SCS-C03 practice question: Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access)
Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A regional energy utility connects its control center to AWS with an AWS Direct Connect dedicated connection at 10 Gbps. A regulator requires that traffic on the physical link between the utility routers and AWS be encrypted at the link layer. The application teams do not want to change their code, and they do not want to manage new tunnels.
The utility wants the full 10 Gbps of the link to stay usable, with encryption that covers the whole link rather than individual flows.
Which solution meets these requirements?
Choose one answer.
AA. Order a dedicated connection on a MACsec-capable port, and configure MACsec with connection keys on the utility router and the AWS side, so the physical link is encrypted.
BB. Create a Site-to-Site VPN over the Direct Connect connection, and send all traffic between the control center and the VPCs through IPsec tunnels that the team manages.
CC. Order a hosted connection of 1 Gbps through an APN partner, and turn on TLS for each application endpoint in the VPCs so that the sessions are encrypted end to end.
DD. Add a second Direct Connect connection through a Transit Gateway, so that traffic is spread across two links for resilience, and no encryption is needed on either one.
Show the answer and explanation
Answer: A
A. Right: Correct. MACsec encrypts the frames on the physical link, so applications need no change and the full dedicated bandwidth remains available. This meets the link-layer requirement that a tunnel cannot meet at full rate. Learn more: MACsec encryption for AWS Direct Connect (opens in a new tab)
B. Wrong: The VPN encrypts traffic at the IP layer, but each tunnel has a limited throughput, so the full 10 Gbps cannot be used. It also does not encrypt the physical link as the regulator asked, and the tunnels add endpoints to manage.
C. Wrong: TLS encrypts individual application sessions, not the link, so it misses the regulator requirement. A 1 Gbps hosted connection also falls short of the 10 Gbps need.
D. Wrong: A second link adds resilience, but it does not encrypt the traffic on either link. The regulator requirement is about encryption, so this design still fails it.
Explanation
MACsec encrypts the physical link on supported dedicated connections, so the applications stay unchanged and the full bandwidth remains. A site-to-site VPN limits throughput and does not encrypt the link, hosted connections are too slow, and a second link adds no encryption.
Want more on Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access)? The 5 full-length practice sets have 5 more Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →