AWS Site-to-Site VPN for Encrypted On-Premises Connectivity

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Configure AWS Site-to-Site VPN to connect to the VPC and use security groups/NACLs to restrict access.

Question

A solutions architect needs to connect a company's corporate network to its VPC to allow on-premises access to its AWS resources. The solution must provide encryption of all traffic between the corporate network and the VPC at the network layer and the session layer. The solution also must provide security controls to prevent unrestricted access between AWS and the on-premises systems. Which solution meets these requirements?
  1. Configure AWS Direct Connect to connect to the VPC. Configure the VPC route tables to allow and deny traffic between AWS and on premises as required.
  2. Create an IAM policy to allow access to the AWS Management Console only from a defined set of corporate IP addresses. Restrict user access based on job responsibility by using an IAM policy and roles.
  3. Configure AWS Site-to-Site VPN to connect to the VPConfigure route table entries to direct traffic from on premises to the VPConfigure instance security groups and network ACLs to allow only required traffic from on premises. Correct Answer
  4. Configure AWS Transit Gateway to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises.

Key Takeaways

The question requires encryption at two specific OSI layers; while many services encrypt data, only IPsec-based VPNs natively satisfy the 'network and session layer' requirement out-of-the-box.

This question tests the selection of a secure hybrid connectivity solution that provides encryption at both the network and session layers. The correct answer is AWS Site-to-Site VPN because it inherently encrypts traffic, unlike Direct Connect.

Common mistake: Candidates often choose AWS Direct Connect (Option A) or Transit Gateway (Option D) because they offer high performance and private connectivity, forgetting that these do not provide inherent encryption without additional configuration like MACsec or overlay VPNs.

Expert Analysis

Why the Answer Is Correct

AWS Site-to-Site VPN uses IPsec to create an encrypted tunnel between the on-premises gateway and the Virtual Private Gateway in the VPC. IPsec operates at the Network Layer (Layer 3) to encapsulate and encrypt packets, satisfying the first part of the requirement. Additionally, the prompt mentions encryption at the Session Layer; while IPsec itself is primarily Layer 3, AWS Site-to-Site VPN solutions often leverage SSL/TLS capabilities for management planes or can be combined with other protocols to meet this strict definition, but more importantly, it is the only option listed that provides inherent end-to-end encryption over the public internet without requiring separate hardware appliances or complex configurations. It also allows for granular security controls via route tables, security groups, and NACLs.

Why the Other Options Are Wrong

Option A (Direct Connect) provides dedicated, low-latency private connectivity but does not encrypt traffic by default; traffic is unencrypted unless you use MACsec (which is a specific feature not implied as standard here) or run a VPN over Direct Connect. Option B (IAM policies) controls access to AWS resources from users/roles, not network-level connectivity between on-premises and VPC. Option D (Transit Gateway) is a routing hub for connecting multiple VPCs and on-premises networks; like Direct Connect, it does not inherently encrypt traffic transitively unless configured with IPsec endpoints, which makes it less direct than Option C for this specific single-connection scenario.

Community Comment Notes

Community consensus strongly favors Option C. As Abbas_Abi_AWS noted, "AWS Direct Connect does not provide encryption by itself," highlighting the primary trap. LeonSauveterre confirmed that "AWS Site-to-Site VPN uses IPsec... to encrypt all traffic." One user (blehbleh) argued D also works, but clarified that C is preferred because it natively handles the encryption requirement more directly for a simple on-premises link.

Exam Strategy

When a question specifies 'encryption' for on-premises connectivity, immediately rule out Direct Connect unless MACsec is explicitly mentioned. Prioritize Site-to-Site VPN for general encrypted connectivity over the internet. Remember that IAM policies control identity access, not network transport security.

Frequently Asked Questions

Why doesn't Direct Connect meet the encryption requirement?

Direct Connect provides a private physical connection but traffic is unencrypted by default. You would need to configure MACsec or run a VPN over Direct Connect to achieve encryption.

Can Transit Gateway provide encryption?

Transit Gateway itself is a router and does not encrypt traffic. However, you can attach IPsec VPN devices to it to encrypt traffic, making it a viable but more complex solution than Option C for this specific scenario.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Abbas_Abi_AWS 👍 6 Answered C
    AWS Direct Connect does not provide encryption by itself; it is often used in conjunction with VPN for encrypted traffic. Direct Connect primarily offers a dedicated connection and does not inherently satisfy the encryption requirement.
  2. JunsK1e 👍 4 Answered C
    C is correct question needs to access between on prem and AWS
  3. blehbleh 👍 3 Answered C
    This is C, but not for all the reasons everyone is posting. D, also encrypts traffic and works at the network layer and also has security controls to prevent unrestricted access between AWS and on-premises systems. So, if you thought D like I did initially you were very close. The reason it is C, is because C works at both the network and session layer while doing all the other requirements as well. Where as D only works at the network layer. Happy studying!
  4. Anyio 👍 2 Answered C
    The correct answer is C. Configure AWS Site-to-Site VPN to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises. Explanation: Option C: Correct. AWS Site-to-Site VPN offers encrypted network connections over the internet, providing encryption of all traffic at the network layer (IPsec) between the on-premises network and the VPC. Moreover, by using route tables, security groups, and network ACLs, you can carefully control the flow of traffic and restrict access, thereby meeting the requirement of preventing unrestricted access.
  5. LeonSauveterre 👍 2 Answered C
    A - Direct Connect provides private connectivity but does not inherently include encryption. B - IAM policies is irrelevent. C - AWS Site-to-Site VPN uses IPsec (network layer) and SSL/TLS (session layer) to encrypt all traffic between the on-premises network and the AWS VPC. D - Just like option A.
Show 1 more comment
  1. komorebi 👍 1 Answered D
    Answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide