises and AWS.
Show answer and explanation
Correct answer: C
Explanation
The correct solution is AWS Direct Connect with VPN overlay. This setup leverages the low-latency private connection of Direct Connect while using a VPN for encryption, ensuring compliance with data protection requirements without sacrificing performance. Other options either fail to provide both encryption and low latency or are not suitable for connecting on-premises environments to AWS.
- A. Incorrect.
Site-to-Site VPN with AWS Transit Gateway provides encryption for data in transit. However, it may introduce additional latency compared to Direct Connect, making it less optimal for real-time processing.
- B. Incorrect.
AWS Direct Connect with MACsec is only available for specific Direct Connect locations and partners. While it provides encryption, it is not universally supported and does not necessarily minimize latency.
- C. Correct.
AWS Direct Connect with VPN overlay combines the low-latency benefits of Direct Connect with the encryption of VPN, meeting both the encryption and performance requirements in this scenario.
- D. Incorrect.
An Elastic Load Balancer with HTTPS can encrypt traffic, but it is primarily used for traffic within AWS or to external clients, not for connecting an on-premises environment to AWS.