AWS Certified Advanced Networking – Specialty ANS-C00 – Question340 | AWS Certified Advanced Networking

You have an application that is processing confidential data. The data is currently stored in your data center. You are moving workloads to AWS, and you need to ensure confidentiality and integrity of the data in transit to your VPC. Your company has an existing AWS Direct Connect connection.
What combination of steps should you perform to set up the most cost-effective connection between your on-premises data center and AWS? (Choose three.)

A. Set up a VPC with a virtual private gateway.
B. Set up a VPC with an Internet gateway.
C. Configure a public virtual interface on your Direct Connect connection.
D. Configure a private virtual interface to the virtual private gateway.
E. Set up an IPsec tunnel between your customer gateway and a software VPN on Amazon EC2 in the VPC.
F. Set up an IPsec tunnel between your customer gateway appliance and the virtual private gateway.

Correct Answer: ACF

Explanation:

Explanation:
Setting up a VPN over your Direct Connect connection will secure the data in transit. The steps to do so are: adding a VGW to the VPC; setting up a public virtual interface; and creating the IPsec tunnel between your data center and the VGW via the public virtual interface. B would send traffic over the public Internet. D is not possible because a public virtual interface is needed to announce the VGW endpoint IPs. E would not take advantage of the already existing Direct Connect connection.