SCS-C02 Question 229
Select 2Your organization wants to establish a secure and reliable connection between its on-premises data center and AWS to transfer sensitive financial data. The primary requirements are low latency, high bandwidth, and a dedicated connection. Additionally, the solution should ensure that sensitive data is encrypted in transit. Which solution would best meet these requirements?
- A
Use AWS Direct Connect with MACsec for encryption
- B
Use AWS Direct Connect and configure a VPN over it for encryption
- C
Use AWS Site-to-Site VPN only
- D
Use AWS Direct Connect Gateway with default public internet routing
- E
Use AWS Direct Connect with a private virtual interface (VIF) and implement client-side encryption
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of low latency, high bandwidth, and a secure connection for transferring sensitive data, AWS Direct Connect is the optimal choice as it provides a dedicated line. To ensure encryption, you can either use AWS Direct Connect with MACsec (if supported) or combine AWS Direct Connect with a VPN. Both approaches meet the organization's requirements for security and performance.
- A. Correct.
This option is correct because AWS Direct Connect now supports MACsec for Layer 2 encryption, which ensures high-speed, secure data transfer with low latency.
- B. Correct.
This option is correct because combining AWS Direct Connect with a VPN provides both dedicated connectivity and encryption using IPsec.
- C. Incorrect.
This option is incorrect because AWS Site-to-Site VPN alone does not meet the low-latency and high-bandwidth requirements as it relies on the public internet.
- D. Incorrect.
This option is incorrect because using a Direct Connect Gateway with public internet routing does not provide encryption or a fully private connection.
- E. Incorrect.
This option is incorrect because while AWS Direct Connect with a private VIF provides a dedicated connection, it does not inherently encrypt data in transit unless additional client-side encryption is implemented, which is outside the scope of the question.