A global Finance company has set up a Hybrid network architecture for its database servers deployed in VPC private subnets. Warm Standby DR architecture is deployed with data synchronization between multiple on-premises locations & these servers. Internet users upload a high amount of data to servers based at multiple locations & the same is continuously replicated to backup servers in VPC. For data replication, encrypted DMVPN dynamic tunnels will be used to meet security compliance as per company security guidelines. Security Head wants no traffic should be exposed to the Internet in any circumstances. As an AWS consultant, which of the following can be designed to meet this high bandwidth secure data transfer requirement?

Answer options:

A.Use AWS managed VPN over Public VIF terminating on Amazon EC2 instance with VPN software.
B.Use VPN Tunnel over Private VIF to terminate on Amazon EC2 instance with VPN software.
C.Use VPN Tunnel over Private VIF to terminate on VGW.
D.Use AWS managed VPN over Public VIF terminating on VGW.

Correct Answer – B
For high bandwidth requirements, AWS Direct Connect links can be used. Since the client is looking for DMVPN tunnels, it needs to use the software VPN option terminated on the Amazon EC2 instance. All data can be encrypted using Software VPN which will be implemented over Private VIF direct connect links.
Option A is incorrect as AWS Managed VPN can terminate on VGW & not on EC2 instances.
Options C & D are incorrect as DMVPN is not supported by VGW, it supports only IPsec VPN tunnels.
For more information on encrypting traffic between on-premises & AWS, refer to the following URL
https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/network-to-amazon-vpc-connectivity-options.html