A county must connect on-premises computer-aided dispatch (CAD) servers to a VPC for hybrid lookups without exposing CAD RDP to the open internet. Which connectivity approach should the architect choose?
Select an answer to reveal the explanation.
Short Explanation
Hybrid lookups need a private tunnel between the county datacenter and the VPC—not RDP hanging out on the internet. Site-to-Site VPN or Direct Connect with proper routing keeps CAD off the public sidewalk. Public RDP, anonymous S3 dumps, or wide-open security groups are non-starters for dispatch systems.
Full Explanation
Connecting on-premises computer-aided dispatch (CAD) servers to a VPC for hybrid lookups—without exposing CAD RDP to the open internet—calls for AWS Site-to-Site VPN or AWS Direct Connect with private routing between the datacenter and the VPC. Those connectivity options extend private IP reachability for lookups over an encrypted VPN or dedicated DX path, preserving public-safety system isolation from opportunistic internet RDP scanning.
Publishing CAD RDP endpoints on Elastic IPs and relying on an obscure nonstandard port fails because security through obscurity does not stop scanners and places critical public-safety admin interfaces on the internet. Copying CAD databases to a public S3 bucket each hour for anonymous VPC download fails conceptually: it creates uncontrolled public copies of sensitive dispatch data. Disabling all security groups so hybrid traffic is never filtered fails because it removes ENI-level allowlists needed even on private hybrid paths.
Exam caveat: VPN/DX provide connectivity, not application authorization—still restrict CAD ports to specific VPC CIDRs/security groups and monitor the hybrid path. Operational check: bring up VPN or DX with matching routes, confirm CAD hosts have no public RDP, test lookups from the VPC over private addressing, and verify internet hosts cannot reach CAD RDP listeners.