300-420 Question 180
Select 3Your organization has a hybrid cloud deployment, with critical applications hosted both on-premises and in a cloud environment. To secure communication between your data center and the cloud, you need to design a site-to-site VPN. Which of the following considerations are essential to ensure optimal performance and security in this design?
- A
Ensure that the VPN uses IPsec with strong encryption and authentication algorithms
- B
Design the VPN to use a split-tunneling configuration to optimize resource usage
- C
Implement redundant VPN tunnels using different ISPs to enhance availability
- D
Use GRE over IPsec to support multicast traffic across the VPN
- E
Avoid the use of dynamic routing protocols over the VPN to prevent complex configurations
Show answer and explanation
Correct answers: A, C, D
Explanation
Designing a site-to-site VPN for hybrid cloud environments requires both performance and security considerations. Strong encryption and authentication via IPsec ensure secure communications, while redundancy enhances reliability. GRE over IPsec enables support for multicast traffic, which is often needed in hybrid cloud scenarios. Split-tunneling is unsuitable for this use case due to security risks, and dynamic routing protocols are preferred to simplify and scale route management.
- A. Correct.
Using IPsec with strong encryption and authentication ensures the security of data in transit, which is a critical requirement for site-to-site VPNs.
- B. Incorrect.
Split-tunneling is generally not recommended for site-to-site VPNs as it can expose traffic to potential threats and is more suitable for remote access VPNs.
- C. Correct.
Redundant VPN tunnels using different ISPs improve fault tolerance and ensure high availability, which is essential for a hybrid cloud environment.
- D. Correct.
GRE over IPsec is useful when multicast traffic or non-IP traffic needs to be transmitted across the VPN, which is often required in hybrid cloud designs.
- E. Incorrect.
Dynamic routing protocols like BGP or OSPF are commonly used over site-to-site VPNs to simplify route management and ensure scalability, so avoiding them is not a best practice.