CAS-004 Security Architecture Practice Question
A security architect is designing a hybrid cloud environment. The organization requires low-latency, private connectivity between on-premises and a public cloud provider, bypassing the public internet. Which solution best meets this requirement?
⚠ Common exam trap
CAS-005 often tests the distinction between 'private connectivity to cloud services' (PrivateLink) and 'dedicated private circuit to on-premises' (Direct Connect/ExpressRoute) — candidates conflate the two because both use the word 'private.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Direct Connect / ExpressRoute
Direct Connect (AWS) and ExpressRoute (Azure) provide dedicated private circuits from on-premises to the cloud provider, bypassing the public internet entirely. This delivers predictable low latency, higher bandwidth, and stronger security than internet-based options. It directly satisfies the 'private connectivity, bypassing the public internet' requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Site-to-site VPN over the internet
Why it's wrong here
A site-to-site VPN carries encrypted traffic across the public internet, so it fails the requirement to bypass the internet entirely. It is tempting because it is private in the sense of encryption and quick to deploy, and would be correct for a low-cost, lower-bandwidth hybrid link where latency guarantees are unnecessary.
- ✗
Private link (e.g., AWS PrivateLink)
Why it's wrong here
AWS PrivateLink provides private connectivity to services within AWS or from on-premises via Direct Connect, but it does not itself deliver the dedicated on-premises-to-cloud circuit the scenario requires. It is tempting because it keeps traffic off the public internet, and would be correct for privately accessing a specific SaaS or VPC endpoint.
- ✓
Direct Connect / ExpressRoute
Why this is correct
Direct Connect and ExpressRoute provide dedicated private circuits from on-premises into the cloud provider's network, so traffic never traverses the public internet. This satisfies the low-latency, private connectivity constraint, unlike site-to-site VPNs, which still ride the internet.
- ✗
SD-WAN with internet breakout
Why it's wrong here
SD-WAN with internet breakout routes traffic across public internet paths, so it cannot guarantee private, low-latency connectivity that bypasses the internet. It is tempting because SD-WAN optimises and prioritises WAN traffic, and would be correct for improving branch application performance over existing broadband links.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.