Q37 — AWS SAA-C03 Ch.13

Question 37 of 100 | ← Chapter 13

Q937. A solutions architect needs to connect a company's corporate network to its VPC to allow on-premises access to its AWS resources. The solution must provide encryption of all traffic between the corporate network and the VPC at the network layer and the session layer. The solution also must provide security controls to prevent unrestricted access between AWS and the on-premises systems.Which solution meets these requirements?

Correct Answer: C. Configure AWS Site-to-Site VPN to connect to the VPC.Configure route table entries to direct traffic from on premises to the VPC.Configure instance security groups and network ACLs to allow only required traffic from on premises.

Explanation

The solution that meets the requirements is:C. Configure AWS Site-to-Site VPN to connect to the VPC. Configure route table entries to direct traffic from on-premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on-premises.Here's why:Network Layer Encryption: Site-to-Site VPNs use IPsec tunnels to establish a secure connection between the corporate network and the VPC, providing encryption at the network layer.Session Layer Encryption: You can further enhance security by configuring TLS/SSL encryption at the session layer for specific applications or services running within the VPC.Security Controls: Route table entries control traffic flow between on-premises and the VPC. Instance security groups and network ACLs provide granular access control, allowing only necessary traffic from on- premises systems.Restricted Access: By configuring security groups and network ACLs, you can prevent unrestricted access between AWS and on-premises systems, ensuring that only authorized traffic can pass through.Why other options are less suitable:A. Configure AWS Direct Connect to connect to the VPC. Configure the VPC route tables to allow and deny traffic between AWS and on premises as required. While Direct Connect provides a dedicated connection, it doesn't inherently provide encryption at the network layer. You would need to configure additional security measures, such as VPN or IPsec, to achieve encryption.B. Create an IAM policy to allow access to the AWS Management Console only from a defined set of corporate IP addresses. Restrict user access based on job responsibility by using an IAM policy and roles. This approach focuses on user access control but doesn't address network layer encryption or provide granular control over traffic flow between on-premises and the VPC.D. Configure AWS Transit Gateway to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises. Transit Gateway is primarily for connecting multiple VPCs, not for establishing secure connections between on-premises and a single VPC. While you can use Transit Gateway with VPNs, it adds complexity and might not be the most efficient solution for this scenario.In summary:Option C provides the most comprehensive solution for connecting a corporate network to a VPC, meeting the requirements for encryption at both the network and session layers, and providing granular security controls to restrict access between AWS and on-premises systems.