AWS Certified Advanced Networking – Specialty (ANS-C01) — Question 159
A financial company that is located in the us-east-1 Region needs to establish secure connectivity to AWS. The company has two on-premises data centers, each located within the same Region. The company's network team needs to establish hybrid connectivity to its AWS environment with reliable and consistent connectivity.
The connection must provide access to the company's private resources inside its AWS environment. The resources are located in the us-east-1 and us-west-2 Regions. The connection must allow resources from the corporate networks to send large amounts of data to Amazon S3 over the same connection. To meet compliance requirements, the connection must be highly available and must provide encryption for all packets that are sent between the on-premises location and any services on AWS.
Which combination of steps should the network team take to meet these requirements? (Choose two.)
Answer options
- A. Set up a private VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the private VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
- B. Set up an AWS Direct Connect connection to each of the company's data centers.
- C. Set up an AWS Direct Connect connection from one of the company's data centers to us-east-1 and us-west-2.
- D. Set up a public VIF to send data to Amazon S3. Use an AWS Site-to-Site VPN connection over the public VIF to encrypt data in transit to the VPCs in us-east-1 and us-west-2.
- E. Set up a transit VIF for an AWS Direct Connect gateway to send data to Amazon S3. Create a transit gateway. Associate the transit gateway with the Direct Connect gateway to provide secure communications from the company’s data centers to the VPCs in us-east-1 and us-west-2.
Correct answer: B, D
Explanation
The correct answer involves establishing an AWS Direct Connect connection to each of the company's data centers (B), which provides reliable and consistent connectivity. A public VIF is used to send data to Amazon S3 (D), which meets the requirement for large data transfers and ensures encryption. The other options either do not provide the necessary connectivity or do not meet compliance requirements.