A bank's adopted control requires the records path to be encrypted. The path today is an AWS Direct Connect private virtual interface with no encryption. Staying off the public internet is also required. What should they add?
Select an answer to reveal the explanation.
Short Explanation
You’ve got the private path, but the records still travel without encryption. Add IPsec over the existing Direct Connect path to encrypt the payload while keeping it off the public internet. A replacement internet VPN would break the private-path requirement, so this is a design fit rather than a legal opinion.
Full Explanation
Direct Connect is not encrypted by itself. A private virtual interface keeps the records off the public internet, but it does not satisfy a control that also requires encryption. Adding IPsec over the existing Direct Connect path encrypts the payload without moving the underlay onto the public internet, meeting both requirements. A replacement internet VPN would encrypt the payload, but it would put the records on the public internet and fail the second constraint. A longer BGP keepalive changes routing-session behavior; it does not encrypt the payload. The Direct Connect port’s public website certificate is not encryption for the VLAN, so it cannot protect the records on that path. Exam caveat: private routing and encryption are separate requirements; meeting one does not imply that you have met the other. This question is not legal advice. Practical check: inspect a capture on the private path to confirm it shows IPsec rather than readable records, and verify that routes still use the Direct Connect virtual interface rather than an internet default.