CAS-004 Security Architecture Practice Question
A security architect is designing a hybrid cloud environment with workloads in AWS and on-premises. The architect needs to ensure secure, low-latency connectivity between the two environments without traversing the internet. Which solution should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Direct Connect
AWS Direct Connect provides dedicated private network connectivity from on-premises to AWS, offering low latency and security without internet exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Direct Connect
Why this is correct
AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet entirely. This satisfies both constraints in the stem: low latency, since traffic avoids internet routing variability, and security, since data never traverses public infrastructure. Site-to-Site VPN would encrypt traffic but still traverse the internet, failing the no-internet requirement.
- ✗
Site-to-site VPN over the internet
Why it's wrong here
A site-to-site VPN carries traffic across the public internet, contradicting the no-internet traversal requirement, and its latency varies with internet routing. It is the right choice when encrypting connectivity over untrusted public networks is acceptable and dedicated private circuits are unavailable or too costly.
- ✗
AWS Client VPN
Why it's wrong here
Client VPN connects individual remote users' devices to AWS, not an on-premises network to a VPC, so it provides no site-to-site path. It is the correct selection when mobile or home workers need authenticated access to private AWS resources from wherever they are.
- ✗
AWS Transit Gateway with internet gateway
Why it's wrong here
An internet gateway routes traffic to and from the public internet, so on-premises connectivity through it traverses the internet and cannot meet the requirement. Transit Gateway is correct for hub-and-spoke routing between VPCs and attachments, but only when paired with Direct Connect or VPN for on-premises links.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.