A financial company that is located in the us-east-1 Region needs to establish secure connectivity to AWS. The company has two on-premises data centers, each located within the same Region. The company's network team needs to establish hybrid connectivity to its AWS environment with reliable and consistent connectivity. The connection must provide access to the company's private resources inside its AWS environment. The resources are located in the us-east-1 and us-west-2 Regions. The connection must allow resources from the corporate networks to send large amounts of data to Amazon S3 over the same connection. To meet compliance requirements, the connection must be highly available and must provide encryption for all packets that are sent between the on-premises location and any services on AWS. Which combination of steps should the network team take to meet these requirements? (Choose two.)
Select 2 answers.
Marked answer: B
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose BD1
Option E does not provide any encryption
Chose BE1
To use the public VIF you'd have to configure AWS Site-to-Site VPN over a Transit Gateway. The Q doesn't mention a TG so option D is out.
2
Option B & E is correct. Why the other options are incorrect: A and D: These options suggest using Site-to-Site VPN over Direct Connect, which is not necessary when using a Transit Gateway and Direct Connect gateway. The Transit Gateway provides the required encryption. C: This option only sets up a Direct Connect connection from one data center, which doesn't meet the high availability requirement.
