Exams / SCS-C03 / Study guide / Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access)

Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access): SCS-C03 study notes and practice questions

What to know about Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access) for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.

Last verified November 2026 against current AWS documentation ·How we write our questions

What to know for the exam

These questions describe a company that links on-premises data centers or offices to AWS and must meet a rule such as “traffic must be encrypted in transit” or “no traffic may cross the public internet.” You choose the connectivity option and the encryption layer that meet the rule without an unnecessary build.

Connectivity options

Site-to-Site VPN runs two IPsec tunnels per connection over the internet to a virtual private gateway or a Transit Gateway. Traffic is encrypted, but it crosses the internet, so latency and bandwidth vary.
Direct Connect provides a dedicated or hosted network connection to AWS. The path is private, not internet-routed, but it is not encrypted by default.
MACsec encrypts traffic at layer 2 between your device and the AWS device at the connection’s location. It is available only on supported dedicated Direct Connect connections. Hosted connections do not support it.
VPN over Direct Connect runs an IPsec Site-to-Site VPN across a Direct Connect public virtual interface, or across a transit virtual interface with a private IP VPN. Traffic is encrypted and stays off the public internet.
Client VPN gives remote users an encrypted tunnel into a VPC. Read the Client VPN guide for how it works.
Verified Access gives per-request access to specific applications, with no VPN and no network-wide tunnel.

Read the Site-to-Site VPN how-it-works guide for the tunnel design, and the MACsec guide for supported connections.

How to choose

Scenario wording	Pick
Quick encrypted link, no dedicated circuit	Site-to-Site VPN with two tunnels
Private, high-bandwidth link where encryption is not required	Direct Connect
Encrypt a Direct Connect link at layer 2	MACsec on a dedicated connection
Encrypt Direct Connect traffic with IPsec and keep it off the internet	VPN over Direct Connect
Remote staff reach a VPC through an encrypted tunnel	Client VPN
Remote staff reach one internal app with per-request checks	Verified Access

Common traps

Calling Direct Connect encrypted. It is private. An encryption requirement still needs MACsec or VPN over Direct Connect.
MACsec on a hosted connection. It needs a supported dedicated connection.
Relying on a VPN alone when the rule says no traffic on the public internet. IPsec traffic still crosses the internet.
A single tunnel as the design. Each connection has two tunnels for redundancy, and both should be used.
Verified Access for a whole network. It fits per-application access, not site-to-site routing.

Try the 1 practice question

Practice Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access)Take the free practice exam

Question 1

Medium ·Link to this question

A regional energy utility connects its control center to AWS with an AWS Direct Connect dedicated connection at 10 Gbps. A regulator requires that traffic on the physical link between the utility routers and AWS be encrypted at the link layer. The application teams do not want to change their code, and they do not want to manage new tunnels.

The utility wants the full 10 Gbps of the link to stay usable, with encryption that covers the whole link rather than individual flows.

Which solution meets these requirements?

Choose one answer.

A. Order a dedicated connection on a MACsec-capable port, and configure MACsec with connection keys on the utility router and the AWS side, so the physical link is encrypted.
B. Create a Site-to-Site VPN over the Direct Connect connection, and send all traffic between the control center and the VPCs through IPsec tunnels that the team manages.
C. Order a hosted connection of 1 Gbps through an APN partner, and turn on TLS for each application endpoint in the VPCs so that the sessions are encrypted end to end.
D. Add a second Direct Connect connection through a Transit Gateway, so that traffic is spread across two links for resilience, and no encryption is needed on either one.

Show the answer and explanation

Answer: A

A. Right: Correct. MACsec encrypts the frames on the physical link, so applications need no change and the full dedicated bandwidth remains available. This meets the link-layer requirement that a tunnel cannot meet at full rate. Learn more: MACsec encryption for AWS Direct Connect (opens in a new tab)
B. Wrong: The VPN encrypts traffic at the IP layer, but each tunnel has a limited throughput, so the full 10 Gbps cannot be used. It also does not encrypt the physical link as the regulator asked, and the tunnels add endpoints to manage.
C. Wrong: TLS encrypts individual application sessions, not the link, so it misses the regulator requirement. A 1 Gbps hosted connection also falls short of the 10 Gbps need.
D. Wrong: A second link adds resilience, but it does not encrypt the traffic on either link. The regulator requirement is about encryption, so this design still fails it.

Explanation

MACsec encrypts the physical link on supported dedicated connections, so the applications stay unchanged and the full bandwidth remains. A site-to-site VPN limits throughput and does not encrypt the link, hosted connections are too slow, and a second link adds no encryption.

Study

Want more on Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access)? The 5 full-length practice sets have 5 more Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access)

MAC security (MACsec)