A company's cloud-hosted workloads in AWS communicate with on-premises systems via a VPN tunnel. Security requirements mandate that cloud workloads must not have direct paths to the on-premises OT segment. Which control enforces this?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to stop the cloud from even seeing or reaching the OT segment, so advertise only non-OT routes into the VPN tunnel and use on-premises ACLs to block cloud source IPs from the OT VLAN. That gives you two enforcement points, so if one fails the other still blocks the path.
Full Explanation
The correct control is configuring the on-premises VPN concentrator to advertise only non-OT routes into the cloud VPN tunnel and implementing ACLs that deny cloud source IPs from reaching the OT VLAN. This works because controlling advertised routes limits what the cloud can see, while on-premises ACLs block traffic that still attempts to reach the OT segment; together they create two enforcement points that prevent cloud-to-OT paths even if one control fails. The Security Groups option is wrong because Security Groups control cloud-inbound traffic but do not prevent cloud-originated traffic from traversing the VPN tunnel to on-premises segments. The CloudTrail logging option is wrong because CloudTrail provides logging but no traffic control. The NAT option is wrong because NAT hides addresses but an attacker with VPN access can still scan and reach NAT-translated OT systems.