A bank's control owner says a dataset must not cross the public internet and must run only in a FedRAMP-authorized cloud offering. Which connectivity recommendation fits?
Select an answer to reveal the explanation.
Short Explanation
A stronger lock on a public road still leaves you on the public road. You need a private path, and the workload still has to sit in the FedRAMP-authorized offering. A certificate on the branch router does not authorize the cloud service.
Full Explanation
The constraint has two parts: the path must stay off the public internet, and the workload must run in an offering that is inside the FedRAMP boundary. Private connectivity into that authorized offering is the design that satisfies both. Internet IPsec can land in an authorized region, and a longer IKE lifetime only changes how often the keys refresh. The packets still cross the public internet, so the path constraint fails. A colocation cross-connect is private, but a commercial region outside the authorized boundary fails the FedRAMP placement rule. Private does not substitute for the authorized offering. An ISO 27001 certificate on the branch router shows an information-security management claim about that product or that site. It does not authorize the cloud service, and leaving the workload on a public address also fails the path rule. Exam caveat: this is a design fit, not a legal opinion. FedRAMP authorizes the cloud offering. The circuit does not create that authorization by itself. Operational check: confirm the target account or subscription is the authorized offering, and confirm the route to the dataset uses the private interconnect rather than a default route to the internet.