NIST Compliance and Data Encryption Connectivity Model
A company with multiple branch offices has strict regulatory compliance requirements and must adhere to NIST standards for data encryption. Which connectivity model meets these requirements?
Community Insight
The trap lies in assuming public internet tunnels (IPsec/GRE) are sufficient for NIST; however, NIST often mandates stronger controls like dedicated lines or specific encryption scopes that pure internet-based models may not fully guarantee without additional complexity.
This question tests the selection of a connectivity model that satisfies strict regulatory compliance (NIST) for data encryption. The correct answer is C, as it provides dedicated infrastructure with mandatory end-to-end encryption.
Many learners choose D (MPLS with IPsec), believing MPLS offers better security. While MPLS isolates traffic, adding IPsec creates overhead and MPLS alone doesn't encrypt data by default, making C the more robust 'end-to-end' compliant choice.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is the correct answer because it combines a dedicated leased line (ensuring reliability and isolation) with end-to-end encryption. NIST standards (such as SP 800-171 or FIPS 140-2/3) often require strong cryptographic protection for data at rest and in transit. A dedicated line minimizes exposure to public internet threats, and end-to-end encryption ensures data is protected across the entire path, meeting the highest tier of compliance.Why the Other Options Are Wrong
Option A (GRE over public internet) is incorrect because GRE does not provide encryption; it only encapsulates packets. Option B (Site-to-site VPN over public internet) uses IPsec, which encrypts data, but the underlying public internet connection introduces latency, jitter, and potential availability issues that may not meet strict SLAs or compliance requirements for high-assurance environments compared to dedicated lines. Option D (MPLS with IPsec) is a common distractor. While MPLS provides private routing, it does not inherently encrypt data. Adding IPsec on top of MPLS is possible, but Option C's explicit 'end-to-end encryption' on a dedicated line is the most definitive description of a compliant, secure, and reliable model for strict NIST adherence.Community Comment Notes
One user suggested Option D, arguing it provides more security. However, as noted in expert analysis, MPLS alone is not encrypted, and the combination in D is less standard for 'strict NIST' scenarios than the explicit end-to-end encryption described in C. Another perspective might argue for B due to cost, but the question emphasizes 'strict regulatory compliance,' favoring the robustness of C.Exam Strategy
When questions mention 'strict regulatory compliance' like NIST or HIPAA, look for options that combine dedicated/reliable infrastructure (like leased lines) with explicit encryption mechanisms. Avoid options that rely solely on public internet unless encryption is explicitly highlighted as superior.
Frequently Asked Questions
Why isn't MPLS with IPsec (D) the best answer?
MPLS provides private routing but not inherent encryption. While IPsec can be added, Option C's explicit 'end-to-end encryption' on a dedicated line is a clearer fit for strict NIST mandates requiring guaranteed data protection.
Does GRE provide encryption?
No, GRE (Generic Routing Encapsulation) does not provide encryption. It only encapsulates packets. You must use IPsec or similar protocols to add encryption if using GRE.