SCS-C02 Infrastructure Security Practice Question
A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The security team wants to encrypt all traffic between on-premises and the VPC. Which solution should be used?
⚠ Common exam trap
It's easy for candidates to assume Direct Connect inherently provides encryption because it is a private connection, but AWS explicitly states that Direct Connect does not encrypt traffic, and the correct approach is to overlay an IPsec VPN tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up an IPsec VPN over the Direct Connect connection
Direct Connect does not natively encrypt traffic; it provides a private, low-latency connection but the data traverses it in cleartext. By establishing an IPsec VPN tunnel over the Direct Connect link (often called a 'Direct Connect VPN' or using a virtual private gateway with a VPN attachment), you encrypt all traffic between on-premises and the VPC at the network layer, meeting the security team's requirement for encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable encryption on the Direct Connect virtual interface
Why it's wrong here
Direct Connect virtual interfaces are Layer 2 VLANs and Layer 3 BGP sessions; they have no native encryption option, so you cannot simply 'enable encryption' on a VIF. Traffic traverses the dedicated fiber in clear text unless you add an encryption layer such as IPsec or MACsec. The absence of an 'encrypt this VIF' toggle is a fundamental AWS design; any encryption must be terminated outside the VIF itself.
- ✗
Use VPC Peering with encryption
Why it's wrong here
VPC peering connects two VPCs using private IP addresses over the AWS network, but it is not designed for on-premises connectivity and offers no built-in encryption. The 'with encryption' phrasing is misleading because VPC peering has no configurable encryption feature; traffic between peered VPCs is not automatically protected. Even if a peering relationship could stretch to your data center, it would fail both requirements: reachability and confidentiality.
- ✓
Set up an IPsec VPN over the Direct Connect connection
Why this is correct
Yes—this is the standard pattern when you need encryption over Direct Connect. You can deploy a site-to-site VPN on a public virtual interface, or terminate a software VPN on an EC2 instance behind a private VIF, so IPsec encapsulates the IP packets and secures the entire path while still benefiting from Direct Connect's bandwidth and latency. IPsec provides authenticity, integrity, and confidentiality for all traffic, making it the appropriate answer for the stated requirement.
- ✗
Configure TLS on all applications
Why it's wrong here
TLS protects application-level data during specific sessions (e.g., HTTPS APIs), but it does nothing for non-TLS traffic or for infrastructure protocols such as DNS, routing, or database replication. More importantly, it does not encrypt the network path itself—packet metadata and any other plaintext traffic over the Direct Connect link remain visible. The requirement to 'encrypt the connection' calls for a network-layer tunnel like IPsec, not per-application encryption.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.