CAS-004 Security Architecture Practice Question
A company is migrating critical applications to a multi-cloud architecture using AWS and Google Cloud Platform (GCP). The security team must ensure secure connectivity between on-premises data centers and cloud environments while meeting data residency requirements in the EU. Which TWO solutions should the architect implement to address these requirements? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dedicated physical connections (e.g., AWS Direct Connect, GCP Dedicated Interconnect)
Private link services (AWS PrivateLink, GCP Private Service Connect) provide secure connectivity without traversing the internet, maintaining data privacy. Direct Connect (or equivalent dedicated connections) ensures reliable, low-latency connectivity with compliance benefits. VPNs are less secure and not preferred for high-performance workloads. CASB and SASE are not direct connectivity solutions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Dedicated physical connections (e.g., AWS Direct Connect, GCP Dedicated Interconnect)
Why this is correct
Dedicated connections provide high bandwidth, low latency, and help meet data residency by keeping traffic within trusted networks.
- ✓
Private link services (e.g., AWS PrivateLink, GCP Private Service Connect)
Why this is correct
Private link services enable secure, private connectivity between on-premises and cloud without exposing data to the internet.
- ✗
Cloud Access Security Broker (CASB)
Why it's wrong here
CASB is a security policy enforcement point, not a connectivity solution.
- ✗
Secure Access Service Edge (SASE)
Why it's wrong here
SASE is a framework for secure access, not a direct connectivity mechanism for hybrid cloud links.
- ✗
Site-to-site VPN with IPsec
Why it's wrong here
VPNs are less secure and may not meet performance or compliance requirements for critical applications.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.