A contractor can save money with an internet VPN into a commercial cloud region. The workload must run in the dedicated government cloud offering that holds the FedRAMP authorization the contract names, and must stay off the public internet. Which recommendation fits?
Select an answer to reveal the explanation.
Short Explanation
A cheaper door in the wrong building is still the wrong building, and it opens onto the public street. You recommend private connectivity into the FedRAMP-authorized offering. Matching the cipher does not move the workload into that offering or off the internet, and this is a design fit rather than a legal opinion.
Full Explanation
The requirement has two parts. The workload must run in the FedRAMP-authorized offering, and the path must stay off the public internet. Private connectivity into that offering is the design that fits. An internet VPN into a commercial region fails both. The region is outside the authorized boundary, and the path is the public internet. Encryption being similar does not change either fact. Direct internet access into the authorized offering still crosses the public internet, so the path constraint fails even if the landing zone is right. A public website certificate is not a private path and does not place the workload in the authorized offering. Exam caveat: the private circuit does not create the FedRAMP authorization. The offering has to already be the authorized one. This question is not legal advice. Operational check: the account or subscription should be the authorized offering, and the route for the workload should use the private interconnect rather than the commercial VPN.