ANS-C01 Network Security, Compliance and Governance Practice Question

Correct answer & explanation

To restrict traffic from a specific on-premises subnet to a specific VPC subnet using AWS Direct Connect, you need two components. First, a private virtual interface (VIF) is required because it provides connectivity to VPCs (as opposed to public or transit VIFs). Second, route tables with specific routes must be configured on both the on-premises router and the VPC route tables to ensure that traffic is directed to the correct destination subnet. Option B (Route tables with specific routes) and Option D (Private virtual interface) are correct. Option A (VPN connection) is not needed because Direct Connect itself provides the private connectivity. Option C (Public virtual interface) is incorrect as it is used for accessing public AWS endpoints, not VPC subnets. Option E (Transit virtual interface) is used for connecting to multiple VPCs via a transit gateway, not for a single VPC subnet.