CAS-004 Security Architecture Practice Question
A company uses a hybrid cloud model with workloads on AWS and on-premises. They need to ensure secure connectivity between the two environments with high bandwidth and low latency, bypassing the public internet. Which solution should they implement?
⚠ Common exam trap
The trap is confusing 'private connectivity' solutions — candidates pick PrivateLink or VPN thinking they provide dedicated bandwidth, but only Direct Connect offers a dedicated, non-internet circuit with guaranteed performance characteristics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure AWS Direct Connect for dedicated private connectivity
AWS Direct Connect provides a dedicated, private network connection between on-premises infrastructure and AWS, bypassing the public internet entirely. It delivers consistent high bandwidth and low latency, which is exactly what hybrid workloads requiring predictable performance need. Because traffic never traverses the public internet, Direct Connect also improves security posture by reducing exposure to internet-based threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure AWS Direct Connect for dedicated private connectivity
Why this is correct
AWS Direct Connect provisions a dedicated private network link between on-premises infrastructure and AWS, bypassing the public internet. This satisfies the hybrid requirement for high bandwidth, low latency and consistent connectivity, unlike VPN tunnels that traverse public networks.
- ✗
Implement SD-WAN with integrated security
Why it's wrong here
SD-WAN with integrated security still routes traffic over public internet paths, so it cannot guarantee the dedicated high bandwidth and low latency required. It is tempting because SD-WAN securely connects distributed sites, and would be correct for managing branch connectivity, whereas bypassing the internet needs a dedicated private circuit such as AWS Direct Connect.
- ✗
Establish a site-to-site VPN over the internet
Why it's wrong here
A site-to-site VPN traverses the public internet, so it cannot bypass it or guarantee the high bandwidth and low latency required. It is tempting because VPNs are quick to deploy and encrypt traffic, and it would be correct for lower-cost, moderate-bandwidth connectivity where internet routing is acceptable.
- ✗
Use AWS PrivateLink to access VPC endpoints
Why it's wrong here
AWS PrivateLink exposes specific services via interface endpoints inside a VPC; it does not provide a high-bandwidth, low-latency transport between on-premises networks and AWS. It is tempting because PrivateLink keeps traffic off the public internet, and it would be correct for privately accessing a single AWS service from a VPC.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.