Exam AWS Certified Security - Specialty topic 1 question 86 discussion

C is the only correct answer . They want also remote workers, travellers and not only office users and this is why AWS private gateway is not a solution since it is site-to-site VPN with 2 tunnels. VPN cloud hub is the same as private VPN gateway but multiple site-to-site tunnels , so it is wrong.

C is correct I think: https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html check the last column

C is the best answer, yet it is very poorly written. It give hints to SSL VPN, but a better description to AWS Client VPN (managed service) would've been better. Still..C is the best answer.

C is correct You can also choose to use a third-party VPN solution. Use a third-party solution if you require full access and management of the AWS side of the VPN connection. see this link : https://repost.aws/knowledge-center/connect-vpc

D; Allow all IP addresses and then use Rate limit on the WAF

Network Engineer here Implemented thousands of VPNs so far B is incorrect because for Clint-to-Site VPNs you need an "EC2 Client VPN endpoint" and not a "VPN Private Gateway" (VPN Private gateway is for Site-to-site Ipsec VPN tunnels) That leaves us with Option C

B is correct because we can create a VPN GW with VPN Clients.

B is absurd

Option A is not a good choice because home IP addresses frequently change, and it would be a significant administrative burden to constantly update security group rules. Option B isn't practical, as creating a virtual gateway for each employee can become cumbersome and difficult to manage, especially for a large number of employees. Option D would be expensive and might not offer the same level of protection and control as a dedicated VPN solution. AWS WAF is more suited to protecting against web exploits rather than managing access control for a large number of users. So, using a VPN appliance from the AWS Marketplace for users to connect to and restricting workload access to traffic from that appliance is the most suitable option.

C is the only suitable remote access solution.

A. Definitely not suitable since there are employess are travelling and remote B. Creating a virtual gateway for each employee would be a lot of effort and not scalable D. AWS WAF is not suitable since it is for protecting web app The remaining is only C. Use a VPN appliance is the most suitable option

C - is the only offering a connection for authenticated users

C --> Is the correct Answer (as the question mentioned work remotely or travel)

virtual gateway for VPN connectivity for each employee? could someone please explain how's that even a solution in the entire security world, rest alone AWS? A VPN solution is usually between two sites/domains or remote access endpoint VPN for users. The one possibility here is to get a VPN appliance from workplace. The answer should be - C

C is correct, others are painful, we don't need to manage each IP address

Ans: C

Having actually worked through this in real world..........C