A city datacenter needs encrypted site-to-site connectivity into a VPC over the internet for daily operations. Which AWS connectivity option maps to that need?
Select an answer to reveal the explanation.
Short Explanation
Need a locked tunnel from the city basement network into the VPC across the public internet? That is AWS Site-to-Site VPN—encrypted pipes, not a CDN signed URL trick.
Full Explanation
A city datacenter that needs encrypted site-to-site connectivity into a VPC over the internet should use AWS Site-to-Site VPN. Site-to-Site VPN creates IPsec tunnels between customer gateway devices and AWS virtual private gateways or transit gateways, encrypting traffic as it traverses the public internet. That pattern fits daily hybrid operations when a dedicated Direct Connect circuit is not yet available or as a backup path alongside Direct Connect.
CloudFront signed URLs authorize access to specific objects via the CDN; they are not site-to-site network tunnels for datacenter traffic. AWS DataSync transfers and synchronizes datasets to AWS storage services; its public endpoints are not a full VPN replacement for general VPC traffic. S3 Transfer Acceleration speeds object transfers via edge locations; it does not provide a private WAN replacement for arbitrary VPC connectivity.
Exam caveat: Connectivity trio—public internet (open/HTTPS), Site-to-Site VPN (encrypted tunnels over internet), Direct Connect (dedicated private connectivity). Stems that say “encrypted” + “over the internet” + “datacenter to VPC” point to Site-to-Site VPN.
Operational check: configure redundant tunnels, use BGP where supported, restrict security groups to the on-premises CIDR, monitor tunnel state CloudWatch metrics, and test failover during a maintenance window so public-works applications survive a single tunnel failure. Document whether the VPN is primary or backup relative to any planned Direct Connect.