DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Transit Gateway

  Why it's wrong here

  AWS Transit Gateway acts as a regional network transit hub to interconnect VPCs and on-premises networks via attachments, but it is purely a routing and forwarding service. It does not natively encrypt traffic as it traverses the gateway; any encryption must be implemented separately using VPN attachments or other overlay tunnels. Therefore, selecting Transit Gateway alone fails the security policy's explicit requirement for encrypting data in transit.

• ✓

  AWS Direct Connect + VPN

  Why this is correct

  This pattern combines an AWS Direct Connect private or public virtual interface with an IPSec Site-to-Site VPN to create a dedicated, private, and encrypted link from your data center to AWS. Direct Connect ensures a consistent, low-latency connection that does not traverse the public internet, while the VPN overlay encrypts all IP traffic between your edge and the AWS virtual private gateway. The combination satisfies both the encryption mandate and the need for predictable, dedicated bandwidth, making it the best choice for this scenario.

• ✗

  Amazon VPC peering

  Why it's wrong here

  Amazon VPC peering is a mechanism to route traffic between two VPCs using private IPv4/IPv6 addresses, but it does not provide any encryption of that traffic in transit. The data is carried over AWS's private network infrastructure without an IPSec endpoint, so it fails to meet a mandate for encryption at the application or transport layer. Additionally, VPC peering is non-transitive and only for VPC-to-VPC, so it is not a general hybrid connectivity solution.

• ✗

  AWS Site-to-Site VPN over the internet

  Why it's wrong here

  An AWS Site-to-Site VPN does establish IPSec tunnels that encrypt traffic, but those tunnels traverse the public internet, meaning the underlying physical path is shared with other traffic and subject to congestion, jitter, and unpredictable latency. While the encryption objective is met, this option does not provide the dedicated connection that the policy may implicitly require for critical workloads. Using a VPN alone over the internet is also subject to provider and internet issues, making it less reliable than Direct Connect with a VPN overlay.

Go deeper

Related to this question