VCP-VMC 2024 Question 17
Select 3You are designing a cloud network architecture for a hybrid cloud deployment using VMware Cloud on AWS. The solution must allow secure communication between the on-premises environment and VMware Cloud on AWS without requiring direct exposure to the public internet. Which architectural elements should you include to meet this requirement?
- A
A VPN connection between the on-premises environment and VMware Cloud on AWS
- B
A Direct Connect link with a private VIF to VMware Cloud on AWS
- C
A public IP address assigned to the on-premises network for direct communication
- D
NSX-T Distributed Firewall rules to control traffic flows between environments
- E
A stretched Layer 2 network between the on-premises environment and VMware Cloud on AWS
Show answer and explanation
Correct answers: A, B, D
Explanation
To enable secure communication between an on-premises environment and VMware Cloud on AWS without relying on the public internet, you can use a VPN or AWS Direct Connect. Both provide secure connectivity options, with Direct Connect offering additional benefits like low latency. NSX-T Distributed Firewall rules further secure the environment by managing and filtering traffic. A public IP address would expose the environment to the internet, violating the security requirements, and a stretched Layer 2 network is not a prerequisite for secure connectivity in this scenario.
- A. Correct.
A VPN connection is a secure and commonly used method to connect on-premises infrastructure to VMware Cloud on AWS without exposing the traffic to the internet.
- B. Correct.
AWS Direct Connect with a private VIF provides a dedicated, private connection to VMware Cloud on AWS, ensuring low latency and secure communication.
- C. Incorrect.
Assigning a public IP address for direct communication exposes the environment to the public internet, making it insecure and not aligned with the requirements.
- D. Correct.
NSX-T Distributed Firewall rules enhance security by controlling and filtering traffic between the on-premises and cloud environments, ensuring compliance with security policies.
- E. Incorrect.
A stretched Layer 2 network is not necessary to meet the requirement of secure communication between environments and is typically used for specific scenarios like workload mobility.