CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
A healthcare organization is adopting a hybrid cloud strategy for its patient data. Sensitive patient records will reside on-premises, while a public cloud platform will host a new patient portal application that needs to securely access a subset of this on-premises data. To ensure that only authorized cloud services can directly communicate with specific on-premises databases, and to establish a secure, private connection, which network component is essential?
- AVirtual Private Network (VPN) Gateway
- BCloud Firewall
- CDirect Connect / ExpressRoute
- DNetwork Access Control List (NACL)
Show answer & explanationAnswer & explanation
Correct answer: C. Direct Connect / ExpressRoute
Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated, private network connection between an on-premises data center and a cloud provider's network. This bypasses the public internet, offering higher bandwidth, lower latency, and enhanced security, making it ideal for securely connecting sensitive on-premises resources to cloud applications in a hybrid cloud setup for regulated data.
Why the other options are wrong
- A. VPN Gateway establishes an encrypted tunnel over the public internet, which is less performant and potentially less secure than a dedicated private connection for sensitive, high-volume healthcare data.
- B. Cloud Firewalls control traffic within the cloud environment or at its perimeter, but they do not establish the underlying private network connectivity to an on-premises data center.
- D. NACLs are stateless packet filtering rules that control traffic to and from subnets within a cloud network, but they do not establish the private connection between on-premises and cloud.
Direct Connect / ExpressRoute
Cloud services that provide a dedicated, private network connection from an on-premises data center or corporate network to a cloud provider's network, bypassing the public internet.
- Offers higher bandwidth and lower latency than VPNs.
- Enhances security by not traversing the public internet.
- Ideal for hybrid cloud, large data transfers, and critical applications.
Memory trick: Private data needs a direct, dedicated road to the cloud.