A company's cloud-hosted workloads in AWS communicate with on-premises systems via a VPN tunnel. Security requirements mandate that cloud workloads must not have direct paths to the on-premises OT segment. Which control enforces this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because controlling advertised routes (limiting what the cloud can see) combined with on-premises ACLs creates two enforcement points that prevent cloud-to-OT paths even if one control fails. A is wrong because Security Groups control cloud-inbound traffic but do not prevent cloud-originated traffic from traversing the VPN tunnel to on-premises segments.
Full explanation below image
Full Explanation
B is correct because controlling advertised routes (limiting what the cloud can see) combined with on-premises ACLs creates two enforcement points that prevent cloud-to-OT paths even if one control fails. A is wrong because Security Groups control cloud-inbound traffic but do not prevent cloud-originated traffic from traversing the VPN tunnel to on-premises segments. C is wrong because CloudTrail provides logging but no traffic control. D is wrong because NAT hides addresses but an attacker with VPN access can still scan and reach NAT-translated OT systems.