A company is migrating its hybrid network to AWS. They have two 10 Gbps AWS Direct Connect connections in a Link Aggregation Group (LAG). They need to ensure that traffic between their on-premises data center and their Amazon VPCs is encrypted in transit. The solution must support at least 5 Gbps of encrypted throughput. Which combination of steps should the Solutions Architect take? (Select TWO)

Answer options:

A.

Configure MACsec on the Direct Connect connections.

B.

Deploy AWS Site-to-Site VPN over the Direct Connect connections.

C.

Use AWS Direct Connect dedicated connections.

D.

Use AWS Direct Connect hosted connections.

E.

Deploy a third-party VPN appliance on an EC2 instance.

F.

Enable AWS Shield Advanced on the Direct Connect connection.

How to approach this question

Determine the encryption method that supports high throughput over Direct Connect.

Configure MACsec on the Direct Connect connections., Use AWS Direct Connect dedicated connections.

MACsec (IEEE 802.1AE) provides Layer 2 encryption at line rate for Direct Connect. It requires dedicated connections.

Choosing IPsec VPN, forgetting the 1.25 Gbps per tunnel limit.

75 questions · hints · full answers · grading