NIST Compliance and Data Encryption Connectivity Model
Short answer
C Point-to-point topology with dedicated leased lines and end-to-end encryption meets strict NIST compliance by ensuring both physical isolation and mandatory cryptographic protection.
Question
Which connectivity model meets these requirements?
Key Takeaways
The trap lies in assuming public internet tunnels (IPsec/GRE) are sufficient for NIST; however, NIST often mandates stronger controls like dedicated lines or specific encryption scopes that pure internet-based models may not fully guarantee without additional complexity.
This question tests the selection of a connectivity model that satisfies strict regulatory compliance (NIST) for data encryption. The correct answer is C, as it provides dedicated infrastructure with mandatory end-to-end encryption.
Common mistake: Many learners choose D (MPLS with IPsec), believing MPLS offers better security. While MPLS isolates traffic, adding IPsec creates overhead and MPLS alone doesn't encrypt data by default, making C the more robust 'end-to-end' compliant choice.
Expert Analysis
Why the Answer Is Correct
Option C is the correct answer because it combines a dedicated leased line (ensuring reliability and isolation) with end-to-end encryption. NIST standards (such as SP 800-171 or FIPS 140-2/3) often require strong cryptographic protection for data at rest and in transit. A dedicated line minimizes exposure to public internet threats, and end-to-end encryption ensures data is protected across the entire path, meeting the highest tier of compliance.
Why the Other Options Are Wrong
Option A (GRE over public internet) is incorrect because GRE does not provide encryption; it only encapsulates packets. Option B (Site-to-site VPN over public internet) uses IPsec, which encrypts data, but the underlying public internet connection introduces latency, jitter, and potential availability issues that may not meet strict SLAs or compliance requirements for high-assurance environments compared to dedicated lines. Option D (MPLS with IPsec) is a common distractor. While MPLS provides private routing, it does not inherently encrypt data. Adding IPsec on top of MPLS is possible, but Option C's explicit 'end-to-end encryption' on a dedicated line is the most definitive description of a compliant, secure, and reliable model for strict NIST adherence.
Community Comment Notes
One user suggested Option D, arguing it provides more security. However, as noted in expert analysis, MPLS alone is not encrypted, and the combination in D is less standard for 'strict NIST' scenarios than the explicit end-to-end encryption described in C. Another perspective might argue for B due to cost, but the question emphasizes 'strict regulatory compliance,' favoring the robustness of C.
Exam Strategy
When questions mention 'strict regulatory compliance' like NIST or HIPAA, look for options that combine dedicated/reliable infrastructure (like leased lines) with explicit encryption mechanisms. Avoid options that rely solely on public internet unless encryption is explicitly highlighted as superior.
Frequently Asked Questions
Why isn't MPLS with IPsec (D) the best answer?
Does GRE provide encryption?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Helloory 👍 1 Answered Dit provides more security, and its better choice for the given scenario
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.