Remote municipal staff need encrypted access from home networks into a private cloud VPC without exposing every server to the public internet. Which connectivity approach fits?
Select an answer to reveal the explanation.
Short Explanation
A VPN is the locked tunnel from home Wi-Fi into the city’s private cloud neighborhood. Staff get encrypted access without hanging every server on the open internet. Open management ports or USB sneakernet are not that tunnel.
Full Explanation
A virtual private network establishes an encrypted tunnel over the public internet into a private cloud network such as a VPC, allowing remote municipal staff to reach internal management and application endpoints without broadly publishing those servers on the open internet. With strong identity controls, VPN access remains a standard pattern for home or field workers who must administer private cloud resources. Publishing every management port with an open security group and no authentication maximizes exposure and violates least-privilege networking for city systems. Unencrypted FTP into a public object bucket is neither a private VPC path nor an acceptable channel for privileged administration. Shipping USB drives nightly cannot provide interactive, timely access to private VPC resources and introduces chain-of-custody and malware risks. Exam caveat: a VPN encrypts the transit path but does not replace multifactor authentication, device posture checks, just-in-time privilege, or segmentation inside the VPC—Cloud+ expects defense in depth, not tunnel-only security. Operational check: enforce MFA on the VPN gateway, advertise only required routes, remove direct public management ports, centralize connection and auth logs, review membership after role changes, and periodically test that remote sessions still land only in approved administrative subnets.