Secure On-Premises to AWS Data Transfer without Internet

DEA-C01 By islever Editorial Last updated Oct 12, 2026

Orchestrate data pipelines. Apply authorization mechanisms.

Short answer

B Create an AWS Direct Connect connection to the on-premises data center and store service account credentials in AWS Secrets Manager.

Question

A data engineer needs to onboard a new data producer into AWS. The data producer needs to migrate data products to AWS. The data producer maintains many data pipelines that support a business application. Each pipeline must have service accounts and their corresponding credentials. The data engineer must establish a secure connection from the data producer's on-premises data center to AWS. The data engineer must not use the public internet to transfer data from an on-premises data center to AWS. Which solution will meet these requirements?

Instruct the new data producer to create Amazon Machine Images (AMIs) on Amazon Elastic Container Service (Amazon ECS) to store the code base of the application. Create security groups in a public subnet that allow connections only to the on-premises data center.
Create an AWS Direct Connect connection to the on-premises data center. Store the service account credentials in AWS Secrets manager. Correct Answer
Create a security group in a public subnet. Configure the security group to allow only connections from the CIDR blocks that correspond to the data producer. Create Amazon S3 buckets than contain presigned URLS that have one-day expiration dates.
Create an AWS Direct Connect connection to the on-premises data center. Store the application keys in AWS Secrets Manager. Create Amazon S3 buckets that contain presigned URLS that have one-day expiration dates.

Key Takeaways

The core concept is establishing a non-internet path (Direct Connect) while securely handling service account credentials (Secrets Manager), avoiding public subnets or insecure storage methods.

This question tests the configuration of a private, secure network connection between on-premises infrastructure and AWS for data migration. The correct solution combines AWS Direct Connect for connectivity with AWS Secrets Manager for credential management.

Common mistake: Candidates often choose options involving Security Groups in public subnets because they focus on access control but ignore the fundamental requirement of not using the public internet for data transfer.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because it directly addresses both critical constraints: the need for a secure, private connection and the secure management of credentials. AWS Direct Connect provides a dedicated, private network link between the on-premises data center and AWS, ensuring that data does not traverse the public internet. Storing service account credentials in AWS Secrets Manager ensures that sensitive authentication information is encrypted at rest, managed securely, and can be rotated easily, which is essential for automated pipelines.

Why the Other Options Are Wrong

Options A and C suggest using public subnets and security groups. Even if restricted by CIDR blocks, traffic routed through public subnets typically implies exposure to the public internet or reliance on NAT gateways/Internet Gateways, violating the "not use the public internet" requirement. Option D adds presigned URLs to S3 buckets; while presigned URLs are useful for temporary access, they do not address the core requirement of establishing a persistent, secure connection for migrating many data pipelines, and the option redundantly mixes networking concepts with object storage access controls unnecessarily compared to the direct simplicity of B. Furthermore, Option D's inclusion of presigned URLs doesn't inherently solve the "secure connection" aspect for pipeline orchestration as well as Direct Connect alone paired with secret management does.

Community Comment Notes

Community consensus strongly favors Option B. Users note that other options contain "partial nonsense" or fail to meet the strict non-internet constraint. As one user noted, "For secure connections without cost constraints, always think Direct Connect," highlighting the priority of the network architecture in this scenario.

Exam Strategy

When a question specifies 'not use the public internet' for data transfer, immediately look for AWS Direct Connect or AWS Site-to-Site VPN as the networking solution. Combine this with secure credential management like AWS Secrets Manager or Parameter Store, rather than hardcoding keys or using insecure storage.

Frequently Asked Questions

Why is a public subnet incorrect for this requirement?

Public subnets imply connectivity via an Internet Gateway, which routes traffic through the public internet. The question explicitly forbids using the public internet.

Is AWS Secrets Manager required for service accounts?

While not strictly the only way, it is the best practice for managing dynamic credentials. Hardcoded keys are insecure, and Secrets Manager provides encryption and rotation capabilities essential for production pipelines.

More DEA-C01 FAQ →

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

emupsx1 👍 2 Answered B

Direct Connect + Secret Manager
MerryLew 👍 1 Answered B

For secure connections without cost constraints, always think Direct Connect.
Ell89 👍 1 Answered B

B. all others contain partial nonsense

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide