SCS-C02 Question 227
Single answerYour company has deployed a corporate application in an Amazon VPC, and you need to securely connect the on-premises network to the VPC. The connection must provide encryption for data in transit and avoid the expense of a dedicated physical link. Which solution would be the MOST appropriate?
- A
Use an AWS Direct Connect connection with a private VIF.
- B
Establish an AWS Site-to-Site VPN connection between the on-premises network and the VPC.
- C
Use AWS Transit Gateway with an inter-region peering connection.
- D
Establish a peering connection between the on-premises network and the VPC.
Show answer and explanation
Correct answer: B
Explanation
AWS Site-to-Site VPN is a cost-effective and secure method to connect an on-premises network to an Amazon VPC. It provides encryption for data in transit over the internet, making it suitable for scenarios where a dedicated physical connection like AWS Direct Connect is not required or feasible. Other options, like Direct Connect or Transit Gateway, do not meet the criteria of encryption in transit or are not applicable for on-premises connections.
- A. Incorrect.
AWS Direct Connect with a private VIF offers a dedicated physical connection, but this does not encrypt data in transit by default, and it is more expensive than a VPN.
- B. Correct.
AWS Site-to-Site VPN provides an encrypted connection over the internet, meeting the requirement to secure data in transit without requiring a physical dedicated link.
- C. Incorrect.
AWS Transit Gateway with inter-region peering is used to connect multiple VPCs or regions, not for connecting an on-premises network to a VPC.
- D. Incorrect.
Peering connections are used to connect VPCs directly and cannot be used to connect an on-premises network to a VPC.