N10-009 Question 27
Single answer1.3 Summarize cloud concepts and connectivity options.A company is moving a payroll application to a public cloud provider but must keep its on-premises HR database in its local data center for regulatory reasons. The payroll application needs private, predictable connectivity to the HR database without sending traffic over the public internet. During testing, the IT team found that an IPsec site-to-site VPN works, but latency varies during peak business hours and occasionally affects payroll batch jobs. Which connectivity option is the BEST choice to meet the company's requirements?
- A
Use a dedicated private cloud interconnect such as AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect
- B
Continue using the existing site-to-site IPsec VPN because encryption is more important than connection consistency
- C
Publish the HR database through a public load balancer and restrict access with ACLs
- D
Use a SaaS email security gateway to proxy payroll application traffic to the HR database
Show answer and explanation
Correct answer: A
Explanation
The best answer is a dedicated private cloud interconnect. In hybrid cloud designs, organizations often need secure and predictable connectivity between on-premises resources and workloads hosted in a public cloud. While site-to-site VPNs are a valid connectivity option and are often quicker and less expensive to deploy, they commonly rely on internet paths and can experience fluctuating latency and throughput. Dedicated connectivity services such as AWS Direct Connect, Microsoft Azure ExpressRoute, and Google Cloud Interconnect are specifically intended to address those issues by providing private, more consistent connectivity into the provider network. This aligns with common cloud networking best practices for regulated workloads, latency-sensitive applications, and environments that require private routing. Vendor documentation for these services consistently highlights reduced variability, private connectivity, and hybrid-cloud integration as primary use cases.
- A. Correct.
Correct. A dedicated private interconnect provides private connectivity between the organization's on-premises environment and the cloud provider over a more predictable path than the public internet. Services such as AWS Direct Connect, Azure ExpressRoute, and Google Cloud Interconnect are designed for hybrid cloud scenarios that require consistent performance, lower latency variation, and private routing. This is the best fit when the business specifically requires traffic to avoid the public internet and when VPN performance is not consistent enough.
- B. Incorrect.
Incorrect. A site-to-site IPsec VPN does provide encrypted connectivity and is commonly used for hybrid cloud connections, but it typically traverses the public internet unless paired with another private transport. Because the scenario specifically calls out variable latency and a requirement to avoid sending traffic over the public internet, continuing with only the VPN does not best meet the stated requirements. A VPN may still be used as a backup path, but not as the primary best choice here.
- C. Incorrect.
Incorrect. Publishing the HR database through a public load balancer would expose access via the public internet, which directly conflicts with the requirement for private connectivity. Even if ACLs or other security controls were added, this does not provide the private, predictable hybrid connectivity the company needs. It also increases attack surface for a sensitive system containing HR data.
- D. Incorrect.
Incorrect. A SaaS email security gateway is unrelated to database or hybrid application connectivity. These services are used for filtering and protecting email traffic, not for providing private network paths between a cloud-hosted application and an on-premises database. This option reflects a misunderstanding of SaaS functions versus network connectivity services.