ANS-C01 Network Implementation Practice Question
A company wants to ensure that traffic between two VPCs in the same region is encrypted in transit. The VPCs are connected via a VPC peering connection. What should the network engineer do to meet this requirement?
⚠ Common exam trap
Candidates often assume VPC peering connections are inherently encrypted because they use the AWS private network, but AWS does not encrypt traffic over VPC peering; encryption must be implemented at the application or instance layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use TLS or IPsec at the application layer between instances.
VPC peering connections do not support native encryption of traffic. To meet the requirement for encryption in transit between two VPCs connected via a VPC peering connection, you must implement encryption at the application layer using TLS or IPsec between the instances. This ensures that traffic is encrypted end-to-end, independent of the underlying network path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an AWS Site-to-Site VPN between the VPCs and disable the VPC peering connection.
Why it's wrong here
While a VPN provides encryption, it adds complexity; VPC peering can still be used with application-layer encryption.
- ✓
Use TLS or IPsec at the application layer between instances.
Why this is correct
Application-layer encryption provides encryption over the peering connection.
- ✗
Replace the VPC peering connection with a Transit Gateway and enable VPN encryption.
Why it's wrong here
Replacing VPC peering with a Transit Gateway and enabling VPN encryption is not suitable for encrypting intra-region traffic directly between two VPCs. While Transit Gateway simplifies routing for many VPCs, VPN encryption on a Transit Gateway is primarily for securing connections from on-premises networks or for cross-region Transit Gateway peering, not for encrypting traffic between VPCs attached to the same Transit Gateway within a single region. This option is tempting as Transit Gateway is a central hub, and VPNs provide encryption, but it misapplies the VPN functionality.
- ✗
Enable encryption on the VPC peering connection.
Why it's wrong here
VPC peering does not support encryption at the connection level.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.