SCS-C02 Question 336
Select 2Your company is setting up a Site-to-Site VPN connection between its on-premises data center and an Amazon VPC. During testing, you notice that the VPN connection is not establishing. Upon reviewing the configuration, you find that the on-premises network device is using an unsupported encryption algorithm. Which of the following options represent valid encryption configurations for an AWS Site-to-Site VPN to function properly?
- A
AES-256 for encryption and SHA-2 for hashing
- B
3DES for encryption and MD5 for hashing
- C
AES-128 for encryption and SHA-1 for hashing
- D
Blowfish for encryption and SHA-256 for hashing
- E
ChaCha20 for encryption and SHA-2 for hashing
Show answer and explanation
Correct answers: A, C
Explanation
AWS Site-to-Site VPN supports specific encryption algorithms for ensuring secure communication. Supported encryption algorithms include AES-128 and AES-256, while supported hashing algorithms include SHA-1 and SHA-2. Unsupported algorithms like MD5, Blowfish, and ChaCha20 may result in the VPN connection failing to establish. It is important to configure both ends of the VPN connection with compatible and supported algorithms.
- A. Correct.
Correct: AWS supports AES-256 for encryption and SHA-2 for hashing, which are widely used secure algorithms for Site-to-Site VPN connections.
- B. Incorrect.
Incorrect: AWS does not support MD5 for hashing due to its known vulnerabilities.
- C. Correct.
Correct: AWS supports AES-128 for encryption and SHA-1 for hashing. Though SHA-1 is less secure than SHA-2, it is still supported.
- D. Incorrect.
Incorrect: Blowfish is not a supported encryption algorithm for AWS Site-to-Site VPN connections.
- E. Incorrect.
Incorrect: ChaCha20 is not supported by AWS for Site-to-Site VPN connections.