A ticket company wants customers on the public internet to reach a web application in a cloud VPC. Campus VPN users must keep today's site-to-site path. Which policy is the new requirement?
Select an answer to reveal the explanation.
Short Explanation
Your customers start on the public internet, so you publish the application at the cloud edge for inbound connectivity. You do not backhaul the VPC’s outbound traffic through campus or change a VPN the customers do not use. Campus users keep the site-to-site path they already have.
Full Explanation
Inbound internet connectivity lets sessions that start on the public internet reach the application through the cloud edge, typically using a public load balancer or internet gateway together with a security rule for the application. That meets the new requirement while leaving the site-to-site VPN in place for campus users. Backhauling the VPC’s outbound internet traffic through the campus firewall changes the path for traffic that starts inside the VPC; it does not let internet customers in. An east-west rule that stops communication between two private subnets segments internal traffic, but does not publish the application to the public internet. A longer IKE lifetime changes rekey timing on the site-to-site VPN. Since internet customers do not use that VPN, changing its lifetime does not create a public front door. Exam caveat: publishing inbound access still requires least-privilege security rules; reachability does not imply opening every port on a public address. Practical check: from outside campus, verify that a client can reach the application through its cloud public endpoint, while a campus test confirms the site-to-site tunnel remains up.