A manufacturer must link a factory to AWS production VPCs and to analytics running in Google Cloud. Factory control traffic needs consistent private throughput to AWS, link-layer encryption on dedicated circuits, dynamic routing with failover, plus encrypted connectivity to Google Cloud without leased lines. Which secure connectivity architecture should the network security engineer design for hybrid and multi-cloud links?
Select an answer to reveal the explanation.
Short Explanation
You get dedicated, consistent throughput to AWS and encrypted connectivity to Google without leased lines. Your factory uses MACsec on the AWS circuits, while VPN tunnels securely bridge to Google.
Full Explanation
Direct Connect provides dedicated private throughput from the factory to AWS, and MACsec adds link-layer encryption on those circuits. Transit Gateway centralizes VPC connectivity, while BGP supports dynamic routing and failover; a BGP-routed IPsec VPN to Google HA VPN provides encrypted connectivity without leased lines to Google. Direct Connect without MACsec misses the required link-layer encryption on dedicated circuits. Using AWS Site-to-Site VPN for factory-to-AWS traffic adds encryption and BGP routing, but internet-based VPN does not meet the requirement for consistent private throughput. Adding dedicated Interconnect to Google with BGP failover provides private connectivity, but violates the requirement to reach Google without leased lines. For exams, distinguish MACsec’s link-layer protection on a circuit from IPsec’s encryption of VPN traffic; the requirements may call for both. In practice, verify MACsec key agreement and cipher status, check that BGP peers advertise expected routes, and test failover by draining a Direct Connect path and an HA VPN tunnel while measuring convergence and packet loss.