N10-009 Question 38
Single answerCloud connectivity options: VPN, Direct ConnectA company is migrating a latency-sensitive financial application to a public cloud provider. The application exchanges large volumes of data continuously with systems that will remain in the on-premises data center. Management requires more predictable bandwidth and lower latency than the public internet can typically provide, and they want to avoid relying solely on an IPsec tunnel over the internet for day-to-day production traffic. Which connectivity option BEST meets these requirements?
- A
Establish a site-to-site VPN over the internet between the data center and the cloud VPC/VNet
- B
Use a dedicated private connection service such as Direct Connect or ExpressRoute between the data center and the cloud provider
- C
Publish the application through a reverse proxy and allow users to connect over HTTPS
- D
Use a remote-access VPN client on each application server to connect to the cloud environment
Show answer and explanation
Correct answer: B
Explanation
The key requirement is predictable, private connectivity with lower and more stable latency for a high-volume hybrid workload. In Network+ terms, a site-to-site VPN is commonly used to connect on-premises networks to cloud environments, but it usually depends on the public internet and is therefore subject to internet congestion, variable latency, and inconsistent throughput. A dedicated connection service such as AWS Direct Connect or Azure ExpressRoute is specifically intended for organizations that need private connectivity and more consistent network performance between their sites and the cloud. In practice, many organizations use both: a dedicated connection for primary production traffic and a VPN as a backup path. This aligns with cloud-provider documentation and common enterprise network design best practices, which describe dedicated private connectivity as the preferred option for predictable performance and hybrid workloads with strict latency or throughput requirements.
- A. Incorrect.
A site-to-site VPN is a valid cloud connectivity option and is often used for quick deployment, lower cost, or backup connectivity. However, it typically traverses the public internet, so latency and throughput are less predictable than with a dedicated private circuit. Because the scenario specifically requires more predictable bandwidth and lower latency than the internet can usually provide, this is not the best answer.
- B. Correct.
A dedicated private connection such as AWS Direct Connect, Azure ExpressRoute, or similar services from other providers is designed for private connectivity between an on-premises environment and the cloud provider. This approach commonly provides more consistent performance, lower and more predictable latency, and avoids sending production traffic over the public internet. For a latency-sensitive application with continuous high-volume data exchange, this is the best fit.
- C. Incorrect.
A reverse proxy over HTTPS may be appropriate for publishing web applications securely to users, but it does not solve the core requirement of private, predictable, low-latency connectivity between an on-premises data center and cloud resources. It addresses application access, not hybrid network transport.
- D. Incorrect.
Remote-access VPN clients are intended for individual user or endpoint connections, not for persistent data-center-to-cloud production connectivity. Deploying VPN clients on each server would add unnecessary complexity and would not provide the predictable network characteristics requested in the scenario.