Exam MCIA - Level 1 topic 1 question 57 discussion

Actual exam question from Mulesoft's MCIA - Level 1

Question #: 57
Topic #: 1

Mule applications need to be deployed to CloudHub so they can access on-premises database systems. These systems store sensitive and hence tightly protected data, so are not accessible over the internet.
What network architecture supports this requirement?

A. An Anypoint VPC connected to the on-premises network using an IPsec tunnel or AWS DirectConnect, plus matching firewall rules in the VPC and on- premises network
B. Relocation of the database systems to a DMZ in the on-premises network, with Mule applications deployed to the CloudHub Shared Worker Cloud connecting only to the DMZ
C. An Anypoint VPC with one Dedicated Load Balancer fronting each on-premises database system, plus matching IP whitelisting in the load balancer and firewall rules in the VPC and on-premises network
D. Static IP addresses for the Mule applications deployed to the CloudHub Shared Worker Cloud, plus matching firewall rules and IP whitelisting in the on- premises network

Show Suggested Answer

Suggested Answer: D 🗳️

by Outdoor25 at Dec. 27, 2021, 3:35 a.m.

Comments

Submit Cancel

edogwest

1 month, 2 weeks ago

Selected Answer: A

Why it fits CloudHub workers placed in an Anypoint VPC sit in a private, RFC-1918 CIDR space, isolated from the public Internet. An IPsec VPN tunnel (or a private DirectConnect link) joins that VPC to the on-premises data-center network, so packets travel over an encrypted or private circuit rather than the public Internet. The DB servers keep their private addresses and security rules; you simply open the required ports in the firewalls at each end of the tunnel. No inbound exposure of the databases is required; traffic is outbound from CloudHub workers to the data center through the tunnel. Why the other choices don’t satisfy the requirement

upvoted 1 times

...

lzrvs

12 months ago

Selected Answer: A

It should be A.

upvoted 1 times

...

madgeezer

1 year, 4 months ago

Selected Answer: A

A. An Anypoint VPC connected to the on-premises network using an IPsec tunnel or AWS DirectConnect, plus matching firewall rules in the VPC and on- premises network

upvoted 1 times

...

Outdoor25

1 year, 11 months ago

It should be A. It cannot be D or C because data is tightly protected means it has to be atleast encrypted. Cannot be B because relocation of database systems to a DMZ does not mean data is tightly protected. Its opposite. It should be A. IPsec tunnel will protect against any unauthoried access of data over public network.

upvoted 2 times

...