An Enterprise customer is starting its migration to the cloud for agility. They want to make their internal Microsoft Active Directory available to any applications running on AWS as a central point of user control for leavers and joiners. Internal users only have to remember one set of credentials. How could they make their Active Directory secure, highly available, and with minimal on-premises infrastructure changes in the most cost and time-efficient way?

Answer options:

A.Using Amazon Elastic Compute Cloud (EC2), they could create a DMZ using a security group. Within the security group, they could provision two smaller Amazon EC2 instances that are running Openswan for resilient IPSec tunnels, and two larger instances that are domain controllers. They would use multiple Availability Zones.
B.Using VPN, they could create an extension to their data center and use resilient hardware IPSec tunnels; they could then have two domain controller instances that are joined to their existing domain and reside within different subnets in different Availability Zones.
C.Within the customer’s existing infrastructure, they could provision new hardware to run Active Directory Federation Services. This would present Active Directory as a SAML2 endpoint on the internet. Any new application on AWS could be written to authenticate using SAML2.
D.The customer could create a stand-alone VPC with its own Active Directory Domain Controllers. Two domain controller instances could be configured, one in each Availability Zone, and new applications would authenticate with those domain controllers.

Answer – B
Option A incorrect because it is just a complicated environment to set up and does not meet the purpose of the requirement.
Option B is CORRECT because using an IPSec tunnel can help decrypt all the traffic from the on-premise to AWS. The domain controllers in separate AZ’s can address high availability.
Option C is incorrect because the question mentions that they want minimal changes to the on-premise environment.
Option D is incorrect because it does not address the secure communication part from on-premise to AWS.
For more information on creating VPN tunnels using Hardware VPN and Virtual private gateways, please refer to the below link-
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html