SCS-C02 Question 338
Single answerYour company has established a VPN connection between its on-premises data center and an Amazon VPC using an AWS Site-to-Site VPN. The VPN connection is configured with IPsec for secure communication. However, you notice intermittent connectivity issues and degraded performance. After reviewing the configuration, you identify that the on-premises VPN device is set to use a custom IPsec Security Association (SA) lifetime that differs from the AWS default. How should you resolve this issue?
- A
Update the IPsec Security Association (SA) lifetime on the on-premises VPN device to match AWS default settings.
- B
Disable IPsec on the AWS Site-to-Site VPN connection to avoid configuration mismatches.
- C
Recreate the AWS Site-to-Site VPN connection with custom settings to match the on-premises IPsec SA lifetime.
- D
Enable Perfect Forward Secrecy (PFS) on the VPN connection to improve performance.
Show answer and explanation
Correct answer: A
Explanation
AWS Site-to-Site VPNs use default IPsec settings, including a specific Security Association (SA) lifetime (8 hours by default). If the on-premises VPN device is configured with a different SA lifetime, it can cause intermittent connectivity and degraded performance due to SA mismatches. To resolve this, you should adjust the on-premises VPN device configuration to match AWS's default SA lifetime settings. This ensures consistent and reliable communication over the VPN.
- A. Correct.
Correct. AWS Site-to-Site VPNs use specific default values for IPsec, and mismatched Security Association (SA) lifetimes can cause connectivity issues. Synchronizing the on-premises device configuration with AWS default settings resolves the problem.
- B. Incorrect.
Incorrect. Disabling IPsec would compromise the security of the VPN connection, which defeats its purpose. This is not a recommended solution.
- C. Incorrect.
Incorrect. Recreating the VPN connection is unnecessary and does not address the root cause of the issue. Adjusting the on-premises configuration is more efficient.
- D. Incorrect.
Incorrect. While enabling Perfect Forward Secrecy (PFS) enhances security, it does not resolve issues related to mismatched IPsec SA lifetimes, which is the source of the problem.