You are designing network connectivity for your thick client application. The application is designed for business travellers who must be able to connect to it from their hotel rooms, cafes, public Wi-Fi hotspots, and elsewhere on the Internet. But you do not want to publish the application on the Internet.

Answer options:

A.Implement AWS Direct Connect, and create a private interface to your VPC. Create a public subnet and place your application servers in it.
B.Implement Elastic Load Balancing with an SSL listener that terminates the back-end connection to the application.
C.Configure an IPsec VPN connection, and provide the users with the configuration details. Create a public subnet in your VPC, and place your application servers in it.
D.Configure an SSL VPN solution in a public subnet of your VPC, then install and configure SSL VPN client software on all user computers. Create a private subnet in your VPC and place your application servers in it.

Answer – D
Option A is incorrect because AWS Direct Connect is not a cost-effective solution compared to using a VPN solution.
Option B is incorrect because it does not mention how the application would be accessible only to business travellers and not to the public.
Option C is incorrect because IPsec requires third-party client software, so it is more expensive to set up and maintain. And it would be better to move the instances to a private subnet.
Option D is CORRECT because configuring the SSL VPN solution is cost-effective and allows access only to business travelers. Since the application servers are in a private subnet, the application is not accessible via the internet.
For more details, please refer to section "AWS Client VPN Categories" in the below link-
https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-user-what-is.html