AWS Certified Solutions Architect – Professional (SAP-C02) — Question 467

A software development company has multiple engineers who are working remotely. The company is running Active Directory Domain Services (AD DS) on an Amazon EC2 instance. The company's security policy states that all internal, nonpublic services that are deployed in a VPC must be accessible through a VPN. Multi-factor authentication (MFA) must be used for access to a VPN.

What should a solutions architect do to meet these requirements?

Answer options

• A. Create an AWS Site-to-Site VPN connection. Configure integration between a VPN and AD DS. Use an Amazon WorkSpaces client with MFA support enabled to establish a VPN connection.
• B. Create an AWS Client VPN endpoint. Create an AD Connector directory for integration with AD DS. Enable MFA for AD Connector. Use AWS Client VPN to establish a VPN connection.
• C. Create multiple AWS Site-to-Site VPN connections by using AWS VPN CloudHub. Configure integration between AWS VPN CloudHub and AD DS. Use AWS Copilot to establish a VPN connection.
• D. Create an Amazon WorkLink endpoint. Configure integration between Amazon WorkLink and AD DS. Enable MFA in Amazon WorkLink. Use AWS Client VPN to establish a VPN connection.

Correct answer: B

Explanation

AWS Client VPN is the appropriate service for enabling remote individual users to securely access VPC resources, and it integrates with AD DS via AD Connector to support multi-factor authentication (MFA). Site-to-Site VPN is intended for connecting entire remote networks rather than individual remote workers, making options A and C incorrect. Amazon WorkLink is designed for secure mobile web access rather than full VPC network access, making option D incorrect.