A company connects its data center to its cloud provider through a dedicated private circuit from a telecommunications carrier. The network team says traffic on the circuit does not need encryption because it does not cross the public internet. What is the best response?
Select an answer to reveal the explanation.
Short Explanation
A private circuit is like a private road: fewer cars, but nobody locked the trucks driving on it. The carrier's equipment and the provider's edge still see your traffic in the clear, so you still need to encrypt it yourself. Don't confuse isolation with confidentiality; they aren't the same thing.
Full Explanation
Dedicated connectivity services provide a private path with predictable performance between a customer's network and a cloud provider, but privacy of routing is not encryption. Traffic traverses carrier equipment, colocation cross-connects and provider edge devices, any of which could be misconfigured, tapped or compromised, and many dedicated connection offerings do not encrypt traffic by default. Applying IPsec tunnels over the circuit, enabling MACsec at layer 2 where both ends support it, or ensuring application traffic uses TLS provides confidentiality and integrity regardless of the path. Treating the circuit as trusted internal traffic reflects an outdated perimeter assumption and leaves sensitive data exposed to anyone with access to intermediate equipment. A nondisclosure agreement is a contractual remedy after misuse; it cannot technically prevent interception by the carrier's staff or by an attacker on the carrier's network. Replacing the circuit with an internet connection would discard the performance and isolation benefits that justified the circuit, and the public path would still need encryption. Exam caveat: data in transit must be protected on every untrusted segment, and anything outside the organization's control is untrusted. Operational check: capture traffic at the edge router and confirm that payloads on the circuit are encrypted.