N10-009 Question 26
Single answer1.3 Summarize cloud concepts and connectivity options.A company is migrating a latency-sensitive inventory application from its on-premises data center to a public cloud provider. The application will continue to use an on-premises database during the first phase of the migration, and users have reported poor performance when testing over the existing site-to-site VPN across the internet. The network administrator needs to recommend a connectivity option that provides more predictable performance, higher reliability, and does not traverse the public internet for the primary path. Which solution is the BEST choice?
- A
Replace the site-to-site VPN with a dedicated private cloud connection such as AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect
- B
Deploy a split-tunnel remote access VPN for all users so inventory application traffic bypasses the data center
- C
Move the on-premises database to a SaaS provider so WAN latency is eliminated
- D
Configure port forwarding on the edge firewall to allow direct access from the cloud application to the on-premises database
Show answer and explanation
Correct answer: A
Explanation
The best answer is a dedicated private cloud connection. In hybrid cloud scenarios, organizations often need to connect on-premises systems to cloud resources with lower latency variation, stronger reliability, and more predictable bandwidth than an internet-based IPsec VPN can provide. Dedicated connectivity services such as AWS Direct Connect, Microsoft Azure ExpressRoute, and Google Cloud Interconnect are designed for this purpose. While VPNs remain common and cost-effective, they typically depend on public internet paths and are more susceptible to congestion, jitter, and variable latency. Best-practice cloud architecture guidance from major providers consistently positions private connectivity options as appropriate for production hybrid workloads with strict performance requirements. This question tests both cloud concepts and connectivity options by requiring the candidate to distinguish between internet VPNs, private cloud interconnects, remote access VPN features, and insecure public exposure methods.
- A. Correct.
Correct. A dedicated private connection between the enterprise network and the cloud provider is specifically designed for more consistent latency, predictable throughput, and improved reliability compared with VPN traffic sent over the public internet. Services such as AWS Direct Connect, Azure ExpressRoute, and Google Cloud Interconnect are common examples of cloud connectivity options covered in Network+. They are often used for hybrid cloud deployments where on-premises and cloud resources must communicate with better performance guarantees than an internet-based VPN can usually provide.
- B. Incorrect.
Incorrect. Split tunneling applies to remote access VPN clients, not to solving poor hybrid cloud performance between an on-premises site and a cloud provider. It can reduce load on a VPN concentrator by allowing some client traffic to go directly to the internet, but it does not create a dedicated private path between the company and the cloud environment. This option addresses a different use case.
- C. Incorrect.
Incorrect. SaaS is a software delivery model, not a direct network connectivity method for extending a private enterprise network into a cloud environment. Also, simply moving the database to a SaaS provider is not a realistic or technically appropriate response to the stated requirement, especially since databases are typically migrated to IaaS, PaaS, or managed database services rather than arbitrarily 'to SaaS.' It also does not directly answer the need for a private, predictable connection during a phased hybrid deployment.
- D. Incorrect.
Incorrect. Port forwarding exposes internal services through a public-facing firewall and would cause the traffic to traverse the public internet, which directly conflicts with the requirement. It also introduces significant security risk and is not considered a best practice for connecting cloud workloads to on-premises databases in a hybrid enterprise architecture.