AWS Certified Advanced Networking – Specialty (ANS-C01)Network Security, Compliance, and GovernanceEasy
A financial services company needs to establish secure and private connectivity between its on-premises data centers and multiple VPCs in AWS. The solution must support high bandwidth and low latency for critical financial transactions and ensure that all traffic is encrypted in transit. Which combination of AWS services would best meet these requirements?
- AAWS VPN CloudHub over the public internet
- BAWS Direct Connect with a Direct Connect Gateway and AWS Site-to-Site VPN
- CAWS Site-to-Site VPN with public internet connectivity
- DAWS Transit Gateway with VPC peering connections
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Direct Connect with a Direct Connect Gateway and AWS Site-to-Site VPN
AWS Direct Connect provides a dedicated, private network connection to AWS, ensuring high bandwidth and low latency. Combining this with AWS Site-to-Site VPN over the Direct Connect connection encrypts traffic in transit, satisfying the security requirement. A Direct Connect Gateway allows access to multiple VPCs.
Why the other options are wrong
- A. VPN CloudHub is used for connecting multiple on-premises networks to a single AWS VPC via multiple VPN connections, but it still relies on the public internet for the underlying connectivity, lacking the performance benefits of Direct Connect.
- C. Site-to-Site VPN over the public internet does not provide the high bandwidth and low latency of a private connection.
- D. VPC peering connections are used for inter-VPC communication within AWS, not for connecting on-premises data centers to AWS, and do not inherently provide encryption over a private link.
Direct Connect with VPN
Combines a dedicated private connection (Direct Connect) with a VPN for encrypted, high-performance connectivity between on-premises networks and AWS VPCs.
- Direct Connect provides private, low-latency, high-bandwidth connectivity.
- VPN adds an encryption layer over the Direct Connect connection.
- Direct Connect Gateway enables connectivity to multiple VPCs and AWS Regions.
Memory trick: Directly Connect Securely, Virtually Private, Globally Linked.