A public-works office needs encrypted connectivity between its on-premises network and an Amazon VPC over the public internet. Which option fits?
Select an answer to reveal the explanation.
Short Explanation
A VPN is a secure tunnel over the public internet—like a sealed tube between city hall and the VPC. Transfer Acceleration speeds S3 uploads, Lightsail DNS is naming for simple apps, and Personalize is ML recommendations—not hybrid encrypted links.
Full Explanation
A public-works office that needs encrypted connectivity between its on-premises network and an Amazon VPC over the public internet should use AWS Site-to-Site VPN (with Client VPN as the related pattern when individual users need remote access). Site-to-Site VPN creates encrypted IPsec tunnels from customer gateway devices to AWS virtual private gateways or transit gateways so hybrid traffic can traverse the internet securely. That matches the exam language of encrypted hybrid connectivity over the public internet into a VPC.
Amazon S3 Transfer Acceleration speeds object transfers to S3 via edge locations; it is not a site-to-site IPsec VPN replacement for general private-subnet application traffic. Amazon Lightsail DNS features do not automatically create encrypted VPC peering to on-premises networks. Amazon Personalize is a machine-learning recommendations service, not a managed VPN concentrator for municipal hybrid networking.
Exam caveat: Encrypted hybrid connectivity over the internet → VPN. Dedicated private connectivity with more consistent performance → Direct Connect. Object transfer acceleration → S3 Transfer Acceleration. Keep this connectivity trio distinct on Cloud Practitioner items.
Operational check: configure redundant Site-to-Site tunnels, monitor tunnel-state CloudWatch metrics, restrict security groups to on-premises CIDR ranges, test failover during a maintenance window, and document whether Direct Connect will later become primary with VPN remaining as encrypted backup for public-works systems.