AWS Certified Security – Specialty — Question 64

A company runs an application on AWS that needs to be accessed only by employees. Most employees work from the office, but others work remotely or travel.
How can the Security Engineer protect this workload so that only employees can access it?

Answer options

• A. Add each employee's home IP address to the security group for the application so that only those users can access the workload.
• B. Create a virtual gateway for VPN connectivity for each employee, and restrict access to the workload from within the VPC.
• C. Use a VPN appliance from the AWS Marketplace for users to connect to, and restrict workload access to traffic from that appliance.
• D. Route all traffic to the workload through AWS WAF. Add each employee's home IP address into an AWS WAF rule, and block all other traffic.

Correct answer: C

Explanation

The correct answer is C because using a VPN appliance ensures that only authenticated employees can connect to the application, providing a secure access method. Option A is not effective as home IP addresses can change, and option B is impractical as it requires a virtual gateway for each employee. Option D relies on static IP addresses, which are not suitable for remote or traveling employees.