How to Encrypt Traffic Over AWS Direct Connect Using IPsec or MACsec
A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)
Quick Answer
The answer is to establish an IPsec VPN tunnel over the Direct Connect connection or enable MACsec at the physical layer. IPsec works by creating an encrypted tunnel over the existing private virtual interface, securing all IP traffic between your on-premises network and VPC without altering the underlying Direct Connect link. MACsec, on the other hand, provides encryption at Layer 2 by securing the physical connection itself, ensuring that all data traversing the fiber is encrypted before it leaves the local device. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of encryption options for dedicated network paths, often appearing as a trap where candidates confuse application-level encryption like SSL/TLS with link-layer security. A common mistake is selecting AWS KMS or Certificate Manager, which manage keys and certificates but do not encrypt traffic in transit. Remember the memory tip: “IPsec for the tunnel, MACsec for the cable” to quickly recall which two methods encrypt Direct Connect traffic.
⚠ Common exam trap
It's easy for candidates to assume encryption must happen at higher layers (like SSL/TLS) or through a separate service (like KMS), but the exam tests knowledge of Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec over Direct Connect) as the two valid methods to encrypt traffic over a Direct Connect connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MACsec on the Direct Connect connection.
MACsec (IEEE 802.1AE) provides encryption at Layer 2 (data link layer) and can be enabled directly on a Direct Connect connection. This encrypts all traffic between the on-premises router and the AWS Direct Connect endpoint without requiring any changes to higher-layer protocols, making it transparent to applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS KMS to encrypt the traffic.
Why it's wrong here
KMS manages keys but does not encrypt network traffic.
- ✗
Use AWS Certificate Manager to issue certificates for the connection.
Why it's wrong here
ACM provides certificates for SSL/TLS, not for Direct Connect encryption.
- ✓
Enable MACsec on the Direct Connect connection.
Why this is correct
MACsec provides encryption at the data link layer.
- ✗
Use SSL/TLS to encrypt the traffic between on-premises and AWS.
Why it's wrong here
SSL/TLS is application-specific, not a comprehensive solution for all traffic.
- ✓
Establish an IPsec VPN tunnel over the Direct Connect connection.
Why this is correct
IPsec provides encryption at the network layer.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to use AWS Direct Connect to establish a dedicated network connection from its on-premises data center to AWS. Which of the following is a security best practice when configuring Direct Connect?
easy- A.Use a private virtual interface (VIF) and enable IPsec encryption for the traffic.
- B.Use a public VIF to access all AWS services including VPC resources.
- ✓ C.Use a private VIF and establish an IPsec VPN tunnel over the Direct Connect connection.
- D.Use a private VIF and enable MACsec encryption at the physical layer.
Why C: The security best practice for encrypting Direct Connect traffic is to establish an IPsec VPN tunnel over a private virtual interface (VIF). This adds Layer 3 encryption to the otherwise unencrypted dedicated connection, protecting data in transit. Option A is misleading because IPsec is not 'enabled' directly on a VIF; it requires a VPN connection. Option D (MACsec) provides Layer 2 encryption at the physical layer, but the question asks specifically for the recommended best practice, which is IPsec over private VIF.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.