Certified Cloud Security Professional (CCSP)Cloud Platform and Infrastructure SecurityMedium
A large enterprise is migrating its critical applications to an IaaS cloud environment. The security team needs to establish secure communication channels between the on-premises data center and the cloud Virtual Private Cloud (VPC) to transfer sensitive data. They require a solution that offers both strong encryption and private connectivity, without traversing the public internet. Which of the following connectivity options is MOST appropriate?
- ASite-to-site Virtual Private Network (VPN) over the internet.
- BDirect Connect (or equivalent private connectivity service) with IPSec VPN.
- CPublic internet with Transport Layer Security (TLS) encryption.
- DCloud-native load balancer with SSL/TLS termination.
Show answer & explanationAnswer & explanation
Correct answer: B. Direct Connect (or equivalent private connectivity service) with IPSec VPN.
Direct Connect (or similar private connectivity services like Azure ExpressRoute or GCP Cloud Interconnect) establishes a dedicated, private network connection between the on-premises data center and the cloud provider, bypassing the public internet. Adding an IPSec VPN layer over this private connection provides an additional layer of encryption and integrity for sensitive data, fulfilling both requirements.
Why the other options are wrong
- A. A site-to-site VPN over the internet provides encryption but still traverses the public internet, which the requirement explicitly seeks to avoid for 'private connectivity'.
- C. Public internet with TLS uses the public internet and might not provide the 'private connectivity' level desired by a large enterprise for critical applications.
- D. A cloud-native load balancer handles traffic distribution and TLS termination for applications within the cloud, not for establishing private connectivity between on-premises and cloud environments.
Cloud Private Connectivity
Dedicated, high-bandwidth network connections between on-premises infrastructure and cloud environments, bypassing the public internet.
- Examples: AWS Direct Connect, Azure ExpressRoute, GCP Cloud Interconnect.
- Offers lower latency and higher bandwidth than VPN over internet.
- Enhances security by avoiding public internet exposure.
Memory trick: Directly connect and encrypt, for the ultimate private network trip.