SAP-C02 Question 8
Single answerA company has on-premises data centers across multiple locations and wants to establish secure, low-latency connectivity to its AWS environment. They have strict compliance requirements that mandate all traffic between their data centers and AWS be encrypted and private. Additionally, the company requires consistent performance for high-bandwidth workloads, and they plan to scale their cloud environment significantly over time. Which is the most appropriate network connectivity strategy?
- A
Use AWS Direct Connect with a private virtual interface (VIF) and enable MACsec encryption for compliance.
- B
Establish an AWS Site-to-Site VPN connection between the on-premises data centers and the AWS environment.
- C
Leverage the AWS Global Accelerator for secure, low-latency connections to AWS.
- D
Use public internet connectivity with SSL/TLS encryption for all data transfers to maintain compliance.
Show answer and explanation
Correct answer: A
Explanation
The best solution for this scenario is AWS Direct Connect with a private virtual interface (VIF) and MACsec encryption. AWS Direct Connect provides a dedicated, private connection between the on-premises data centers and AWS, ensuring low latency, high bandwidth, and consistent performance. Enabling MACsec encryption ensures that the connection complies with the strict requirement for encrypted and private traffic. This makes it the most suitable option for the company's needs.
- A. Correct.
Using AWS Direct Connect with a private virtual interface (VIF) provides a dedicated, high-bandwidth connection with consistent performance. Additionally, enabling MACsec encryption ensures compliance with the requirement for encrypted and private traffic.
- B. Incorrect.
While an AWS Site-to-Site VPN provides secure and encrypted traffic, it relies on the internet, which can lead to higher latency and inconsistent performance. This option is not ideal for high-bandwidth workloads or scalability.
- C. Incorrect.
AWS Global Accelerator optimizes traffic routing for applications and provides low-latency connections, but it does not provide dedicated private connectivity or encryption for compliance requirements.
- D. Incorrect.
Using public internet connectivity with SSL/TLS encryption can encrypt data in transit but does not meet the requirement for private connectivity. Additionally, the public internet does not provide consistent performance for high-bandwidth workloads.